Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 153.0b12 to 153.0rc1. This is a routine metadata update for a binary Firefox beta package and does not by itself introduce any new build steps, sources, scripts, permissions, or privilege/persistence mechanisms. No security-relevant red flags are visible in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 153.0b12
+	pkgver = 153.0rc1
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

Risk is low. This change only updates .SRCINFO metadata to track a newer Firefox beta/RC release and adjusts the pinned upstream tarball URL and checksum accordingly. The source remains HTTPS and points to Mozilla infrastructure, with no new build-time code execution, install-script changes, or privilege/persistence mechanisms. The only notable concern is that the source path uses the Firefox candidates directory while the filename is still normalized to firefox-153.0rc1.tar.xz, but that is a packaging detail rather than a security issue in this diff.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=153.0b12
+	provides = firefox=153.0rc1
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/153.0b12/linux-x86_64/en-US/firefox-153.0b12.tar.xz
+	source = firefox-153.0rc1.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/153.0-candidates/build1/linux-x86_64/en-US/firefox-153.0.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 0ee0eb60f5c8a84434d1bb577e42f7e4a1e0666028fd3ea72830cb6cacf69792
+	sha256sums = bfc57e7b6b4e6204b11e7e03c4b93cff708e9fb37f6b9948be243455311d82ee
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change only bumps pkgver from 153.0b12 to 153.0rc1 and adjusts derived version parsing variables accordingly. No sources, checksums, build commands, install scripts, or packaging behavior changed. This is a routine version update with no security-relevant red flags in the provided hunk.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=153.0b12
+pkgver=153.0rc1
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change only updates the package version from 153.0b12 to 153.0rc1 and refreshes the checksum for the upstream Firefox tarball. The source remains an HTTPS download from Mozilla’s official archive/candidate infrastructure, with no new build-time commands, scripts, or packaging logic introduced. I did notice the source URL in the PKGBUILD still points to the beta tarball path while pkgver is rc1, but the conditional RC override below replaces it with the Mozilla candidate URL at build time, so this looks like a normal release-candidate bump rather than a supply-chain risk. No malicious persistence, privilege escalation, or integrity red flags are introduced by this diff.

@@ -26,7 +26,7 @@ source=("https://archive.mozilla.org/pub/firefox/releases/153.0b12/linux-x86_64/
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('0ee0eb60f5c8a84434d1bb577e42f7e4a1e0666028fd3ea72830cb6cacf69792'
+sha256sums=('bfc57e7b6b4e6204b11e7e03c4b93cff708e9fb37f6b9948be243455311d82ee'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')