Review Results

Comment

The change is a trivial version bump in .SRCINFO from 7.2.2.lqx1 to 7.2.2.lqx2 with no accompanying source, build, install-script, or metadata changes. There are no new URLs, checksums, dependencies, scripts, or packaging behaviors introduced by this diff, so I see no security impact from the reviewed hunk alone.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.2.2.lqx1
+	pkgver = 7.2.2.lqx2
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change only updates the AUR metadata to point at a new upstream tarball release (7.2-2 instead of 7.2-1) and refreshes the corresponding sha512 checksum. The source remains the same official GitHub repository, over HTTPS, with no new build-time commands, scripts, or privilege-related artifacts introduced in this diff. No integrity or supply-chain red flags are evident from this metadata-only update.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.2-1.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.2-2.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1
 	sha512sums = SKIP
-	sha512sums = b14376a527a725eb088c3259483a1de4e352d5bacef1ce45c213036c111542bcfad824a15308a919a096b1b95fc25e6bbc70982e592d1adbac05500d45cea56c
+	sha512sums = bd61aa9687a688ccd033a438cc2c2efc20e0ddccdf09ffcee11d7cf748c98af366fefe5d99975803f8b1984d687007163668ebded0a085a68f1b31bb0e3766c4
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change only bumps the Liquorix patch release/version and updates the corresponding source checksum. No build logic, install scripts, permissions, or source URLs changed. The new source remains pinned to HTTPS GitHub release content, and there are no new red flags such as network fetches at build time or privilege-escalation behavior. This looks like a routine integrity update for a new upstream tarball.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.2
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=1
+_lqxpatchrel=2
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.2.2.lqx1
+pkgver=7.2.2.lqx2
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only updates the Liquorix patch release/version and the corresponding SHA-512 checksum for the new upstream tarball. The source URLs remain HTTPS and pinned to specific release artifacts, and there are no new build steps, network fetches, privilege changes, or packaging behavior changes in this diff. No security-relevant regression is evident from the checksum/version bump alone.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1'
             'SKIP'
-            'b14376a527a725eb088c3259483a1de4e352d5bacef1ce45c213036c111542bcfad824a15308a919a096b1b95fc25e6bbc70982e592d1adbac05500d45cea56c')
+            'bd61aa9687a688ccd033a438cc2c2efc20e0ddccdf09ffcee11d7cf748c98af366fefe5d99975803f8b1984d687007163668ebded0a085a68f1b31bb0e3766c4')