Review Results

Comment

The change is a simple version bump in .SRCINFO from 28.15 to 28.16 with no accompanying changes to sources, build logic, install scripts, or package metadata beyond pkgver. On its face this does not introduce any new attack surface or integrity concern; the security posture depends on the underlying PKGBUILD/source set, which is unchanged in this diff. No red flags are visible in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = java-openjfx
 	pkgdesc = Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version
-	pkgver = 28.15
+	pkgver = 28.16
 	pkgrel = 1
 	url = https://wiki.openjdk.java.net/display/OpenJFX/Main
 	arch = x86_64

Comment

The change is a straightforward upstream version bump in .SRCINFO from OpenJFX 28+15 to 28+16, with the corresponding source tarball name and b2sum updated. The source remains an HTTPS GitHub release archive from the official upstream project, and there are no new build steps, scripts, permissions changes, or other suspicious artifacts introduced by this diff. No integrity or persistence red flags are present in the reviewed hunk.

@@ -28,13 +28,13 @@ pkgbase = java-openjfx
 	makedepends = zip
 	makedepends = gradle
 	options = !lto
-	source = java-openjfx-28.15.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+15.tar.gz
+	source = java-openjfx-28.16.tar.gz::https://github.com/openjdk/jfx/archive/refs/tags/28+16.tar.gz
 	source = java-openjfx-gradle.properties
 	source = java-openjfx-flags.patch
 	source = java-openjfx-profile.sh
 	source = java-openjfx-profile.csh
 	source = java-openjfx-env.sh
-	b2sums = 91a02104e920123fb66a3086695107048155ee98ebd7f62e0c31f02c68ea4b397ab4d22f0934a7644b87f20932a3c0fc368cb6e24806ebae2bb2185b3db4b245
+	b2sums = 28e6776449bfab4e98ef7128e85d943834beb4643218c6b57f13149f891b46fa19c86f377b5aa9d8931146e9ce2bdd5301f300093387ef61b73f9e5d6b5c0fae
 	b2sums = 0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f
 	b2sums = 5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3
 	b2sums = 73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522

Comment

The change is a one-line version bump in PKGBUILD, updating the upstream tag from 28+15 to 28+16. No build logic, sources, checksums, install scripts, permissions, or package metadata beyond the version string were altered. Based on the provided diff, there are no new security red flags or supply-chain concerns introduced by this change.

@@ -21,7 +21,7 @@ pkgname=(
 )
 _java_build_ver=25
 _java_run_ver=25
-_tag='28+15'
+_tag='28+16'
 pkgver=${_tag//+/.}
 pkgrel=1
 pkgdesc="Java OpenJFX client application platform (open-source implementation of JavaFX) - latest version"

Comment

The change is a routine upstream version bump in PKGBUILD: it updates the OpenJFX tag from 28+15 to 28+16 and refreshes the corresponding b2sum for the source tarball. No new sources, no build-script logic changes, no network-at-build behavior, and no packaging/persistence mechanisms were introduced. The remaining source entries and checksums are unchanged, so this diff does not add any obvious supply-chain or privilege-escalation risk.

@@ -67,7 +67,7 @@ source=(
   "${pkgbase}-profile"{.sh,.csh}
   "${pkgbase}-env.sh"
 )
-b2sums=('91a02104e920123fb66a3086695107048155ee98ebd7f62e0c31f02c68ea4b397ab4d22f0934a7644b87f20932a3c0fc368cb6e24806ebae2bb2185b3db4b245'
+b2sums=('28e6776449bfab4e98ef7128e85d943834beb4643218c6b57f13149f891b46fa19c86f377b5aa9d8931146e9ce2bdd5301f300093387ef61b73f9e5d6b5c0fae'
         '0c023ef99e7ee600710c54dad0ad59070620595109ca42c5057fa2ab74ef6d244631745f5cd4c1bea9c0321ee69f1e1efaab820ff124ad1d4f453121e77fd14f'
         '5b6dafc22995b57564fda89aaedeb2b6ee58b2c635336ac43a123ea4ac6ced3a20eba39d99cc4eb7ec7b29fc7541f5c3bee454ee55ca79fd2d7ce5ef4ed65cd3'
         '73cc0da90136a8a564599fb23c321bae64c35c4381e74d00f24604ed9a46dc2c7aa988077846160e8cb6a61e0eaa80d1e153d89a93fb4818d2589b067eff2522'