Review Results

Comment

The only change in this .SRCINFO diff is a package version bump from 7.2.14.lqx1 to 7.2.15.lqx1. No sources, checksums, build steps, install scripts, permissions, or dependencies are modified, so there is no new security-relevant behavior introduced by this change alone.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.2.14.lqx1
+	pkgver = 7.2.15.lqx1
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change is a routine source-version bump in .SRCINFO, updating the liquorix-package tarball from 7.2-23 to 7.2-24 and its corresponding checksum. No new sources, protocols, build steps, or privilege-related artifacts are introduced, and the kernel upstream sources and PGP keys remain unchanged. Based on the provided diff, there are no security red flags.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.2-23.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.2-24.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1
 	sha512sums = SKIP
-	sha512sums = 6a91fbb6b7bd3ac978e6f0396c9720d70656dc27cfb09b685a4d0605b0ff2088206401975263f36e2b6c1040d34f046872dd45ea04222a08bc9a247c7e925f5f
+	sha512sums = 0a1847ed487e1aa6586bb09c3b599dfce75ee33cdc9e5f3b9188dc1686d505b1c0575eb4d79185573713cd3e6a06b4e2244cff2c501c84a7c7dc49274521dd74
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change is a routine version bump for the Liquorix kernel package: pkgver and the corresponding patch release number are updated, and the source checksum is refreshed. I do not see any new sources, build-time network access, privilege escalation, install-script changes, or other suspicious packaging behavior in this diff. The only security-relevant aspect is that the patch checksum changed, but that is expected for a legitimate upstream release update and there is no evidence here of tampering.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.2
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=23
+_lqxpatchrel=24
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.2.14.lqx1
+pkgver=7.2.15.lqx1
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change is a routine upstream version bump in PKGBUILD metadata: pkgver/_lqxpatchrel updated and the sha512 checksum for the corresponding source tarball changed. I do not see any new sources, build-time network access, privilege escalation, install-script changes, or other suspicious packaging behavior in this diff. Risk is low because the only security-relevant aspect is source integrity, and the new checksum appears to be a normal update for a new upstream release rather than an attempt to bypass verification.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1'
             'SKIP'
-            '6a91fbb6b7bd3ac978e6f0396c9720d70656dc27cfb09b685a4d0605b0ff2088206401975263f36e2b6c1040d34f046872dd45ea04222a08bc9a247c7e925f5f')
+            '0a1847ed487e1aa6586bb09c3b599dfce75ee33cdc9e5f3b9188dc1686d505b1c0575eb4d79185573713cd3e6a06b4e2244cff2c501c84a7c7dc49274521dd74')