Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 7.1.11.lqx1 to 7.1.12.lqx1. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the reviewed diff. On its face this is a routine upstream version update with no security red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.1.11.lqx1
+	pkgver = 7.1.12.lqx1
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change is a routine metadata refresh in .SRCINFO for a new upstream package release: pkgver/pkgrel and the GitHub source tarball checksum were updated. The source URLs remain HTTPS and point to the same upstream project, with no new build-time code, install scripts, or privilege-related artifacts introduced in this diff. No security-relevant red flags are evident from the provided hunk.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.1-19.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.1-20.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc
 	sha512sums = SKIP
-	sha512sums = 965b42741810095723938c172084af5104a0f91f1e313b292d77effd21b0debace415b2e0fbcacbccaad4d0d649089218e334377a0ec8243565b2467d78a250f
+	sha512sums = 70f1060045cc14886e4ece5a1245ff2cf102c09fecb6d44acabab17171b0baa722ee4a67a8c7dafa9bbd4b39b4b4374942cd0aef0888cb46c444a4f250ec6222
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change is a routine version bump for the Linux Liquorix kernel package: it updates the package version, patch release number, and the sha512 checksum for the corresponding upstream source/patch artifact. I do not see any new sources, network fetches, privilege changes, install-script behavior, or packaging logic changes in this diff. The only security-relevant aspect is integrity metadata being updated to match a new upstream release, which is expected.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.1
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=19
+_lqxpatchrel=20
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.1.11.lqx1
+pkgver=7.1.12.lqx1
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only bumps the Liquorix patch release and updates the corresponding SHA-512 checksum for the upstream tarball in PKGBUILD. There are no new sources, no build-script changes, no added network fetches, and no privilege/persistence mechanisms introduced. The package still relies on HTTPS and existing PGP verification for the kernel source. This diff is low risk and appears to be a routine version/checksum refresh.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('d4d9c45261813559341c67ea53d4a47f5a04d1ad15e3c2b8222a09b5483380d2bfd31b8c675e144db2eb91f560d6cb28f66187a5ea4f24f6dfb82a4ad48064cc'
             'SKIP'
-            '965b42741810095723938c172084af5104a0f91f1e313b292d77effd21b0debace415b2e0fbcacbccaad4d0d649089218e334377a0ec8243565b2467d78a250f')
+            '70f1060045cc14886e4ece5a1245ff2cf102c09fecb6d44acabab17171b0baa722ee4a67a8c7dafa9bbd4b39b4b4374942cd0aef0888cb46c444a4f250ec6222')