Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver bump for firefox-nightly from one upstream nightly snapshot to a newer one. There are no changes to source URLs, checksums, build/install scripts, dependencies, or packaging behavior in the provided diff. On its face this is a routine version update with no obvious security red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = firefox-nightly
 	pkgdesc = Fast, Private & Safe Web Browser (Nightly version)
-	pkgver = 154.0a1+20260629.1+h2cfe577bd498
+	pkgver = 154.0a1+20260716.1+hfd15e652209e
 	pkgrel = 1
 	url = https://www.mozilla.org/firefox/channel/desktop/#nightly
 	arch = x86_64

Comment

The change only updates .SRCINFO to add two new patch sources and their checksums. This is metadata-only and does not itself introduce executable logic, network fetches, privilege escalation, or packaging changes. I would still want the corresponding patch files reviewed for malicious content, but based on this diff alone there is no direct security issue.

@@ -73,16 +73,22 @@ pkgbase = firefox-nightly
 	source = firefox-nightly.desktop
 	source = org.mozilla.firefox-nightly.metainfo.xml
 	source = 0001-Install-under-remoting-name.patch
+	source = 0002-Bug-2055018-Add-some-missing-X11UndefineNone-include.patch
+	source = 0003-Bug-2055288-Add-missing-include-cstdint-to-DataChann.patch
 	validpgpkeys = 14F26682D0916CDD81E37B6D61B7B526D98F0353
 	sha256sums = SKIP
 	sha256sums = cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8
 	sha256sums = 4304902899987928ea51b7020fb1298b01fa77e327ef66ab00b061f767042b9f
 	sha256sums = 9649563e8703b4f4b43469029fe20e3bd0c1209dbaa4c2d664c00e089abd7fa0
-	sha256sums = 3cef02fd2fa711204ce25e73c8dc896a2a2bd0d48cd4a05df4d6349199645bb2
+	sha256sums = 844423079aa1ffc5f6ee66df2f43d27879d2a761073939747945da5409bec191
+	sha256sums = add89c5abc3463548b4a401f5cde7b94df67dfe19fea09864db238dbb2681648
+	sha256sums = f1151ff907231aacf604a71c21dc17259146eb6c51d7ea01a7d728e19e62f07d
 	b2sums = SKIP
 	b2sums = f2a9cfb758692584dd8057ab30d0ed9d22f5356d0021e1c8111a061866ee66d6b2d891351e11064f904fe8c90032e78f9def61ed54ae4208c8be4de6b4226277
 	b2sums = 9c748d4c330d37d10862c73b3092c0d4308030fb62ca80da56ba9b3c3350ba4d779570308d1dd8e2c7d873f269654b72030702c5abc772aabfdfe7f39320a8b9
 	b2sums = 561d6fd3b394eee3242c1db12c0520e865488b3e5c1943a398994857b1fcad520ed4387ea93bc9402356649a0b3db6911bcd3a9f8d388bbe88a58a2efec0aa14
-	b2sums = 9d652eb28c3762c91131e25e31912d8ad47a5143cebd0d8dd3a6042b219de44007703b318d13600c9fae9d3227c7f15bdd8c917837a1a07e8cbea6c75c9fcc41
+	b2sums = 70e8bfd40bf23afa3f6de2d975aa69043cb88ae14b625702b754cd3de56215be159cf69ba4ed522ca7122b8bbdb50cfe763694e7c7595f2fdcec40bab5e2739f
+	b2sums = 457f9d30311823107177558872a83ce2742de4d09b67f138e7914bfa73ca51c262cf1a8650b29d7d7e0d60ea8ce34375cc93ef0541ebdee3421985df3035d783
+	b2sums = 6421e6a2e5a02cd079ed00358373051e7a2380e9b97f45b181f6bb7267701325f232e18ef725f388f4ed0e4f56c94a08b074f10587b2f7c146192cf781fc81c6
 
 pkgname = firefox-nightly

Comment

The patch only changes Firefox Nightly’s install/remoting naming: it installs the binary symlink under MOZ_APP_REMOTINGNAME and uses that remoting name for the DBus app name instead of lowercasing the product name. I don’t see any added network access, privilege escalation, persistence, or packaging outside $pkgdir. The change is limited to naming/paths and appears consistent with the stated goal of avoiding channel conflicts. Risk is low.

@@ -25,10 +25,10 @@ index 428beef48e14..13a609c1cfe9 100644
  DIST = dist
  else
 diff --git a/toolkit/mozapps/installer/packager.mk b/toolkit/mozapps/installer/packager.mk
-index c663de3a732f..7487d1619524 100644
+index 2322886ca517..2c92bf6fe1fd 100644
 --- a/toolkit/mozapps/installer/packager.mk
 +++ b/toolkit/mozapps/installer/packager.mk
-@@ -169,8 +169,8 @@ endif
+@@ -167,8 +167,8 @@ endif
  	(cd $(DIST)/$(MOZ_PKG_DIR) && $(TAR) --exclude=precomplete $(TAR_CREATE_FLAGS) - .) | \
  	  (cd $(DESTDIR)$(installdir) && tar -xf -)
  	$(NSINSTALL) -D $(DESTDIR)$(bindir)

Comment

The patch only changes Firefox Nightly’s install/remoting naming: it installs the binary under MOZ_APP_REMOTINGNAME instead of MOZ_APP_NAME, updates the symlink target accordingly, and uses remotingName for the DBus app name. I don’t see any added network access, privilege escalation, persistence, or suspicious external sources. The change is limited to packaging/runtime naming behavior and appears consistent with the stated goal of avoiding channel conflicts.

