Review Results

Comment

The change only bumps the package version in .SRCINFO from 7.2.10.lqx1 to 7.2.10.lqx2. No sources, checksums, build steps, install scripts, or packaging metadata affecting execution or privileges were modified. This is a routine metadata update with no security impact evident from the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.2.10.lqx1
+	pkgver = 7.2.10.lqx2
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change is a routine source version bump in .SRCINFO from liquorix-package 7.2-17 to 7.2-18, with the corresponding checksum updated. The upstream source URLs remain HTTPS and point to the same GitHub project, and there are no new build-time commands, scripts, or privilege-related changes in this diff. No security-relevant red flags are introduced by this metadata-only update.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.2-17.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.2-18.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1
 	sha512sums = SKIP
-	sha512sums = 5266d8d57bb8c7bdb61b310cf54569d9267140d65bff61d5d21e89ee7789aaf1b74993339adfb382c7064b42c485e870a4309ef1d488b70e974a2475da8bfdf3
+	sha512sums = 82078232c29fdab788971702f88d2e9ec05e91044166abd13dba8b4fcc31c511c07d11c349153ec0cb7591dc0727ea390f56254202d97783a861fa7b0aef70b7
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change only bumps the Liquorix patch release/version and updates the corresponding SHA-512 checksum for the new upstream tarball. No build logic, install scripts, permissions, or source URLs changed, and the sources remain HTTPS from the expected upstream locations. I do not see any new supply-chain, persistence, or privilege-escalation risk introduced by this diff.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.2
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=17
+_lqxpatchrel=18
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.2.10.lqx1
+pkgver=7.2.10.lqx2
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only updates the Liquorix patch release/version and the corresponding SHA-512 checksum for the source tarball. I did not find any new sources, build steps, install scripts, or packaging logic changes that would introduce code execution, privilege escalation, persistence, or integrity bypass. The source URLs remain HTTPS and pinned to an explicit archive release, and the checksum update is consistent with a legitimate upstream tarball refresh. Low risk.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1'
             'SKIP'
-            '5266d8d57bb8c7bdb61b310cf54569d9267140d65bff61d5d21e89ee7789aaf1b74993339adfb382c7064b42c485e870a4309ef1d488b70e974a2475da8bfdf3')
+            '82078232c29fdab788971702f88d2e9ec05e91044166abd13dba8b4fcc31c511c07d11c349153ec0cb7591dc0727ea390f56254202d97783a861fa7b0aef70b7')