Review Results

Comment

The change is a straightforward version bump in .SRCINFO from Oracle JDK 26.0.2 to 27, with corresponding source URLs and checksums updated. I do not see any new red flags in this diff: sources remain HTTPS and point to Oracle’s official download/licensing locations, there are no added build-time commands, no install scripts or systemd units involved, and the package metadata changes are consistent with a normal upstream release update. Risk is low because the only security-relevant concern here is the usual trust in Oracle’s release artifacts, which was already present before this change.

@@ -1,28 +1,28 @@
 pkgbase = jdk
 	pkgdesc = Oracle Java
-	pkgver = 26.0.2
+	pkgver = 27
 	pkgrel = 1
 	url = https://www.oracle.com/java/
 	arch = x86_64
 	license = LicenseRef-Custom
 	makedepends = python-html2text
 	makedepends = alsa-lib
-	noextract = jdk-26.0.2_doc-all.zip
-	source = https://download.oracle.com/java/26/archive/jdk-26.0.2_linux-x64_bin.tar.gz
-	source = https://download.oracle.com/otn_software/java/jdk/26.0.2+10/818d462d89b645c7a1aad49066c454e5/jdk-26.0.2_doc-all.zip
-	source = jdk-26_doc-license.html::https://download.oracle.com/otndocs/jcp/java_se-26-final-spec/license.html
+	noextract = jdk-27_doc-all.zip
+	source = https://download.oracle.com/java/27/archive/jdk-27_linux-x64_bin.tar.gz
+	source = https://download.oracle.com/otn_software/java/jdk/27+35/55ce5470a6294008af0057ff4626d0e5/jdk-27_doc-all.zip
+	source = jdk-27_doc-license.html::https://download.oracle.com/otndocs/jcp/java_se-27-final-spec/license.html
 	source = java.desktop
 	source = jconsole.desktop
 	source = jshell.desktop
 	source = java_16.png
 	source = java_48.png
 	source = LICENSE
-	sha256sums = 11de2bce72e7f07b9e80afa9bdd950b42f3a5c69cf4969e44389d50f466959e2
-	sha256sums = b6600b90e3d177d8b02a278761ac2ec59742682a722bad281421013844e0e875
-	sha256sums = 27984b214d135bc4f6fb04c2d2cb85de8b9ad55f7b5752bf128f58c62e11ddcc
-	sha256sums = 0a0c33a4cebf59d365a95869f0513a8f2b54ed69db7c8b8220f364b4a3069726
-	sha256sums = 25aa549dfc515ca177e416bc1635db85655db2d2e9c77ea153b8768e11953b16
-	sha256sums = 3e59f0f2e134b87deedb10469a331f974d5b575d748633dcc1e3000f798a9c89
+	sha256sums = 0c7bb6c33c7fcc46674054cab734e3ca027ba05323c6c6ecbc8786f76a45b155
+	sha256sums = 767e992ce20e86a0452570ff9c0e0ee3bafb7a05ca99d5555634a9552011c0be
+	sha256sums = 64c4284265aa0d7f0499dbb8eb9cc1d86ad75570e92e8b31675e6dc806ef001e
+	sha256sums = d3db8fd5b469110709dc4986b3ef8d858bfeb77851a32ff0d1c7df7e0a0e075f
+	sha256sums = 72bbb9357debef6f03e5ee9a26189cd3e1a4f2c670595742b7f25b0b47caf044
+	sha256sums = 848acd359383b9d0a496a33f9146a25f31ec1343d1bde6896fff6b640da1b863
 	sha256sums = d27fec1d74f7a3081c3d175ed184d15383666dc7f02cc0f7126f11549879c6ed
 	sha256sums = 7cf8ca096e6d6e425b3434446b0835537d0fc7fe64b3ccba7a55f7bd86c7e176
 	sha256sums = 20becfcac0bdeaa29a76e6966d727f8cc79381354cbd5d530cdec823954df19f

Comment

The change is limited to .SRCINFO metadata updates for a version bump from 26 to 27, including source URLs, checksums, and provides/conflicts entries. I do not see any new code execution, install-script behavior, privilege escalation, or suspicious external sources beyond Oracle's HTTPS download endpoints. The only security-relevant concern is that .SRCINFO must match the PKGBUILD, but this diff alone does not introduce a malicious mechanism.

