Review Results

Comment

The change is a simple version bump in .SRCINFO from 7.3.pf2 to 7.3.pf3 with no accompanying changes to sources, build logic, install scripts, or packaging metadata. On its face this does not introduce any new attack surface or suspicious behavior. I did not see evidence in the provided diff of network fetches, privilege escalation, persistence mechanisms, or integrity regressions.

@@ -1,6 +1,6 @@
 pkgbase = linux-pf
 	pkgdesc = pf-kernel
-	pkgver = 7.3.pf2
+	pkgver = 7.3.pf3
 	pkgrel = 1
 	url = https://pfkernel.natalenko.name
 	arch = x86_64

Comment

The change only updates the upstream source tarball URL and its corresponding B2 checksum in .SRCINFO. The source remains an HTTPS Codeberg archive from the same project, with no new build-time commands, scripts, or packaging behavior introduced. This is a routine version bump with integrity metadata updated accordingly, and there are no obvious supply-chain red flags in the diff itself.

@@ -26,10 +26,10 @@ pkgbase = linux-pf
 	makedepends = zstd
 	options = !debug
 	options = !strip
-	source = https://codeberg.org/pf-kernel/linux/archive/8bf2dbc059c3d7dbc881f9d93d015cdb5e01959b.tar.gz
+	source = https://codeberg.org/pf-kernel/linux/archive/58cd6df377ace364afcfb06ad2d221ac926987ed.tar.gz
 	source = config
 	b2sums = SKIP
-	b2sums = 0e01b3bbdf0673038ed63be4017e0b40b659dce89d3b9213e69358801ef45a441e72a96f1daacad141f1fdec4e8ff095cd10207dea11c1400ad6e489f7ba8987
+	b2sums = b1ee917dfb3a8844bc084826218bbe5077ac8d0e19e10ac525d449fb5dc239849573af98ae65809dcdf5db3aeac8e36e37c7f8fb83e83d0b3cf0734ee9e82c29
 
 pkgname = linux-pf
 	pkgdesc = The pf-kernel and modules

Comment

The change is a routine kernel version bump: it updates the pinned upstream commit hash and matching b2 checksum for the source tarball, plus pkgver. The source remains an HTTPS Codeberg archive, there are no new build steps, no added scripts, no network fetches outside source=(), and no packaging/persistence red flags introduced by this diff. Risk is low because the only security-relevant aspect is trust in the new upstream commit, which is expected for a version update and is still pinned and checksummed.

@@ -3,8 +3,8 @@
 pkgbase="linux-pf"
 _suffix=""
 pkgname=(${pkgbase}${_suffix} ${pkgbase}-headers${_suffix})
-_rev=8bf2dbc059c3d7dbc881f9d93d015cdb5e01959b
-pkgver=7.3.pf2
+_rev=58cd6df377ace364afcfb06ad2d221ac926987ed
+pkgver=7.3.pf3
 pkgrel=1
 pkgdesc="pf-kernel"
 arch=(x86_64)

Comment

The change only updates the BLAKE2 checksum for the existing upstream tarball source in PKGBUILD. The source URL remains HTTPS and points to the same upstream Codeberg project, with no new build steps, scripts, or packaging logic introduced. This is a low-risk integrity metadata update, likely reflecting an upstream tarball change or repackaging, but by itself it does not add execution or persistence risk.

@@ -15,7 +15,7 @@ options=(!debug !strip)
 source=(https://codeberg.org/pf-kernel/linux/archive/${_rev}.tar.gz
 		config)
 b2sums=(SKIP
-		'0e01b3bbdf0673038ed63be4017e0b40b659dce89d3b9213e69358801ef45a441e72a96f1daacad141f1fdec4e8ff095cd10207dea11c1400ad6e489f7ba8987')
+		'b1ee917dfb3a8844bc084826218bbe5077ac8d0e19e10ac525d449fb5dc239849573af98ae65809dcdf5db3aeac8e36e37c7f8fb83e83d0b3cf0734ee9e82c29')
 
 export KBUILD_BUILD_HOST=archlinux
 export KBUILD_BUILD_USER=${pkgbase}

Comment

The only change in this diff is a comment update in the kernel config banner from pf2 to pf3. No build logic, sources, scripts, permissions, or packaging behavior changed, and there are no security-relevant indicators in this hunk. Based on the provided diff, this is effectively harmless metadata-only churn.

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 7.3.0-pf2 Kernel Configuration
+# Linux/x86 7.3.0-pf3 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (GCC) 16.2.1 20260810"
 CONFIG_CC_IS_GCC=y