Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 7.2.15.lqx2 to 7.3.3.lqx1. No sources, checksums, build steps, install scripts, or package metadata affecting trust boundaries were modified in the reviewed diff. On its face this is a routine upstream version update with no security red flags visible in the provided change.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.2.15.lqx2
+	pkgver = 7.3.3.lqx1
 	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change only updates the .SRCINFO metadata to point at a different upstream tarball version (7.2-25 -> 7.2-1) and corresponding checksum. The source remains on GitHub over HTTPS, there is no new build-time code execution, no added install script or systemd/persistence mechanism, and no evidence of a malicious URL or integrity bypass in this diff alone. This looks like a routine metadata refresh, though the actual PKGBUILD/source contents would need separate review if they changed elsewhere.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.2.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.2-25.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.2-1.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1
 	sha512sums = SKIP
-	sha512sums = 18d6d4e6e33a877cc07b560df5bc9d0dc955326f6324e14ee813eb23edd7a477d67cab331a22acacd826d18112d78293fb1458d184c405d60e5d3d5410316edb
+	sha512sums = b14376a527a725eb088c3259483a1de4e352d5bacef1ce45c213036c111542bcfad824a15308a919a096b1b95fc25e6bbc70982e592d1adbac05500d45cea56c
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change only bumps the kernel package version and the Liquorix patch release reference, plus updates the source checksum accordingly. I do not see any new execution paths, network fetches outside source=(), privilege changes, or packaging/install-script behavior introduced by this diff. The only security-relevant question is whether the new upstream tarball/checksum is trustworthy, but that is covered by the existing HTTPS source URL and checksum pinning; no additional red flags are present in the reviewed hunk.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.2
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=25
+_lqxpatchrel=1
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.2.15.lqx2
+pkgver=7.3.3.lqx1
 pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change is limited to bumping the package version and updating the sha512 checksum for one source artifact. I did not find any new sources, build-time network access, privilege escalation, install-script changes, or other suspicious packaging behavior in this diff. The checksum update is expected for a new upstream tarball/patch release and does not by itself indicate tampering.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('47e63679363261a864d271277340a6f2d45f544e1a056be4159df081f4f6537d0efa865c4af26611ab33a3079ee65db88ec2f6bc0e5fff43e0c043cde0cd91e1'
             'SKIP'
-            '18d6d4e6e33a877cc07b560df5bc9d0dc955326f6324e14ee813eb23edd7a477d67cab331a22acacd826d18112d78293fb1458d184c405d60e5d3d5410316edb')
+            'b14376a527a725eb088c3259483a1de4e352d5bacef1ce45c213036c111542bcfad824a15308a919a096b1b95fc25e6bbc70982e592d1adbac05500d45cea56c')