Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 28.14 to 28.15. No sources, checksums, build steps, install scripts, permissions, or package metadata with security impact were altered in the provided diff. Based on this hunk alone, there is no evidence of malicious behavior or integrity risk.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.14
+	pkgver = 28.15
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO: it updates the OpenJFX source tarball from 28+14 to 28+15 and refreshes the corresponding BLAKE2 checksum. No new sources, scripts, build steps, permissions, or install-time behavior are introduced by this diff. The source remains an HTTPS GitHub release archive from the expected upstream project, and there are no integrity or supply-chain red flags visible in this hunk.

@@ -28,13 +28,13 @@ pkgbase = java-openjfx
 	makedepends = zip
 	makedepends = gradle
 	options = !lto
-	source = java-openjfx-28.14.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+14.tar.gz
+	source = java-openjfx-28.15.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+15.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = d68e7315cd5325945a119804180b625115a5d315787c700e3db2c1d5cb9f3c510fc6519a1711dc215a480d4f6915092c108fd2683ca0c0229d6341dceb1cead7
+	b2sums = 91a02104e920123fb66a3086695107048155ee98ebd7f62e0c31f02c68ea4b397ab4d22f0934a7644b87f20932a3c0fc368cb6e24806ebae2bb2185b3db4b245
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change is a one-line version bump in PKGBUILD from _tag '28+14' to '28+15'. This only updates the pinned upstream release identifier used to derive pkgver and does not introduce new sources, build steps, install scripts, or packaging behavior. No security-relevant logic changed in the provided diff hunk.

@@ -21,7 +21,7 @@ pkgname=(
 )
 _java_build_ver=25
 _java_run_ver=25
-_tag='28+14'
+_tag='28+15'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

The change only bumps the upstream release tag from 28+14 to 28+15 and updates the corresponding b2sum for the source archive. No new sources, scripts, build steps, permissions, or install-time behavior were introduced. Based on the diff shown, this is a routine integrity checksum refresh for a version update and does not add security risk by itself.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('d68e7315cd5325945a119804180b625115a5d315787c700e3db2c1d5cb9f3c510fc6519a1711dc215a480d4f6915092c108fd2683ca0c0229d6341dceb1cead7'
+b2sums=('91a02104e920123fb66a3086695107048155ee98ebd7f62e0c31f02c68ea4b397ab4d22f0934a7644b87f20932a3c0fc368cb6e24806ebae2bb2185b3db4b245'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'