Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 7.3.pf4 to 7.3.pf5. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the reviewed diff. Based on this hunk alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = linux-pf
 	pkgdesc = pf-kernel
-	pkgver = 7.3.pf4
+	pkgver = 7.3.pf5
 	pkgrel = 1
 	url = https://pfkernel.natalenko.name
 	arch = x86_64

Comment

The change only updates the upstream source tarball URL and its corresponding b2sum in .SRCINFO, which is normal version pinning for an AUR package. The source remains HTTPS on the upstream Codeberg project, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. Risk is minimal.

@@ -26,10 +26,10 @@ pkgbase = linux-pf
 	makedepends = zstd
 	options = !debug
 	options = !strip
-	source = https://codeberg.org/pf-kernel/linux/archive/5210f1119480203a93eedaebf006d5f51cae9216.tar.gz
+	source = https://codeberg.org/pf-kernel/linux/archive/fc5cd7c3ebd530aeb32c8b7c461e8f391067d566.tar.gz
 	source = config
 	b2sums = SKIP
-	b2sums = fc354277e8c6d4b7ce8400c3302e9dd822b11aa4f23d5ad08eb0bfc438b08f8dc4fe930f724301b7f841eec3a18ce6298b9bf6f9dbd6c7db16663d16e3fb2532
+	b2sums = 2929b4636d1c798548527e3e9abee581abc586bf4a20ea0a85123464a25c147700f41f08adbc3aef0bc8e693ec31ea4aa327ff8eacebd9e7149774d8dfda6b49
 
 pkgname = linux-pf
 	pkgdesc = The pf-kernel and modules

Comment

The change only bumps the upstream kernel revision and package version in PKGBUILD. There are no new sources, build steps, install scripts, permissions changes, or other packaging logic introduced in the diff hunk. Based on the provided change alone, I do not see a security regression or supply-chain red flag.

@@ -3,8 +3,8 @@
 pkgbase="linux-pf"
 _suffix=""
 pkgname=(${pkgbase}${_suffix} ${pkgbase}-headers${_suffix})
-_rev=5210f1119480203a93eedaebf006d5f51cae9216
-pkgver=7.3.pf4
+_rev=fc5cd7c3ebd530aeb32c8b7c461e8f391067d566
+pkgver=7.3.pf5
 pkgrel=1
 pkgdesc="pf-kernel"
 arch=(x86_64)

Comment

The change only updates the B2 checksum for the existing upstream source tarball URL. The source remains HTTPS and points to the same upstream project archive, with no new build steps, scripts, network fetches, privilege changes, or packaging behavior changes. This is a low-risk integrity metadata update, assuming the new checksum matches the intended upstream revision.

@@ -15,7 +15,7 @@ options=(!debug !strip)
 source=(https://codeberg.org/pf-kernel/linux/archive/${_rev}.tar.gz
 		config)
 b2sums=(SKIP
-		'fc354277e8c6d4b7ce8400c3302e9dd822b11aa4f23d5ad08eb0bfc438b08f8dc4fe930f724301b7f841eec3a18ce6298b9bf6f9dbd6c7db16663d16e3fb2532')
+		'2929b4636d1c798548527e3e9abee581abc586bf4a20ea0a85123464a25c147700f41f08adbc3aef0bc8e693ec31ea4aa327ff8eacebd9e7149774d8dfda6b49')
 
 export KBUILD_BUILD_HOST=archlinux
 export KBUILD_BUILD_USER=${pkgbase}

Comment

The change is a one-line version bump in the kernel config header from pf4 to pf5. There are no functional configuration changes, no added sources, scripts, permissions, or build-time behavior, and nothing in this hunk suggests a supply-chain or privilege risk. Based on the provided diff alone, this is effectively cosmetic metadata only.

@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86 7.3.0-pf4 Kernel Configuration
+# Linux/x86 7.3.0-pf5 Kernel Configuration
 #
 CONFIG_CC_VERSION_TEXT="gcc (GCC) 16.2.1 20260810"
 CONFIG_CC_IS_GCC=y