Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 2.5.2 to 2.5.3. No source URLs, checksums, build steps, install scripts, or packaging metadata were altered in the reviewed diff, so there is no new security-relevant behavior introduced by this change alone.

@@ -1,6 +1,6 @@
 pkgbase = lyx
 	pkgdesc = An advanced WYSIWYM document processor & LaTeX front-end
-	pkgver = 2.5.2
+	pkgver = 2.5.3
 	pkgrel = 1
 	url = https://www.lyx.org
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO from LyX 2.5.2 to 2.5.3, with the corresponding tarball URL and SHA-512 checksum updated. The source remains HTTPS on the official LyX stable download path, and the existing PGP signature verification entry is unchanged. No new build-time execution, install-script behavior, or packaging metadata red flags are introduced by this diff alone.

@@ -22,11 +22,11 @@ pkgbase = lyx
 	options = emptydirs
 	options = !lto
 	backup = etc/lyx/lyxrc.dist
-	source = https://ftp.lip6.fr/pub/lyx/stable/2.5.x/lyx-2.5.2.tar.xz
-	source = https://ftp.lip6.fr/pub/lyx/stable/2.5.x/lyx-2.5.2.tar.xz.sig
+	source = https://ftp.lip6.fr/pub/lyx/stable/2.5.x/lyx-2.5.3.tar.xz
+	source = https://ftp.lip6.fr/pub/lyx/stable/2.5.x/lyx-2.5.3.tar.xz.sig
 	source = lyxrc.dist
 	validpgpkeys = FE66471B43559707AFDAD955DE7A44FAC7FB382D
-	sha512sums = 301d8e4aa63bcf2cdaadee2a5dbbe2b5bf33d9ea6dd767db2e59c07fde83f1191d747d883adaf22690ccc0aed03e438ea2dbff19a45dcdadf5fab0d1b4f5fb28
+	sha512sums = 133aa46e43849997d2ffc90ae8a443b9ee50f6cb09e24fb6c4e6abe5ae5b6378c83d9c7c7e3fdce8a7785b2aa5d6cb77202106aa6f2d88c72972bb7e6b060f77
 	sha512sums = SKIP
 	sha512sums = eef777cf6033a7b1e04700f33068b07309f8d5c6931c16927305dafb3a00fd46d4b536149349ab56b7455e7dea195c8889da2b6fbf9caa9e76bc0557f9358bc3
 

Comment

The change is a straightforward version bump in PKGBUILD from 2.5.2 to 2.5.3 with no accompanying changes to sources, checksums, build logic, install scripts, or packaging behavior in the provided diff hunk. On its face this does not introduce any new security-relevant behavior. No red flags are visible in the reviewed change alone.

@@ -3,7 +3,7 @@
 # Contributor: Ronald van Haren <ronald.archlinux.org>
 # Contributor: Jason Chu <jason@archlinux.org>
 pkgname=lyx
-pkgver=2.5.2
+pkgver=2.5.3
 pkgrel=1
 pkgdesc="An advanced WYSIWYM document processor & LaTeX front-end"
 arch=(x86_64)

Comment

The change only updates the SHA-512 checksum for the upstream LyX tarball in PKGBUILD. The source URL remains HTTPS on the official LyX FTP mirror, the tarball is still PGP-verified with the existing validpgpkey, and no build/install logic or additional sources were introduced. This is a low-risk integrity metadata update with no obvious security impact beyond reflecting a new upstream release artifact.

@@ -20,7 +20,7 @@ options=('emptydirs' '!lto')
 source=(https://ftp.lip6.fr/pub/${pkgname}/stable/${pkgver::4}x/${pkgname}-${pkgver}.tar.xz{,.sig}
 	lyxrc.dist)
 validpgpkeys=('FE66471B43559707AFDAD955DE7A44FAC7FB382D') # LyX Release Manager (Signing LyX tarballs and binaries) <sanda@lyx.org>
-sha512sums=('301d8e4aa63bcf2cdaadee2a5dbbe2b5bf33d9ea6dd767db2e59c07fde83f1191d747d883adaf22690ccc0aed03e438ea2dbff19a45dcdadf5fab0d1b4f5fb28'
+sha512sums=('133aa46e43849997d2ffc90ae8a443b9ee50f6cb09e24fb6c4e6abe5ae5b6378c83d9c7c7e3fdce8a7785b2aa5d6cb77202106aa6f2d88c72972bb7e6b060f77'
             'SKIP'
             'eef777cf6033a7b1e04700f33068b07309f8d5c6931c16927305dafb3a00fd46d4b536149349ab56b7455e7dea195c8889da2b6fbf9caa9e76bc0557f9358bc3')