@@ -42,12 +42,12 @@ pkgname = jre
 	depends = zlib
 	optdepends = alsa-lib: for basic sound support
 	optdepends = gtk3: for the Gtk+ 3 look and feel - desktop usage
-	provides = java-runtime=26
-	provides = java-runtime-jdk26
-	provides = jre26-jdk=26.0.2-1
-	provides = java-runtime-headless=26
-	provides = java-runtime-headless-jdk=26
-	provides = jre26-jdk-headless=26.0.2-1
+	provides = java-runtime=27
+	provides = java-runtime-jdk27
+	provides = jre27-jdk=27-1
+	provides = java-runtime-headless=27
+	provides = java-runtime-headless-jdk=27
+	provides = jre27-jdk-headless=27-1
 	conflicts = jdk
 	backup = etc/java-jdk/jaxp.properties
 	backup = etc/java-jdk/jaxp-strict.properties.template

Comment

The change only updates .SRCINFO metadata to reflect a new JDK major version in the provides list (26 -> 27) and corresponding package virtuals. There are no added sources, build steps, install scripts, permissions changes, or other execution paths. This is a low-risk metadata-only update with no security-relevant behavior visible in the diff.

@@ -83,16 +83,16 @@ pkgname = jdk
 	depends = hicolor-icon-theme
 	optdepends = alsa-lib: for basic sound support
 	optdepends = gtk3: for the Gtk+ 3 look and feel - desktop usage
-	provides = java-environment=26
-	provides = java-environment-jdk=26
-	provides = jdk26-jdk=26.0.2-1
-	provides = jre=26
-	provides = java-runtime=26
-	provides = java-runtime-jdk26
-	provides = jre26-jdk=26.0.2-1
-	provides = java-runtime-headless=26
-	provides = java-runtime-headless-jdk=26
-	provides = jre26-jdk-headless=26.0.2-1
+	provides = java-environment=27
+	provides = java-environment-jdk=27
+	provides = jdk27-jdk=27-1
+	provides = jre=27
+	provides = java-runtime=27
+	provides = java-runtime-jdk27
+	provides = jre27-jdk=27-1
+	provides = java-runtime-headless=27
+	provides = java-runtime-headless-jdk=27
+	provides = jre27-jdk-headless=27-1
 	conflicts = jre
 	backup = etc/java-jdk/jaxp.properties
 	backup = etc/java-jdk/jaxp-strict.properties.template

Comment

The change is a straightforward version bump of the Oracle JDK package from 26.0.2 to 27, with corresponding build/hash updates and refreshed checksums. I do not see any new code execution, network-fetching outside the declared source array, privilege escalation, install-script changes, or suspicious metadata changes in this diff. The source remains the official Oracle download URL over HTTPS. Risk is low.

@@ -3,9 +3,9 @@
 
 pkgbase=jdk
 pkgname=('jre' 'jdk' 'jdk-doc')
-pkgver=26.0.2
-_build=10
-_hash=818d462d89b645c7a1aad49066c454e5
+pkgver=27
+_build=35
+_hash=55ce5470a6294008af0057ff4626d0e5
 _majver="${pkgver%%.*}"
 pkgrel=1
 pkgdesc='Oracle Java'

Comment

The change is a routine version bump of Oracle JDK sources and corresponding SHA-256 checksums. The source URLs remain HTTPS and point to Oracle’s official download endpoints, with no new build-time network access, scripts, patches, or packaging logic changes. I don’t see any added persistence, privilege escalation, or integrity red flags in this diff. Risk is low because the only security-relevant effect is trusting a new upstream release via updated checksums.

@@ -26,12 +26,12 @@ source=("https://download.oracle.com/java/${_majver}/archive/jdk-${pkgver}_linux
         'java_48.png'
         'LICENSE')
 noextract=("jdk-${pkgver}_doc-all.zip")
-sha256sums=('11de2bce72e7f07b9e80afa9bdd950b42f3a5c69cf4969e44389d50f466959e2'
-            'b6600b90e3d177d8b02a278761ac2ec59742682a722bad281421013844e0e875'
-            '27984b214d135bc4f6fb04c2d2cb85de8b9ad55f7b5752bf128f58c62e11ddcc'
-            '0a0c33a4cebf59d365a95869f0513a8f2b54ed69db7c8b8220f364b4a3069726'
-            '25aa549dfc515ca177e416bc1635db85655db2d2e9c77ea153b8768e11953b16'
-            '3e59f0f2e134b87deedb10469a331f974d5b575d748633dcc1e3000f798a9c89'
+sha256sums=('0c7bb6c33c7fcc46674054cab734e3ca027ba05323c6c6ecbc8786f76a45b155'
+            '767e992ce20e86a0452570ff9c0e0ee3bafb7a05ca99d5555634a9552011c0be'
+            '64c4284265aa0d7f0499dbb8eb9cc1d86ad75570e92e8b31675e6dc806ef001e'
+            'd3db8fd5b469110709dc4986b3ef8d858bfeb77851a32ff0d1c7df7e0a0e075f'
+            '72bbb9357debef6f03e5ee9a26189cd3e1a4f2c670595742b7f25b0b47caf044'
+            '848acd359383b9d0a496a33f9146a25f31ec1343d1bde6896fff6b640da1b863'
             'd27fec1d74f7a3081c3d175ed184d15383666dc7f02cc0f7126f11549879c6ed'
             '7cf8ca096e6d6e425b3434446b0835537d0fc7fe64b3ccba7a55f7bd86c7e176'
             '20becfcac0bdeaa29a76e6966d727f8cc79381354cbd5d530cdec823954df19f')

