Review Results

Comment

The change only bumps the package version in .SRCINFO from 7.2.4.lqx3 to 7.2.4.lqx4. No sources, checksums, build steps, install scripts, or permissions are altered, and there are no new network, privilege, or persistence concerns introduced by this metadata-only update. Based on the provided diff, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.2.4.lqx3
+	pkgver = 7.2.4.lqx4
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change only updates the AUR source tarball from liquorix-package 7.2-9 to 7.2-10 and refreshes its checksum in .SRCINFO. The upstream kernel tarball/signature sources and PGP keys are unchanged, and there is no evidence here of added build-time code execution, network fetches outside declared sources, privilege escalation, or packaging policy violations. This is a routine metadata update with low security risk.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.2-9.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.2-10.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1
 	sha512sums = SKIP
-	sha512sums = fe00356d2282f097a6e71e832c8e810f03dd08292dca153dbfaff970cdf384902fdd56ab75a0a722d36e0c6730655cb49fc70571b4a1f9b19d102a8b9d239ade
+	sha512sums = bc51be87d77a44703a3827e93ad8d69ac323bb9e5b9d384f8beceb5a7cfa06cf8028a1ac218b63621d226fa18cfda7c4876f07ef95856af511fbac16707a3ebe
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change is a routine version bump for the linux-lqx package: it updates the Liquorix patch release number, pkgver, and the corresponding SHA-512 checksum for the new upstream tarball. I did not find any new code execution, network-fetch, privilege, persistence, or packaging-scope changes in the diff. The source URLs remain HTTPS and point to the expected upstream locations. Risk is therefore minimal.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.2
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=9
+_lqxpatchrel=10
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.2.4.lqx3
+pkgver=7.2.4.lqx4
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only updates the expected SHA-512 checksum for the upstream Liquorix patch tarball and bumps the package version/patch release accordingly. I did not see any new sources, network fetches, privilege escalation, install-script changes, or build-time execution introduced by this diff. The integrity change is consistent with a legitimate upstream artifact refresh, so risk is low.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1'
             'SKIP'
-            'fe00356d2282f097a6e71e832c8e810f03dd08292dca153dbfaff970cdf384902fdd56ab75a0a722d36e0c6730655cb49fc70571b4a1f9b19d102a8b9d239ade')
+            'bc51be87d77a44703a3827e93ad8d69ac323bb9e5b9d384f8beceb5a7cfa06cf8028a1ac218b63621d226fa18cfda7c4876f07ef95856af511fbac16707a3ebe')