Review Results

Comment

The only change in this .SRCINFO update is a version bump from 7.3rc3 to 7.3rc4. There are no changes to source URLs, checksums, build steps, install scripts, permissions, or package metadata that would introduce supply-chain or privilege-escalation risk. This is a routine upstream version update and appears low risk.

@@ -1,6 +1,6 @@
 pkgbase = linux-mainline
 	pkgdesc = Linux Mainline
-	pkgver = 7.3rc3
+	pkgver = 7.3rc4
 	pkgrel = 1
 	url = https://kernel.org/
 	arch = x86_64

Comment

The change only bumps the kernel source tag from v7.3-rc3 to v7.3-rc4 and updates the corresponding sha256 checksum in .SRCINFO. The source remains the official kernel.org git repository over HTTPS, pinned to a specific tag, with existing PGP key verification unchanged. No new sources, scripts, build steps, or packaging behavior are introduced by this metadata-only update. I see no security-relevant regression in this diff.

@@ -32,12 +32,12 @@ pkgbase = linux-mainline
 	makedepends = texlive-latexextra
 	options = !debug
 	options = !strip
-	source = linux-mainline::git+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git#tag=v7.3-rc3
+	source = linux-mainline::git+https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git#tag=v7.3-rc4
 	source = config.x86_64
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	validpgpkeys = 83BC8889351B5DEBBB68416EB8AC08600F108CDF
-	sha256sums = ba8e204ee407d3f9430580406ccab817b8293332f8e6581363a6617ad17e2c04
+	sha256sums = e7ee5085d63ac0939ce2af87cd60d9e3a3adc1029579d70ac535738d1eab7610
 	sha256sums = 9f6e1be50d2ebb69a23b14799ccf23462c80e29f284ce3b205186921c5c3bf3d
 
 pkgname = linux-mainline

Comment

The change is a routine upstream version bump from v7.3-rc3 to v7.3-rc4, with the corresponding source checksum updated. I do not see any new sources, build-time network access, privilege escalation, install-script changes, or packaging logic changes. This appears to be a low-risk maintenance update.

@@ -6,8 +6,8 @@
 
 pkgbase=linux-mainline
 #pkgbase=linux-custom       # Build kernel with a different name
-_tag=v7.3-rc3
-pkgver=7.3rc3
+_tag=v7.3-rc4
+pkgver=7.3rc4
 pkgrel=1
 pkgdesc="Linux Mainline"
 arch=(x86_64)

Comment

The change is a routine upstream version bump from v7.3-rc3 to v7.3-rc4 with the corresponding source checksum update. I do not see any new sources, build-time network access, privilege escalation, install-script changes, or packaging logic changes. The diff is limited to version metadata and integrity hash adjustment, so risk is minimal.

@@ -56,7 +56,7 @@ validpgpkeys=(
   647F28654894E3BD457199BE38DBBDC86092693E  # Greg Kroah-Hartman
   83BC8889351B5DEBBB68416EB8AC08600F108CDF  # Jan Alexander Steffens (heftig)
 )
-sha256sums=('ba8e204ee407d3f9430580406ccab817b8293332f8e6581363a6617ad17e2c04'
+sha256sums=('e7ee5085d63ac0939ce2af87cd60d9e3a3adc1029579d70ac535738d1eab7610'
             '9f6e1be50d2ebb69a23b14799ccf23462c80e29f284ce3b205186921c5c3bf3d')
 
 export KBUILD_BUILD_HOST=archlinux