Review Results

Comment

The change only bumps pkgver in .SRCINFO from 7.2.8.lqx1 to 7.2.8.lqx2. No sources, checksums, build steps, install scripts, or permissions changed, and there are no new integrity or execution concerns visible in this diff. This is a routine metadata update with negligible security impact.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.2.8.lqx1
+	pkgver = 7.2.8.lqx2
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change is a routine source version bump in .SRCINFO from liquorix-package 7.2-13 to 7.2-14, with the corresponding checksum updated. The upstream GitHub tarball remains on the official project, HTTPS is used, and there are no new execution paths, install scripts, or privilege-related changes in this diff. No security-relevant red flags are introduced by this metadata-only update.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.2-13.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.2-14.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1
 	sha512sums = SKIP
-	sha512sums = b261c094764d78c1d1d57c886fb33897d5acebccbadc06a9bf73572a5da7fa772329d08c0dbed070543f52493d46972856eea9a32113682a4be4695b75896979
+	sha512sums = bcfb5852159290599c456279dccaaf0181bf62e6c5fe0eeab739b29b2fe379f320ca32f58d3a8fd12ca0846cb86017f06ad78618d587d9f1cea3beabda325ae1
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change is a simple version bump in PKGBUILD metadata: _lqxpatchrel 13->14 and pkgver 7.2.8.lqx1->7.2.8.lqx2. No new sources, build steps, install scripts, permissions, or packaging logic are introduced in the provided diff. Based on this hunk alone, there is no evidence of supply-chain risk or malicious behavior.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.2
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=13
+_lqxpatchrel=14
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.2.8.lqx1
+pkgver=7.2.8.lqx2
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only updates the upstream Liquorix patch release reference and the corresponding sha512 checksum, plus a pkgver bump from 7.2.8.lqx1 to 7.2.8.lqx2. There are no new sources, no build-script logic changes, no added network fetches, and no install/persistence mechanisms introduced. The risk is low; the only security-relevant concern is that the new tarball checksum must match the fetched upstream archive, but that is exactly what the PKGBUILD is meant to pin.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1'
             'SKIP'
-            'b261c094764d78c1d1d57c886fb33897d5acebccbadc06a9bf73572a5da7fa772329d08c0dbed070543f52493d46972856eea9a32113682a4be4695b75896979')
+            'bcfb5852159290599c456279dccaaf0181bf62e6c5fe0eeab739b29b2fe379f320ca32f58d3a8fd12ca0846cb86017f06ad78618d587d9f1cea3beabda325ae1')