Review Results

Comment

The diff only bumps the package version from 28.9-2 to 28.10-1 in .SRCINFO. No source URLs, checksums, build commands, install scripts, or packaging metadata affecting execution/persistence were changed in the reviewed hunk. On its face this is a routine version/release metadata update with no security-relevant behavior change.

@@ -1,7 +1,7 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.9
-	pkgrel = 2
+	pkgver = 28.10
+	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64
 	arch = x86_64_v3

Comment

The change is a straightforward upstream version bump in .SRCINFO from OpenJFX 28+9 to 28+10, with the corresponding source filename and checksum updated. The source remains an HTTPS GitHub release tarball, there are no new build-time commands, scripts, or privilege-related changes in the reviewed hunk, and no suspicious metadata changes (e.g. new dependencies, replaces/conflicts, or install hooks). Based on this diff alone, I see no security concern beyond the normal trust in the upstream release artifact.

@@ -28,13 +28,13 @@ pkgbase = java-openjfx
 	makedepends = zip
 	makedepends = gradle
 	options = !lto
-	source = java-openjfx-28.9.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+9.tar.gz
+	source = java-openjfx-28.10.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+10.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = 04dfed3bdb73c97e206ae396ce7ced7828d14ca28fabf428023769574f01b769fe1cae4b99a60bdcf81122df8cef9ee5820721315c7ced95c4780a2b57ab3113
+	b2sums = a15e3a6f4d890f8b337085150b01e9c03ab012ddade6c523f2ffbce94a376c6ab39609ba029c6e8c06f7633d6ed415cfa88ce90778afaff4a00416661d81a2f0
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change is a routine upstream version bump from 28+9 to 28+10 with the corresponding b2sums update and pkgrel reset. I do not see any new sources, build-time network access, privilege escalation, install-script changes, or suspicious packaging behavior in this diff. The only security-relevant effect is that the package will now verify a different upstream tarball/checksum, which is expected for a version update.

@@ -21,9 +21,9 @@ pkgname=(
 )
 _java_build_ver=25
 _java_run_ver=25
-_tag='28+9'
+_tag='28+10'
 pkgver=${_tag//+/.}
-pkgrel=2
+pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"
 arch=(x86_64 x86_64_v3)
 url='https://wiki.openjdk.java.net/display/OpenJFX/Main'

Comment

The change only updates the PKGBUILD to a new upstream tag and refreshes the corresponding b2sums. No new sources, scripts, install hooks, privilege changes, or build-time network behavior are introduced by this diff. Based on the provided hunk, this is a routine version/checksum bump with no evident security impact.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('04dfed3bdb73c97e206ae396ce7ced7828d14ca28fabf428023769574f01b769fe1cae4b99a60bdcf81122df8cef9ee5820721315c7ced95c4780a2b57ab3113'
+b2sums=('a15e3a6f4d890f8b337085150b01e9c03ab012ddade6c523f2ffbce94a376c6ab39609ba029c6e8c06f7633d6ed415cfa88ce90778afaff4a00416661d81a2f0'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'