Review Results

Comment

The change only bumps pkgver in .SRCINFO from 28.11 to 28.12. No build logic, sources, checksums, dependencies, install scripts, or packaging behavior are altered in the reviewed diff. On its face this is a metadata-only version update with no security-relevant behavior change visible in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.11
+	pkgver = 28.12
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO from OpenJFX 28+11 to 28+12, with the source URL still pointing to the official GitHub release archive over HTTPS and the corresponding checksum updated. No new sources, build steps, install scripts, or packaging behaviors are introduced by this diff. Based on the provided hunk alone, there are no security red flags.

@@ -28,13 +28,13 @@ pkgbase = java-openjfx
 	makedepends = zip
 	makedepends = gradle
 	options = !lto
-	source = java-openjfx-28.11.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+11.tar.gz
+	source = java-openjfx-28.12.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+12.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = 9df419d99dc818f2d70c66fbff523bd63f5621ce87da89e9c3aedb353aaa6d095b736cf0793285975e50da92a33962dac0ce95ff53cd4992a593e537ed701302
+	b2sums = d9a96347888a67c7041111f614212dd6b1a1ca0601b448c29cdf3a5e89ec11a80047e14d2af424b4e41b3e496f91640e655ce7b095d97bdfd9a5105b165e1e27
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change is a one-line version bump in PKGBUILD, updating _tag from 28+11 to 28+12. No build logic, sources, checksums, install scripts, permissions, or package metadata beyond the version string are altered. Based on the provided diff, there are no security-relevant red flags.

@@ -21,7 +21,7 @@ pkgname=(
 )
 _java_build_ver=25
 _java_run_ver=25
-_tag='28+11'
+_tag='28+12'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

The change only updates a b2sums entry for one declared source in PKGBUILD. This is an integrity metadata change, not executable logic, and there are no accompanying changes to source URLs, build steps, install scripts, or package contents in the provided hunk. On its face this is low risk; the only concern would be if the new checksum were intentionally mismatched to a different payload, but there is no evidence of that from this isolated diff alone.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('9df419d99dc818f2d70c66fbff523bd63f5621ce87da89e9c3aedb353aaa6d095b736cf0793285975e50da92a33962dac0ce95ff53cd4992a593e537ed701302'
+b2sums=('d9a96347888a67c7041111f614212dd6b1a1ca0601b448c29cdf3a5e89ec11a80047e14d2af424b4e41b3e496f91640e655ce7b095d97bdfd9a5105b165e1e27'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'