Review Results

Comment

The change only bumps the package version in .SRCINFO from 7.3.4.lqx1 to 7.3.4.lqx2. No sources, build logic, install scripts, permissions, or dependencies are modified, and there are no new integrity or execution concerns visible in this diff. This is a routine metadata update with negligible security impact.

@@ -1,6 +1,6 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.3.4.lqx1
+	pkgver = 7.3.4.lqx2
 	pkgrel = 2
 	url = https://liquorix.net/
 	arch = x86_64

Comment

The change is a straightforward source checksum/version bump in .SRCINFO, updating the liquorix-package tarball from 7.3-2 to 7.3-3 and its corresponding sha512. No new sources, no protocol changes, no added build steps, and no evidence of malicious packaging behavior in this diff alone. The upstream GitHub archive URL remains the same official project location, and the kernel source/signature entries are unchanged. Risk is therefore minimal.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.3.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.3.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.3-2.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.3-3.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 14b99ea7cc2adc0798a183ac5f3e184587f2496c3b2d1d53b625574389891c69e8be375b5d03875fe859b09ac9314aa15da604087274ba815671135bd6a0e590
 	sha512sums = SKIP
-	sha512sums = 289082ec6694e2ac47da2cd488c39491da05e931273a0a9a2a9103c8ac1916feee7b26c8b50f781e094b672c05938a6403c0c744aa9469d4ffc161ffbbf256a4
+	sha512sums = 1cc5c5ca5c6937ea25bc289fdd58ab4971fa9fc16bfe2e85ebc054a3cd8d0a993cefcae83cc1c42bed6319c4529f0a5ec11d8c6df92ca2b1e9ebb74f1e9d7171
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The diff only bumps the Liquorix patch release metadata from 7.3.4.lqx1 to 7.3.4.lqx2 and increments the internal patch release variable from 2 to 3. No build logic, sources, install scripts, permissions, or systemd-related artifacts are changed in this hunk. On its face this is a routine version refresh with no security-relevant behavior change visible in the provided diff.

@@ -54,10 +54,10 @@ _htmldocs_enable=
 _major=7.3
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=2
+_lqxpatchrel=3
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.3.4.lqx1
+pkgver=7.3.4.lqx2
 pkgrel=2
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'

Comment

The change only bumps the Liquorix patch release/version metadata and updates the corresponding sha512 checksum for an existing source artifact. I did not find any new sources, build-time network access, script execution, privilege changes, or packaging behavior changes in this diff. The risk is therefore low and limited to the integrity of the replaced source checksum, which is expected for a version bump.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('14b99ea7cc2adc0798a183ac5f3e184587f2496c3b2d1d53b625574389891c69e8be375b5d03875fe859b09ac9314aa15da604087274ba815671135bd6a0e590'
             'SKIP'
-            '289082ec6694e2ac47da2cd488c39491da05e931273a0a9a2a9103c8ac1916feee7b26c8b50f781e094b672c05938a6403c0c744aa9469d4ffc161ffbbf256a4')
+            '1cc5c5ca5c6937ea25bc289fdd58ab4971fa9fc16bfe2e85ebc054a3cd8d0a993cefcae83cc1c42bed6319c4529f0a5ec11d8c6df92ca2b1e9ebb74f1e9d7171')