Review Results

Comment

The only change in this .SRCINFO diff is a package version bump from 7.2.12.lqx1 to 7.2.13.lqx1. No sources, checksums, build steps, install scripts, permissions, or metadata affecting trust boundaries changed. Based on the provided diff alone, there is no security-relevant modification.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.2.12.lqx1
+	pkgver = 7.2.13.lqx1
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change only updates the AUR source tarball version from 7.2-21 to 7.2-22 and refreshes the corresponding sha512 checksum in .SRCINFO. The upstream kernel source URL, PGP keys, and other metadata remain unchanged. No new sources, scripts, build steps, or privilege-related artifacts are introduced by this diff, so there is no evident security impact from the metadata update alone.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.2-21.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.2-22.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1
 	sha512sums = SKIP
-	sha512sums = d828f59d908c1666fd696057ef6c69bda0151b7d636ad24791c8b4ec65fc82c66ae7dbe3c861e57d06c9e90a1f6306f9e15d898729c0ee323de13145cad507b8
+	sha512sums = 2c46fa1ee0242ccc9536ec74c66e3fad0721d48d64463b9048b665fca8c8d1d232700c5dd77eedb650397614cdf7a2471e5c483da8e0edf1946814dae96183aa
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change is a routine version bump for the Liquorix kernel package: pkgver and the corresponding patch release number are updated, and the source checksum is adjusted accordingly. I do not see any new sources, network-fetching logic, privilege escalation, install-script changes, or other suspicious packaging behavior in this diff. The only security-relevant aspect is that the integrity hash changed, but that is expected when the upstream source changes and is pinned by checksum. No obvious red flags in the reviewed hunk.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.2
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=21
+_lqxpatchrel=22
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.2.12.lqx1
+pkgver=7.2.13.lqx1
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only updates the Liquorix patch release/version and the corresponding SHA-512 checksum for the downloaded upstream patch archive. I did not find any new sources, build steps, privilege changes, network fetches outside the declared source array, or modifications to install scripts/systemd units. The diff is a routine integrity update to keep the PKGBUILD aligned with a newer upstream tarball, with no security red flags in the reviewed hunk.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1'
             'SKIP'
-            'd828f59d908c1666fd696057ef6c69bda0151b7d636ad24791c8b4ec65fc82c66ae7dbe3c861e57d06c9e90a1f6306f9e15d898729c0ee323de13145cad507b8')
+            '2c46fa1ee0242ccc9536ec74c66e3fad0721d48d64463b9048b665fca8c8d1d232700c5dd77eedb650397614cdf7a2471e5c483da8e0edf1946814dae96183aa')