Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver bump from 7.1.13 to 7.2.4. No build logic, sources, checksums, install scripts, or package metadata beyond the version number changed. While the upstream URL remains HTTP in the metadata, that is pre-existing and not introduced by this diff. Based on the provided change alone, there is no evidence of a security issue.

@@ -1,6 +1,6 @@
 pkgbase = linux-xanmod
 	pkgdesc = Linux Xanmod - Stable Mainline [MAIN]
-	pkgver = 7.1.13
+	pkgver = 7.2.4
 	pkgrel = 1
 	url = http://www.xanmod.org/
 	arch = x86_64

Comment

The change only updates the kernel upstream tarball and the XanMod patch to newer versions, with corresponding checksum updates. Sources remain HTTPS and pinned to specific release artifacts, and there are no new build-time commands, install scripts, or privilege/persistence mechanisms introduced in this diff. Based on the provided hunk alone, this looks like a routine version bump with no evident security red flags.

@@ -18,15 +18,15 @@ pkgbase = linux-xanmod
 	makedepends = tar
 	makedepends = xz
 	options = !strip
-	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.xz
-	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.1.tar.sign
-	source = patch-7.1.13-xanmod1.xz::https://sourceforge.net/projects/xanmod/files/releases/main/7.1.13-xanmod1/patch-7.1.13-xanmod1.xz/download
+	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
+	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
+	source = patch-7.2.4-xanmod1.xz::https://sourceforge.net/projects/xanmod/files/releases/main/7.2.4-xanmod1/patch-7.2.4-xanmod1.xz/download
 	source = choose-gcc-optimization.sh
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
-	sha256sums = 691f44797fbe790dc8a321604c927087526ad27b6d649925d60f8eed0a2564a0
+	sha256sums = f9fef3d14c0df53819026f4be74459835c2a0b0dcbf5b5bbd9ea19f0829402b3
 	sha256sums = SKIP
-	sha256sums = 205a4f38a3fe3716e84fb8497c472d7567f84cb579b3907057f01ec7a5c9f324
+	sha256sums = ed3bed407ec263b649c7c88243a8afaf3df74ee389e6e51fde18136b1078fc07
 	sha256sums = f4acc1760990c54348a029315d1505ccb7c7270cd70a9aeb728bffcced51e767
 
 pkgname = linux-xanmod

Comment

The change only bumps the package version from 7.1.13 to 7.2.4 and updates the corresponding source checksums. There are no new sources, no build-script logic changes, no added network fetches, and no packaging/install behavior changes. Based on the diff provided, this is a routine version refresh with no security impact evident.

@@ -72,8 +72,8 @@ fi
 ### IMPORTANT: Do no edit below this line unless you know what you're doing
 
 pkgbase=linux-xanmod
-_major=7.1
-pkgver=${_major}.13
+_major=7.2
+pkgver=${_major}.4
 _branch=7.x
 xanmod=1
 _revision=

Comment

The change is limited to updating PKGBUILD metadata and checksums for the package version bump from 7.1.13 to 7.2.4. I do not see any new sources, build commands, install scripts, privilege changes, or network-fetch behavior introduced by this diff. The checksum updates are consistent with the versioned source changes and do not by themselves indicate tampering. No security red flags are present in the reviewed hunk.

@@ -118,9 +118,9 @@ for _patch in ${_patches[@]}; do
     source+=("${_patch}::https://raw.githubusercontent.com/archlinux/svntogit-packages/${_commit}/trunk/${_patch}")
 done
 
-sha256sums=('691f44797fbe790dc8a321604c927087526ad27b6d649925d60f8eed0a2564a0'
+sha256sums=('f9fef3d14c0df53819026f4be74459835c2a0b0dcbf5b5bbd9ea19f0829402b3'
             'SKIP'
-            '205a4f38a3fe3716e84fb8497c472d7567f84cb579b3907057f01ec7a5c9f324'
+            'ed3bed407ec263b649c7c88243a8afaf3df74ee389e6e51fde18136b1078fc07'
             'f4acc1760990c54348a029315d1505ccb7c7270cd70a9aeb728bffcced51e767')
 
 export KBUILD_BUILD_HOST=${KBUILD_BUILD_HOST:-archlinux}