Review Results

Comment

The change only removes three validpgpkeys entries from .SRCINFO while leaving the source list and checksums unchanged. This does not introduce new code execution, network access, or packaging behavior; it merely narrows the set of accepted signing keys for upstream source verification. I see no security regression in the diff itself, though it could affect buildability if the PKGBUILD still expects those keys. From a security perspective this is low risk.

@@ -59,9 +59,6 @@ pkgbase = openssl-1.1
 	source = CVE-2026-45447-2.patch
 	source = CVE-2025-69419-1.patch
 	source = CVE-2025-69419-2.patch
-	validpgpkeys = 8657ABB260F056B1E5190839D9C4D26D0E604491
-	validpgpkeys = 7953AC1FBC3DC8B3B292393ED5E9E43F7DF9EE8C
-	validpgpkeys = A21FAB74B0088AA361152586B8EF1A6BA9DA2D5C
 	validpgpkeys = EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5
 	sha256sums = cf3098950cb4d853ad95c0841f1f9c6d3dc102dccfcacd521d93925208b76ac8
 	sha256sums = SKIP

Comment

The change only removes three PGP key fingerprints from validpgpkeys, leaving a single trusted signer. This does not introduce code execution, network access, privilege escalation, or packaging changes. It slightly narrows the set of acceptable signatures, which could affect build availability if upstream rotates signers, but it is not a security issue in itself and does not weaken integrity for the remaining source verification.

@@ -111,9 +111,6 @@ sha256sums=('cf3098950cb4d853ad95c0841f1f9c6d3dc102dccfcacd521d93925208b76ac8'
             'd89423836be0cb5ca076e173ea373c4deeef3d6ffa17085ca8a0850b364d7d3b'
             '933c61f15a81ac9c50f66f8c6c059d09f94a116d7b4c4d534a41b1c8f0140160')
 validpgpkeys=(
-	'8657ABB260F056B1E5190839D9C4D26D0E604491'
-	'7953AC1FBC3DC8B3B292393ED5E9E43F7DF9EE8C'
-	'A21FAB74B0088AA361152586B8EF1A6BA9DA2D5C'
 	'EFC0A467D613CB83C7ED6D30D894E2CE8B3D79F5'
 )
 noextract=(