Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 152.0.5_1 to 152.0.6_1. No sources, checksums, install scripts, build steps, or package metadata affecting trust boundaries were changed in the reviewed diff. On its face this is a routine upstream version update with no security-relevant red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = librewolf-bin
 	pkgdesc = Community-maintained fork of Firefox, focused on privacy, security and freedom.
-	pkgver = 152.0.5_1
+	pkgver = 152.0.6_1
 	pkgrel = 1
 	epoch = 1
 	url = https://librewolf.net/

Comment

The change is a straightforward version bump in .SRCINFO from 152.0.5-1 to 152.0.6-1, updating the pinned git tag and the corresponding prebuilt binary tarball URLs and checksums for x86_64/aarch64. The source remains HTTPS on the official Codeberg project, and the package still uses the same signed upstream artifacts with no new build-time code execution, install-script, or privilege-related changes visible in this diff. No security red flags are introduced by this metadata-only update.

@@ -52,20 +52,20 @@ pkgbase = librewolf-bin
 	options = !emptydirs
 	backup = usr/lib/librewolf/librewolf.cfg
 	backup = usr/lib/librewolf/distribution/policies.json
-	source = git+https://codeberg.org/librewolf/source.git#tag=152.0.5-1
+	source = git+https://codeberg.org/librewolf/source.git#tag=152.0.6-1
 	source = default192x192.png
 	source = librewolf.desktop
 	validpgpkeys = 662E3CDD6FE329002D0CA5BB40339DD82B12EF16
-	sha256sums = 2f66d548e7ea777b69ce1bccd95247f82fc41ce41ed49fd61d63b428c5049c5d
+	sha256sums = 963d9b951be30735116b2fb866cae7df8dd417d5d0d113532381f5a3c076f0e3
 	sha256sums = 959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1
 	sha256sums = 3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae
-	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.5-1/librewolf-152.0.5-1-linux-x86_64-package.tar.xz
-	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.5-1/librewolf-152.0.5-1-linux-x86_64-package.tar.xz.sig
-	sha256sums_x86_64 = f58d27dd41d12bd5a02a128520c07708b9a1d46a79687a0888ac6528d29ee607
+	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.6-1/librewolf-152.0.6-1-linux-x86_64-package.tar.xz
+	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.6-1/librewolf-152.0.6-1-linux-x86_64-package.tar.xz.sig
+	sha256sums_x86_64 = 75974b75c9d8d492dd5cd742ddf3e667cb12d39ad67dcc67cb70484ccd76c9da
 	sha256sums_x86_64 = SKIP
-	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.5-1/librewolf-152.0.5-1-linux-arm64-package.tar.xz
-	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.5-1/librewolf-152.0.5-1-linux-arm64-package.tar.xz.sig
-	sha256sums_aarch64 = c7dbd45da12d8e763afa638b6cb897981af973b66611845324af5f0c8a5f815b
+	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.6-1/librewolf-152.0.6-1-linux-arm64-package.tar.xz
+	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.6-1/librewolf-152.0.6-1-linux-arm64-package.tar.xz.sig
+	sha256sums_aarch64 = 20d8c01f808ea51f1211875b37d30efaf3d5a5eb771a58249dcddb9c70b845c2
 	sha256sums_aarch64 = SKIP
 
 pkgname = librewolf-bin

Comment

The change is a routine version bump for a binary package: it updates pkgver and refreshes the corresponding source checksums for the upstream tarballs and signed artifacts. I do not see any new build-time code execution, network behavior, privilege escalation, or packaging-path changes introduced by this diff. The source remains pinned to a specific git tag and the package still verifies downloaded artifacts via checksums/signatures. Risk is low.

@@ -4,7 +4,7 @@ pkgname=librewolf-bin
 provides=(${pkgname//-bin/""})
 conflicts=(${pkgname//-bin/""})
 epoch=1
-pkgver=152.0.5_1
+pkgver=152.0.6_1
 _fixedfirefoxver="${pkgver%_*}" # Version of Firefox this LibreWolf version is based on, but the Firefox patch number is always included
 _librewolfver="${pkgver#*_}"
 _firefoxver="${_fixedfirefoxver%.0}" # Removes ".0" from the end. For "136.0.0" this will result in "136.0" but for "136.0.1" won't do anything.

Comment

The change only bumps librewolf-bin from 152.0.5_1 to 152.0.6_1 and updates the corresponding SHA-256 checksums for the already-declared upstream release artifacts. No new sources, scripts, network fetches, install hooks, privilege changes, or packaging logic were introduced. This looks like a routine version/hash refresh with no evident security impact in the reviewed hunk.

@@ -76,12 +76,12 @@ source=(
 )
 source_aarch64=("${_uploadpath_aarch64}" "${_uploadpath_sig_aarch64}")
 source_x86_64=("${_uploadpath_x86_64}" "${_uploadpath_sig_x86_64}")
-sha256sums=('2f66d548e7ea777b69ce1bccd95247f82fc41ce41ed49fd61d63b428c5049c5d'
+sha256sums=('963d9b951be30735116b2fb866cae7df8dd417d5d0d113532381f5a3c076f0e3'
             '959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1'
             '3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae')
-sha256sums_x86_64=('f58d27dd41d12bd5a02a128520c07708b9a1d46a79687a0888ac6528d29ee607'
+sha256sums_x86_64=('75974b75c9d8d492dd5cd742ddf3e667cb12d39ad67dcc67cb70484ccd76c9da'
                    'SKIP')
-sha256sums_aarch64=('c7dbd45da12d8e763afa638b6cb897981af973b66611845324af5f0c8a5f815b'
+sha256sums_aarch64=('20d8c01f808ea51f1211875b37d30efaf3d5a5eb771a58249dcddb9c70b845c2'
                     'SKIP')
 
 package() {