Review Results

Comment

The change only bumps the package version in .SRCINFO from 7.2.4.lqx2 to 7.2.4.lqx3. No sources, build logic, install scripts, permissions, or package metadata affecting execution/persistence were changed. This is a low-risk metadata update with no security impact evident from the diff provided.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.2.4.lqx2
+	pkgver = 7.2.4.lqx3
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change is limited to .SRCINFO metadata for a version bump of the packaging repo source from 7.2-8 to 7.2-9, with the corresponding checksum updated. The kernel source remains pinned to the same HTTPS kernel.org tarball and the same PGP keys are retained. I do not see any new build-time execution, network fetches outside declared sources, privilege escalation, or suspicious install/persistence behavior in this diff. Risk is low because this is only metadata and the updated source is still a GitHub archive over HTTPS, but there is no evidence here of malicious content.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.2-8.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.2-9.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1
 	sha512sums = SKIP
-	sha512sums = 742ef7677a1241d6a4b69ec48b9e3429004bf7e18d943b5f4d2ae53aba13e98bea5515938a317320b1464249c420c9071ee246f8babd5894d9377e2cf4df7d5b
+	sha512sums = fe00356d2282f097a6e71e832c8e810f03dd08292dca153dbfaff970cdf384902fdd56ab75a0a722d36e0c6730655cb49fc70571b4a1f9b19d102a8b9d239ade
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change only bumps the Liquorix patch release/version and updates the corresponding source checksum. No new sources, build steps, privileges, network behavior, or packaging logic were introduced. The diff is limited to metadata needed to fetch and verify the new upstream tarball, so there is no security concern in this change itself.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.2
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=8
+_lqxpatchrel=9
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.2.4.lqx2
+pkgver=7.2.4.lqx3
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only bumps the package version and updates the sha512 checksum for an existing source artifact. I did not see any new sources, build-time downloads, script execution, privilege changes, or packaging behavior changes in the reviewed hunk. This looks like a routine upstream refresh with no security red flags in the diff provided.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1'
             'SKIP'
-            '742ef7677a1241d6a4b69ec48b9e3429004bf7e18d943b5f4d2ae53aba13e98bea5515938a317320b1464249c420c9071ee246f8babd5894d9377e2cf4df7d5b')
+            'fe00356d2282f097a6e71e832c8e810f03dd08292dca153dbfaff970cdf384902fdd56ab75a0a722d36e0c6730655cb49fc70571b4a1f9b19d102a8b9d239ade')