Comment

This is a benign desktop-entry update that only changes the displayed name/comment and the hardcoded Exec path from Java 26 to Java 27. It does not introduce new commands, network access, privilege escalation, persistence, or packaging/install-script behavior. The change is limited to a launcher metadata file and appears consistent with a version bump.

@@ -1,8 +1,8 @@
 [Desktop Entry]
-Name=Oracle Java 26 Runtime
-Comment=Oracle Java 26 Runtime
+Name=Oracle Java 27 Runtime
+Comment=Oracle Java 27 Runtime
 Keywords=java;runtime
-Exec=/usr/lib/jvm/java-26-jdk/bin/java -jar
+Exec=/usr/lib/jvm/java-27-jdk/bin/java -jar
 Terminal=false
 Type=Application
 Icon=java-jdk

Comment

This is a straightforward desktop launcher version bump: the displayed name/comment and Exec path were updated from java-26-jdk to java-27-jdk. There are no added commands, scripts, network fetches, privilege changes, or other security-relevant behaviors in this hunk. The change only affects which installed JDK binary the desktop entry points to.

@@ -1,8 +1,8 @@
 [Desktop Entry]
-Name=Oracle Java 26 Console
-Comment=Oracle Java 26 Monitoring and Management Console
+Name=Oracle Java 27 Console
+Comment=Oracle Java 27 Monitoring and Management Console
 Keywords=java;console;monitoring
-Exec=/usr/lib/jvm/java-26-jdk/bin/jconsole
+Exec=/usr/lib/jvm/java-27-jdk/bin/jconsole
 Terminal=false
 Type=Application
 Icon=java-jdk

Comment

The change is a trivial version bump in the install script from java-26-jdk to java-27-jdk, plus a matching comment update. No new commands, network access, privilege changes, persistence mechanisms, or packaging behavior were introduced. Based on the provided diff, this is low risk and appears to be a routine maintenance update.

@@ -1,4 +1,4 @@
-THIS_JDK='java-26-jdk'
+THIS_JDK='java-27-jdk'
 
 fix_default() {
   if [ ! -x /usr/bin/java ]; then

Comment

This change is a one-line comment update in jdk.install, changing a stale reference from JRE26 to JRE27. It does not alter executable logic, package installation behavior, permissions, network access, or any post-install/remove actions. No security impact is evident from the diff.

@@ -42,7 +42,7 @@ post_upgrade() {
 
 pre_remove() {
   if [ "x$(fix_default)" = "x${THIS_JDK}" ]; then
-    # Check JRE26 is still available
+    # Check JRE27 is still available
     if [ -x /usr/lib/jvm/${THIS_JDK}/bin/java ]; then
       /usr/bin/archlinux-java unset
     fi

Comment

The change is a one-line package identifier update in jre.install from java-26-jdk to java-27-jdk. This does not introduce new commands, network access, privilege changes, persistence, or packaging behavior; it only adjusts the package name referenced by the install script. No security-relevant issues are apparent from this diff alone.

@@ -1,4 +1,4 @@
-THIS_JRE='java-26-jdk'
+THIS_JRE='java-27-jdk'
 
 fix_default() {
   if [ ! -x /usr/bin/java ]; then

Comment

This is a straightforward desktop launcher version bump from Java 26 to Java 27, updating the displayed name/comment and the Exec path to the new JDK location. There are no added scripts, network fetches, privilege changes, persistence mechanisms, or other security-relevant behaviors in this hunk. The change is low risk and appears to be a normal package update.

@@ -1,8 +1,8 @@
 [Desktop Entry]
-Name=Oracle Java 26 Shell
-Comment=Oracle Java 26 Shell
+Name=Oracle Java 27 Shell
+Comment=Oracle Java 27 Shell
 Keywords=java;shell
-Exec=/usr/lib/jvm/java-26-jdk/bin/jshell
+Exec=/usr/lib/jvm/java-27-jdk/bin/jshell
 Terminal=true
 Type=Application
 Icon=java-jdk