Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 28.10 to 28.11. No sources, checksums, build commands, install scripts, or package metadata affecting trust boundaries were changed in the reviewed diff. On its face this is a routine upstream version update with no security red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.10
+	pkgver = 28.11
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO from OpenJFX 28+10 to 28+11, with the corresponding source tarball filename and BLAKE2 checksum updated. The source remains an HTTPS GitHub release archive from the official upstream project, and there are no new build steps, scripts, or packaging directives introduced in this diff. No obvious supply-chain or persistence red flags are present in the reviewed hunk.

@@ -28,13 +28,13 @@ pkgbase = java-openjfx
 	makedepends = zip
 	makedepends = gradle
 	options = !lto
-	source = java-openjfx-28.10.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+10.tar.gz
+	source = java-openjfx-28.11.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+11.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = a15e3a6f4d890f8b337085150b01e9c03ab012ddade6c523f2ffbce94a376c6ab39609ba029c6e8c06f7633d6ed415cfa88ce90778afaff4a00416661d81a2f0
+	b2sums = 9df419d99dc818f2d70c66fbff523bd63f5621ce87da89e9c3aedb353aaa6d095b736cf0793285975e50da92a33962dac0ce95ff53cd4992a593e537ed701302
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change is a routine upstream version bump from 28+10 to 28+11 with the corresponding b2sum update. I did not find any new sources, build steps, install scripts, or packaging logic changes that would introduce network access, privilege escalation, persistence, or embedded binaries. The diff is limited to version metadata and checksum refresh, so risk is minimal.

@@ -21,7 +21,7 @@ pkgname=(
 )
 _java_build_ver=25
 _java_run_ver=25
-_tag='28+10'
+_tag='28+11'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

The change is limited to bumping the upstream OpenJFX release tag from 28+10 to 28+11 and updating the corresponding b2sum for the first source artifact. I do not see any new build-time code execution, network access, privilege escalation, install-script changes, or packaging behavior changes. The only security-relevant aspect is source integrity: the checksum update is consistent with a version bump and still pins the downloaded source. No red flags are introduced by this diff alone.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('a15e3a6f4d890f8b337085150b01e9c03ab012ddade6c523f2ffbce94a376c6ab39609ba029c6e8c06f7633d6ed415cfa88ce90778afaff4a00416661d81a2f0'
+b2sums=('9df419d99dc818f2d70c66fbff523bd63f5621ce87da89e9c3aedb353aaa6d095b736cf0793285975e50da92a33962dac0ce95ff53cd4992a593e537ed701302'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'