Review Results

Comment

The only change in this .SRCINFO hunk is a package version bump from 7.3.3.lqx1 to 7.3.4.lqx1. There are no source URL changes, no new build steps, no install script or unit-file changes, and no integrity or privilege-related red flags visible in the provided diff. Based on this hunk alone, the change appears to be a routine version update with negligible security risk.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.3.3.lqx1
+	pkgver = 7.3.4.lqx1
 	pkgrel = 2
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change only updates the archived upstream packaging source from liquorix-package 7.3-1 to 7.3-2 and refreshes its checksum in .SRCINFO. The source remains an HTTPS GitHub archive, pinned to a specific release tarball, with no new build-time network access, scripts, or privilege-related artifacts introduced by this diff. On the evidence in this hunk alone, this is a routine version bump with no security red flags.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.3.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.3.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.3-1.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.3-2.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 14b99ea7cc2adc0798a183ac5f3e184587f2496c3b2d1d53b625574389891c69e8be375b5d03875fe859b09ac9314aa15da604087274ba815671135bd6a0e590
 	sha512sums = SKIP
-	sha512sums = 3aeaa3605cfa925e691092eb3578b97431202429a3086f0be5e8be24edea080f42058cddf185aa0cc8125001be8b24d948b5193e17be8bdac2f2bf859d842357
+	sha512sums = 289082ec6694e2ac47da2cd488c39491da05e931273a0a9a2a9103c8ac1916feee7b26c8b50f781e094b672c05938a6403c0c744aa9469d4ffc161ffbbf256a4
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change only bumps the Liquorix package version/release metadata and updates the corresponding source checksum for the upstream tarball. No build logic, install scripts, permissions, or source URLs changed, and the source remains HTTPS from the same upstream GitHub release archive. I do not see any new supply-chain, persistence, or privilege-escalation risk introduced by this diff.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.3
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=1
+_lqxpatchrel=2
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.3.3.lqx1
+pkgver=7.3.4.lqx1
 pkgrel=2
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only updates the upstream Liquorix patch tarball version and its SHA-512 checksum, along with the corresponding pkgver/_lqxpatchrel bump. I did not find any new sources, build-time network fetches, privilege escalation, install scripts, or other behavioral changes in the reviewed hunk. This is a routine integrity update with no security impact evident from the diff.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('14b99ea7cc2adc0798a183ac5f3e184587f2496c3b2d1d53b625574389891c69e8be375b5d03875fe859b09ac9314aa15da604087274ba815671135bd6a0e590'
             'SKIP'
-            '3aeaa3605cfa925e691092eb3578b97431202429a3086f0be5e8be24edea080f42058cddf185aa0cc8125001be8b24d948b5193e17be8bdac2f2bf859d842357')
+            '289082ec6694e2ac47da2cd488c39491da05e931273a0a9a2a9103c8ac1916feee7b26c8b50f781e094b672c05938a6403c0c744aa9469d4ffc161ffbbf256a4')