Review Results

Comment

The only change in this diff is a pkgrel bump from 1 to 2 in .SRCINFO. This is metadata-only and does not alter sources, build steps, dependencies, install scripts, or shipped artifacts. No security-relevant behavior is introduced by this change.

@@ -1,7 +1,7 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
 	pkgver = 28.9
-	pkgrel = 1
+	pkgrel = 2
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64
 	arch = x86_64_v3

Comment

The change only adjusts a makedepends entry in .SRCINFO from jdk26-openjdk to jdk25-openjdk. This is a metadata-only dependency version change with no evidence of added code execution, network access, privilege escalation, or packaging behavior changes. It does not introduce suspicious sources or install-time actions.

@@ -16,7 +16,7 @@ pkgbase = java-openjfx
 	makedepends = glib2
 	makedepends = gperf
 	makedepends = gtk3
-	makedepends = jdk26-openjdk
+	makedepends = jdk25-openjdk
 	makedepends = libgl
 	makedepends = libx11
 	makedepends = libxtst

Comment

The change only adjusts the OpenJFX build JDK version from 26 to 25, bumps pkgrel, and removes an extra space in two install commands. I found no new network access, privilege escalation, persistence, or packaging integrity issues in the diff. The source URL and checksums are unchanged, and the modified install lines still write only under pkgdir. This appears to be a benign compatibility/packaging update.

@@ -19,11 +19,11 @@ pkgname=(
   java-openjfx-doc
   java-openjfx-src
 )
-_java_build_ver=26
+_java_build_ver=25
 _java_run_ver=25
 _tag='28+9'
 pkgver=${_tag//+/.}
-pkgrel=1
+pkgrel=2
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"
 arch=(x86_64 x86_64_v3)
 url='https://wiki.openjdk.java.net/display/OpenJFX/Main'

Comment

The change is a trivial whitespace cleanup in the install command inside package(), with no effect on sources, build steps, permissions, network access, or installed artifacts. It does not introduce any new execution paths or packaging risks.

@@ -118,7 +118,7 @@ package_java-openjfx() {
 
   cd $_jfxdir
 
-  install -dm 755  "${pkgdir}"/usr/{lib/$pkgbase,share/java/$pkgbase,share/licenses}
+  install -dm 755 "${pkgdir}"/usr/{lib/$pkgbase,share/java/$pkgbase,share/licenses}
   cp -dr --no-preserve=ownership build/sdk/lib/*.jar "${pkgdir}/usr/share/java/$pkgbase"
   cp -dr --no-preserve=ownership build/sdk/lib/*.so "${pkgdir}/usr/lib/$pkgbase"
   cp -dr --no-preserve=ownership build/jmods "${pkgdir}/usr/share/java/$pkgbase"

Comment

The change is a one-character whitespace cleanup in a PKGBUILD install command: it removes an extra space before the quoted destination path in `install -dm 755`. This does not alter the command semantics, does not introduce new sources, network access, privilege changes, or packaging behavior, and has no security impact.

@@ -141,7 +141,7 @@ package_java-openjfx-src() {
   arch=(any)
   cd $_jfxdir
 
-  install -dm 755  "${pkgdir}"/usr/{lib/jvm/java-$_java_build_ver-openjdk,share/licenses}
+  install -dm 755 "${pkgdir}"/usr/{lib/jvm/java-$_java_build_ver-openjdk,share/licenses}
   install -m 644 build/sdk/src.zip "${pkgdir}/usr/lib/jvm/java-$_java_build_ver-openjdk/javafx-src.zip"
   ln -s "$pkgbase" "${pkgdir}/usr/share/licenses/$pkgbase-src"
 }