Review Results

Comment

The change is a simple version bump in .SRCINFO from 28.6 to 28.7 with no accompanying changes to sources, build logic, install scripts, or metadata that would indicate a security issue. On its face this is low risk; the only thing to verify outside this diff would be that the PKGBUILD/source checksums were updated consistently, but that is not shown here and there are no red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.6
+	pkgver = 28.7
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The change is limited to updating a build dependency in .SRCINFO from jdk25-openjdk to jdk26-openjdk. This does not introduce new sources, scripts, network access, privilege changes, or packaging behavior. The security impact is minimal and confined to which JDK version is required to build the package.

@@ -16,7 +16,7 @@ pkgbase = java-openjfx
 	makedepends = glib2
 	makedepends = gperf
 	makedepends = gtk3
-	makedepends = jdk25-openjdk
+	makedepends = jdk26-openjdk
 	makedepends = libgl
 	makedepends = libx11
 	makedepends = libxtst

Comment

The change is a routine version bump in .SRCINFO: it updates pkgver/source/checksum metadata from OpenJFX 28.6 to 28.7, adds gradle to makedepends, and bumps the JDK build dependency from jdk25-openjdk to jdk26-openjdk to match the PKGBUILD. The source remains the official OpenJFX GitHub release tarball over HTTPS, and there are no new scripts, patches, or install-time behaviors introduced by this metadata-only change. No supply-chain or privilege-escalation concerns are evident from the diff provided.

@@ -26,14 +26,15 @@ pkgbase = java-openjfx
 	makedepends = python
 	makedepends = unzip
 	makedepends = zip
+	makedepends = gradle
 	options = !lto
-	source = java-openjfx-28.6.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+6.tar.gz
+	source = java-openjfx-28.7.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+7.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = 12fda3123df69f055bf4569028cfe773c4c84179394cb3e7fb028624a63aeed6b6c3b83d004f7fd9e502485ad3023b6d6cba19369cdbf8391d54c58437613cba
+	b2sums = 72c1870d3f5cd0ce35aa66a7532cdc9a5e6c1213ba2ffee1f52bda958472bd76398036b96ac4c6d4b518d2e54b0ddb8991b35c50361a4671a559aa9506f077ec
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The only reviewed change flips the default from using the bundled Gradle wrapper to the system gradle, and bumps the upstream version/checksums accordingly. This does not introduce new network fetches, privilege escalation, install-script behavior, or suspicious packaging actions. The source remains HTTPS from the official OpenJFX GitHub release archive, and the rest of the PKGBUILD packaging logic is unchanged. Low risk.

@@ -11,7 +11,7 @@
 # Contributor: Jens Kapitza <j dot kapitza at schwarze-allianz dot de>
 # Contributor: Olli <olli at coderkun dot de>
 
-: ${_use_gradle_wrapper:=1}
+: ${_use_gradle_wrapper:=0}
 
 pkgbase=java-openjfx
 pkgname=(

Comment

The change is a routine version bump in PKGBUILD metadata: it updates the OpenJFX build/run version tags and the source checksum, and also disables use of the Gradle wrapper in favor of the packaged build tooling. I do not see any added network fetches, shell execution, privilege escalation, persistence mechanisms, or suspicious packaging behavior in the provided diff. The checksum update is expected for a new upstream release, and the version changes are consistent with a normal package refresh.

@@ -19,9 +19,9 @@ pkgname=(
   java-openjfx-doc
   java-openjfx-src
 )
-_java_build_ver=25
+_java_build_ver=26
 _java_run_ver=25
-_tag='28+6'
+_tag='28+7'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

The change is low risk. It updates the package to a newer upstream OpenJFX release, refreshes the source checksum, and disables use of the Gradle wrapper in favor of the package’s existing build tooling. I do not see any added network fetches, shell execution, privilege escalation, install-script changes, or suspicious sources in this diff. The only security-relevant aspect is the checksum update, which is expected for a version bump and does not by itself indicate tampering.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('12fda3123df69f055bf4569028cfe773c4c84179394cb3e7fb028624a63aeed6b6c3b83d004f7fd9e502485ad3023b6d6cba19369cdbf8391d54c58437613cba'
+b2sums=('72c1870d3f5cd0ce35aa66a7532cdc9a5e6c1213ba2ffee1f52bda958472bd76398036b96ac4c6d4b518d2e54b0ddb8991b35c50361a4671a559aa9506f077ec'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'