Review Results

Comment

The change only bumps the package version in .SRCINFO from 7.2.8.lqx2 to 7.2.9.lqx1. No sources, build steps, install scripts, permissions, or dependencies are modified, and there are no new integrity or execution red flags in the provided diff. This is a routine metadata update with no apparent security impact.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.2.8.lqx2
+	pkgver = 7.2.9.lqx1
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change is a straightforward source-version bump in .SRCINFO from liquorix-package 7.2-14 to 7.2-15, with the corresponding SHA-512 updated. No new sources, protocols, scripts, or packaging behaviors are introduced, and the kernel tarball/signature sources remain unchanged. This does not by itself indicate a security issue; it is a routine metadata refresh for the AUR package.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.2-14.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.2-15.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1
 	sha512sums = SKIP
-	sha512sums = bcfb5852159290599c456279dccaaf0181bf62e6c5fe0eeab739b29b2fe379f320ca32f58d3a8fd12ca0846cb86017f06ad78618d587d9f1cea3beabda325ae1
+	sha512sums = cc752dcde4da1b482d6e033e3fff13a5e9152d5f4bc64f202330984bf7845e23580d0ea2daf3dad36162949d994d7b8d3d0c7b5817b8b323e645bf8cf41672a8
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change only bumps the Liquorix patch release and kernel package version, along with the corresponding SHA-512 checksum for the upstream source tarball. I did not see any new build steps, network fetches, privilege changes, install scripts, or packaging behavior changes. This is a routine version update with no security-relevant red flags in the diff provided.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.2
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=14
+_lqxpatchrel=15
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.2.8.lqx2
+pkgver=7.2.9.lqx1
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change is a routine upstream version bump in PKGBUILD metadata: pkgver/lqx patch release increment and the corresponding sha512 checksum update for the new source tarball. I do not see any new build steps, network fetches outside source(), privilege escalation, install-script changes, or other suspicious packaging behavior in this diff. Risk is low because the only security-relevant effect is trusting a different upstream release artifact, which is normal for a package update.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1'
             'SKIP'
-            'bcfb5852159290599c456279dccaaf0181bf62e6c5fe0eeab739b29b2fe379f320ca32f58d3a8fd12ca0846cb86017f06ad78618d587d9f1cea3beabda325ae1')
+            'cc752dcde4da1b482d6e033e3fff13a5e9152d5f4bc64f202330984bf7845e23580d0ea2daf3dad36162949d994d7b8d3d0c7b5817b8b323e645bf8cf41672a8')