Review Results

Comment

The change is a routine version bump in .SRCINFO: it updates the kernel/XanMod release numbers and corresponding source/checksum entries. There are no new sources, no added scripts, no build-time execution changes, and no packaging/persistence red flags in this diff. One existing issue remains that the upstream URL is HTTP, but this was pre-existing and not introduced by this change. Overall this diff is low risk.

@@ -1,6 +1,6 @@
 pkgbase = linux-xanmod
 	pkgdesc = Linux Xanmod - Stable Mainline [MAIN]
-	pkgver = 7.2.15
+	pkgver = 7.3.3
 	pkgrel = 1
 	url = http://www.xanmod.org/
 	arch = x86_64

Comment

The change is a routine source/version bump in .SRCINFO: it updates the upstream kernel tarball and the XanMod patch URL/checksums, while keeping HTTPS sources and the same PGP key constraints. There are no new build-time commands, no added install scripts, and no suspicious extra sources or privilege-related changes in this diff. Based on the provided hunk alone, this looks like a normal package update with low security risk.

@@ -23,15 +23,15 @@ pkgbase = linux-xanmod
 	makedepends = xxhash
 	makedepends = xz
 	options = !strip
-	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
-	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
-	source = patch-7.2.15-xanmod1.xz::https://sourceforge.net/projects/xanmod/files/releases/main/7.2.15-xanmod1/patch-7.2.15-xanmod1.xz/download
+	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.3.tar.xz
+	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.3.tar.sign
+	source = patch-7.3.3-xanmod1.xz::https://sourceforge.net/projects/xanmod/files/releases/main/7.3.3-xanmod1/patch-7.3.3-xanmod1.xz/download
 	source = choose-gcc-optimization.sh
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
-	sha256sums = f9fef3d14c0df53819026f4be74459835c2a0b0dcbf5b5bbd9ea19f0829402b3
+	sha256sums = 87363c24f10e06321eb362765521094e94471f6bff8bce2d6b3e40f39f004953
 	sha256sums = SKIP
-	sha256sums = 9203329b801de937a49cee8fac241e465ca946a0565ad9fd82f832fd22f466b2
+	sha256sums = a8996c759ae6e239028449f11cf369bf7818f38bb4dc8486915684c51f7e54c9
 	sha256sums = f4acc1760990c54348a029315d1505ccb7c7270cd70a9aeb728bffcced51e767
 
 pkgname = linux-xanmod

Comment

The change only bumps the package version variables from 7.2.15 to 7.3.3. This is a metadata/version update with no added sources, build logic, install scripts, permissions changes, or other execution paths. I see no security-relevant behavior introduced by this diff.

@@ -72,8 +72,8 @@ fi
 ### IMPORTANT: Do no edit below this line unless you know what you're doing
 
 pkgbase=linux-xanmod
-_major=7.2
-pkgver=${_major}.15
+_major=7.3
+pkgver=${_major}.3
 _branch=7.x
 xanmod=1
 _revision=

Comment

The change only bumps the package version and updates two source checksums in PKGBUILD. I did not find any new sources, build steps, network fetches, privilege changes, or packaging logic changes. The updated checksums are consistent with a source refresh and do not by themselves indicate malicious behavior. No security issue evident in this diff hunk.

@@ -122,9 +122,9 @@ for _patch in "${_patches[@]}"; do
     source+=("${_patch}::https://raw.githubusercontent.com/archlinux/svntogit-packages/${_commit}/trunk/${_patch}")
 done
 
-sha256sums=('f9fef3d14c0df53819026f4be74459835c2a0b0dcbf5b5bbd9ea19f0829402b3'
+sha256sums=('87363c24f10e06321eb362765521094e94471f6bff8bce2d6b3e40f39f004953'
             'SKIP'
-            '9203329b801de937a49cee8fac241e465ca946a0565ad9fd82f832fd22f466b2'
+            'a8996c759ae6e239028449f11cf369bf7818f38bb4dc8486915684c51f7e54c9'
             'f4acc1760990c54348a029315d1505ccb7c7270cd70a9aeb728bffcced51e767')
 
 export KBUILD_BUILD_HOST=${KBUILD_BUILD_HOST:-archlinux}