Review Results

Comment

The change only bumps pkgver in .SRCINFO from 7.2.15.lqx1 to 7.2.15.lqx2. No sources, checksums, build steps, install scripts, or package metadata affecting trust boundaries were modified. This is a routine version metadata update with no security-relevant behavior change visible in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.2.15.lqx1
+	pkgver = 7.2.15.lqx2
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change only updates the AUR source tarball version from 7.2-24 to 7.2-25 and replaces the corresponding SHA-512 checksum in .SRCINFO. The upstream kernel source URL, PGP keys, and other metadata are unchanged. This is a routine version bump with no new build-time code execution, no added sources, and no packaging/persistence red flags visible in the diff.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.2-24.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.2-25.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1
 	sha512sums = SKIP
-	sha512sums = 0a1847ed487e1aa6586bb09c3b599dfce75ee33cdc9e5f3b9188dc1686d505b1c0575eb4d79185573713cd3e6a06b4e2244cff2c501c84a7c7dc49274521dd74
+	sha512sums = 18d6d4e6e33a877cc07b560df5bc9d0dc955326f6324e14ee813eb23edd7a477d67cab331a22acacd826d18112d78293fb1458d184c405d60e5d3d5410316edb
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change is a routine version bump in PKGBUILD metadata: it updates the Liquorix patch release number, pkgver, and the corresponding source checksum. I do not see any new sources, network fetches, privilege changes, install-script behavior, or packaging logic changes. The diff is limited to integrity metadata for an upstream kernel patch release, so there is no evident security concern in this change alone.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.2
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=24
+_lqxpatchrel=25
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.2.15.lqx1
+pkgver=7.2.15.lqx2
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only bumps the Liquorix patch release/version metadata and updates the sha512 checksum for the corresponding source tarball. I did not find any new sources, build-time network fetches, privilege escalation, install-script changes, or other suspicious packaging behavior in this diff. The risk is low and limited to integrity metadata for an upstream release update.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1'
             'SKIP'
-            '0a1847ed487e1aa6586bb09c3b599dfce75ee33cdc9e5f3b9188dc1686d505b1c0575eb4d79185573713cd3e6a06b4e2244cff2c501c84a7c7dc49274521dd74')
+            '18d6d4e6e33a877cc07b560df5bc9d0dc955326f6324e14ee813eb23edd7a477d67cab331a22acacd826d18112d78293fb1458d184c405d60e5d3d5410316edb')