Review Results

Comment

The change only bumps the package version from 7.3.4.lqx2 to 7.3.4.lqx3 and resets pkgrel from 2 to 1 in .SRCINFO. No source URLs, checksums, build steps, install scripts, or other packaging metadata are altered, so there is no new security-relevant behavior introduced by this diff alone.

@@ -1,7 +1,7 @@
 pkgbase = linux-lqx
 	pkgdesc = Linux Liquorix
-	pkgver = 7.3.4.lqx2
-	pkgrel = 2
+	pkgver = 7.3.4.lqx3
+	pkgrel = 1
 	url = https://liquorix.net/
 	arch = x86_64
 	license = GPL-2.0-only

Comment

The change only bumps the liquourix-package source archive from 7.3-3 to 7.3-4 and updates its checksum in .SRCINFO. The source remains an HTTPS GitHub archive from the same upstream project, with no new build-time network access, scripts, or privilege-related artifacts introduced by this metadata-only update. No additional red flags are visible in the provided diff.

@@ -23,12 +23,12 @@ pkgbase = linux-lqx
 	options = !strip
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.3.tar.xz
 	source = https://cdn.kernel.org/pub/linux/kernel/v7.x/linux-7.3.tar.sign
-	source = https://github.com/damentz/liquorix-package/archive/7.3-3.tar.gz
+	source = https://github.com/damentz/liquorix-package/archive/7.3-4.tar.gz
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = 14b99ea7cc2adc0798a183ac5f3e184587f2496c3b2d1d53b625574389891c69e8be375b5d03875fe859b09ac9314aa15da604087274ba815671135bd6a0e590
 	sha512sums = SKIP
-	sha512sums = 1cc5c5ca5c6937ea25bc289fdd58ab4971fa9fc16bfe2e85ebc054a3cd8d0a993cefcae83cc1c42bed6319c4529f0a5ec11d8c6df92ca2b1e9ebb74f1e9d7171
+	sha512sums = ac0017118e8e73ee688e235484f16b117fe282201d194814dd8c54f41626c3bb8c5a560784819b4af11cca14a0e54cef0e2bda50551d7d7c70826edc53ad9643
 
 pkgname = linux-lqx
 	pkgdesc = The Linux Liquorix kernel and modules

Comment

The change only bumps the Liquorix patch release and package release/version metadata in PKGBUILD. No source URLs, build steps, install scripts, permissions, or other executable packaging logic are modified in the provided hunk. Based on this diff alone, there are no security-relevant red flags.

@@ -54,11 +54,11 @@ _htmldocs_enable=
 _major=7.3
 _srcname=linux-${_major}
 _lqxpatchname=liquorix-package
-_lqxpatchrel=3
+_lqxpatchrel=4
 _lqxpatchver=${_lqxpatchname}-${_major}-${_lqxpatchrel}
 pkgbase=linux-lqx
-pkgver=7.3.4.lqx2
-pkgrel=2
+pkgver=7.3.4.lqx3
+pkgrel=1
 pkgdesc='Linux Liquorix'
 url='https://liquorix.net/'
 arch=(x86_64)

Comment

The change only updates the checksum for the upstream Liquorix patch tarball and bumps the package version/release metadata accordingly. I did not find any new sources, build steps, install scripts, or other behavior changes in the reviewed hunk. The integrity change is consistent with a republished upstream archive and does not by itself introduce a security issue.

@@ -106,7 +106,7 @@ validpgpkeys=(
 )
 sha512sums=('14b99ea7cc2adc0798a183ac5f3e184587f2496c3b2d1d53b625574389891c69e8be375b5d03875fe859b09ac9314aa15da604087274ba815671135bd6a0e590'
             'SKIP'
-            '1cc5c5ca5c6937ea25bc289fdd58ab4971fa9fc16bfe2e85ebc054a3cd8d0a993cefcae83cc1c42bed6319c4529f0a5ec11d8c6df92ca2b1e9ebb74f1e9d7171')
+            'ac0017118e8e73ee688e235484f16b117fe282201d194814dd8c54f41626c3bb8c5a560784819b4af11cca14a0e54cef0e2bda50551d7d7c70826edc53ad9643')