Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 7.2.7.lqx1 to 7.2.8.lqx1 with no accompanying changes to sources, build logic, install scripts, or package metadata that would introduce new attack surface. On its own, this is low risk and does not indicate a supply-chain or privilege-escalation issue.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.2.7.lqx1
+	pkgver = 7.2.8.lqx1
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change only bumps the upstream liquorix-package tarball from 7.2-12 to 7.2-13 and updates its checksum in .SRCINFO. The source remains an HTTPS GitHub release archive, with no new build steps, scripts, or integrity red flags introduced by this metadata-only update. No evidence here of malicious persistence, privilege escalation, or supply-chain weakening beyond the normal trust in the new upstream tarball version.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.2-12.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.2-13.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1
 	sha512sums = SKIP
-	sha512sums = f35c762fc8d04d6a6ac1fa3064c5c8f02c7a6c76cc435d2b734fe19320413d2bffc63a2ce05270da200435d2b261b747f91c2435f704819a464057bc8457e33d
+	sha512sums = b261c094764d78c1d1d57c886fb33897d5acebccbadc06a9bf73572a5da7fa772329d08c0dbed070543f52493d46972856eea9a32113682a4be4695b75896979
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change is a straightforward version bump in PKGBUILD metadata: _lqxpatchrel 12->13 and pkgver 7.2.7.lqx1->7.2.8.lqx1. No new sources, URLs, build steps, install scripts, permissions, or packaging logic are introduced in the provided hunk. Based on this diff alone, there are no security-relevant red flags.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.2
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=12
+_lqxpatchrel=13
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.2.7.lqx1
+pkgver=7.2.8.lqx1
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only bumps the package version/patch release and updates the sha512 checksum for an existing source artifact. I did not find any new sources, build steps, network fetches, privilege changes, or packaging logic changes in this hunk. On its face this is a routine integrity update with no security red flags.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1'
             'SKIP'
-            'f35c762fc8d04d6a6ac1fa3064c5c8f02c7a6c76cc435d2b734fe19320413d2bffc63a2ce05270da200435d2b261b747f91c2435f704819a464057bc8457e33d')
+            'b261c094764d78c1d1d57c886fb33897d5acebccbadc06a9bf73572a5da7fa772329d08c0dbed070543f52493d46972856eea9a32113682a4be4695b75896979')