Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 28.5 to 28.6. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were modified in the provided diff. On its face this is a routine upstream version update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.5
+	pkgver = 28.6
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO from OpenJFX 28.5 to 28.6, with the source URL still using HTTPS on the official GitHub repository and the checksum updated accordingly. No new sources, scripts, build steps, or packaging logic are introduced in this diff, and there are no signs of privilege escalation, network-at-build, or persistence mechanisms. Based on the provided hunk alone, this appears low risk.

@@ -27,13 +27,13 @@ pkgbase = java-openjfx
 	makedepends = unzip
 	makedepends = zip
 	options = !lto
-	source = java-openjfx-28.5.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+5.tar.gz
+	source = java-openjfx-28.6.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+6.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = 9922c3c35c25d83d8280442b91c000122b28e46c6473668eda0b643f9a7e4bba5b06115e140574c0f3c61d4de57d94f69d0332a65b3606b971124f91fa2d94f8
+	b2sums = 12fda3123df69f055bf4569028cfe773c4c84179394cb3e7fb028624a63aeed6b6c3b83d004f7fd9e502485ad3023b6d6cba19369cdbf8391d54c58437613cba
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change is a one-line version bump in PKGBUILD, updating the upstream tag from 28+5 to 28+6. No build logic, sources, checksums, install scripts, permissions, or package metadata beyond the version string are altered. On its face this does not introduce any new security-relevant behavior or supply-chain risk.

@@ -21,7 +21,7 @@ pkgname=(
 )
 _java_build_ver=25
 _java_run_ver=25
-_tag='28+5'
+_tag='28+6'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

The change only updates the b2sum for one declared source file in PKGBUILD. This is an integrity metadata change, not a build-script or packaging logic change, and there are no signs here of added network access, command execution, privilege escalation, or altered install behavior. I did not see any suspicious new sources or other red flags in the provided hunk. Risk is therefore very low.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('9922c3c35c25d83d8280442b91c000122b28e46c6473668eda0b643f9a7e4bba5b06115e140574c0f3c61d4de57d94f69d0332a65b3606b971124f91fa2d94f8'
+b2sums=('12fda3123df69f055bf4569028cfe773c4c84179394cb3e7fb028624a63aeed6b6c3b83d004f7fd9e502485ad3023b6d6cba19369cdbf8391d54c58437613cba'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'