Review Results

Comment

The only change in .SRCINFO is a version bump from 7.2.2.lqx2 to 7.2.3.lqx1. No source URLs, checksums, build steps, install scripts, permissions, or package metadata beyond the version string were altered. On its face this is a routine upstream version update with no visible security red flags in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.2.2.lqx2
+	pkgver = 7.2.3.lqx1
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change only bumps the liquourix-package source tarball from 7.2-2 to 7.2-3 and updates its checksum in .SRCINFO. The upstream kernel source remains pinned and verified, and there are no new URLs, scripts, build-time fetches, or packaging behavior changes visible in this diff. On its face this is a routine metadata refresh with no obvious security impact.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.2-2.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.2-3.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1
 	sha512sums = SKIP
-	sha512sums = 540efb9756fbe8717fc7712ed4f81d708fdefb32aeca7f25b97bc8272011cdaa4ab873346d585bf4b0cb917914bfc99e3d9777609d6c72446dcb828a8a095d92
+	sha512sums = b9cebfc20d1ce9d294c68b16f5a2d9b577a8ee2200c80994876d4af0f8002045eb3acb41934a97fe2db8b8c406753c9c0ccd86ee0a642a462a05df8ba671cf08
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change is a routine version bump in PKGBUILD: it updates the Liquorix patch release number, pkgver, and the corresponding sha512 checksum for the source archive. There are no new sources, no network-fetching logic, no privilege-related changes, and no packaging/install script modifications. Based on the diff provided, this does not introduce an obvious security risk.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.2
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=2
+_lqxpatchrel=3
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.2.2.lqx2
+pkgver=7.2.3.lqx1
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change is limited to bumping the Liquorix patch release/version and updating the sha512 checksum for the corresponding source artifact. I did not see any new sources, build steps, network fetches, privilege changes, install scripts, or packaging behavior changes. This looks like a routine integrity update rather than a security concern.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1'
             'SKIP'
-            '540efb9756fbe8717fc7712ed4f81d708fdefb32aeca7f25b97bc8272011cdaa4ab873346d585bf4b0cb917914bfc99e3d9777609d6c72446dcb828a8a095d92')
+            'b9cebfc20d1ce9d294c68b16f5a2d9b577a8ee2200c80994876d4af0f8002045eb3acb41934a97fe2db8b8c406753c9c0ccd86ee0a642a462a05df8ba671cf08')