@@ -40,10 +40,10 @@ index c663de3a732f..7487d1619524 100644
  upload:
  	$(PYTHON3) -u $(MOZILLA_DIR)/build/upload.py --base-path $(ABS_DIST) $(UPLOAD_FILES)
 diff --git a/xpcom/glue/XREAppData.cpp b/xpcom/glue/XREAppData.cpp
-index 8274b57e2208..f1fc353c0797 100644
+index 444a5b8b3384..5413e4976fb7 100644
 --- a/xpcom/glue/XREAppData.cpp
 +++ b/xpcom/glue/XREAppData.cpp
-@@ -51,8 +51,7 @@ void XREAppData::GetDBusAppName(nsACString& aName) const {
+@@ -52,8 +52,7 @@ void XREAppData::GetDBusAppName(nsACString& aName) const {
    if (env) {
      aName.Assign(env);
    } else {

Comment

This patch is a straightforward upstream code cleanup in Firefox GTK/X11 sources: it only reorders and adds missing X11UndefineNone includes, plus removes a few now-unused includes. There are no build-script changes, no new sources, no network access, no install-time actions, and no privilege/persistence mechanisms. The diff is limited to C++ include hygiene in existing Mozilla code and does not introduce executable logic or packaging risk.

@@ -0,0 +1,171 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Emilio=20Cobos=20=C3=81lvarez?= <emilio@crisal.io>
+Date: Wed, 15 Jul 2026 17:47:37 +0200
+Subject: [PATCH] Bug 2055018 - Add some missing X11UndefineNone includes.
+ r=stransky
+
+And clean up some unused ones while at it.
+
+Differential Revision: https://phabricator.services.mozilla.com/D312311
+---
+ widget/gtk/WidgetUtilsGtk.cpp       | 13 +++++------
+ widget/gtk/nsPrintDialogGTK.cpp     | 35 ++++++++++-------------------
+ widget/gtk/nsUserIdleServiceGTK.cpp | 21 ++++++++---------
+ 3 files changed, 27 insertions(+), 42 deletions(-)
+
+diff --git a/widget/gtk/WidgetUtilsGtk.cpp b/widget/gtk/WidgetUtilsGtk.cpp
+index 516b259547c1..f5bab748a847 100644
+--- a/widget/gtk/WidgetUtilsGtk.cpp
++++ b/widget/gtk/WidgetUtilsGtk.cpp
+@@ -8,40 +8,39 @@
+ #include <glib.h>
+ #include <gtk/gtk.h>
+ #include <inttypes.h>
++#ifdef MOZ_X11
++#  include <X11/Xatom.h>
++#  include <X11/Xlib.h>
++
++#  include "X11UndefineNone.h"
++#endif
+ 
+ #include "MainThreadUtils.h"
+-#include "mozilla/Components.h"
+ #include "mozilla/StaticPrefs_widget.h"
+ #include "mozilla/UniquePtr.h"
+ #include "nsCOMPtr.h"
+ #include "nsDirectoryServiceDefs.h"
+ #include "nsGtkKeyUtils.h"
+ #include "nsGtkUtils.h"
+ #include "nsIFile.h"
+-#include "nsIGfxInfo.h"
+ #include "nsIProperties.h"
+ #include "nsReadableUtils.h"
+ #include "nsString.h"
+ #include "nsStringFwd.h"
+ #include "nsWindow.h"
+ #include "nsXPCOMCID.h"
+ #include "nsXULAppAPI.h"
+ 
+ #ifdef MOZ_ENABLE_DBUS
+ #  include "mozilla/ClearOnShutdown.h"
+ #  include "mozilla/widget/AsyncDBus.h"
+ #  include "nsAppShell.h"
+ #endif  // MOZ_ENABLE_DBUS
+ 
+ #ifdef MOZ_WAYLAND
+ #  include "nsWaylandDisplay.h"
+ #endif  // MOZ_WAYLAND
+ 
+-#ifdef MOZ_X11
+-#  include <X11/Xatom.h>
+-#  include <X11/Xlib.h>
+-#endif /* MOZ_X11 */
+-
+ #undef LOGW
+ #ifdef MOZ_LOGGING
+ #  include "mozilla/Logging.h"
+diff --git a/widget/gtk/nsPrintDialogGTK.cpp b/widget/gtk/nsPrintDialogGTK.cpp
+index 6e2d9280a099..c3084f02e0dd 100644
+--- a/widget/gtk/nsPrintDialogGTK.cpp
++++ b/widget/gtk/nsPrintDialogGTK.cpp
+@@ -4,47 +4,36 @@
+ 
+ #include "nsPrintDialogGTK.h"
+ 
++#include <gdk/gdk.h>  // for gdk_x11_window_get_xid
+ #include <gtk/gtk.h>
+ #include <gtk/gtkunixprint.h>
+ #include <stdlib.h>
++#ifdef MOZ_X11
++#  include <gdk/gdkx.h>
++
++#  include "X11UndefineNone.h"
++#endif
++#include <dlfcn.h>
++#include <fcntl.h>
++#include <gio/gunixfdlist.h>
++#include <sys/stat.h>
++#include <sys/types.h>
+ 
+ #include "GRefPtr.h"
+-#include "MozContainer.h"
++#include "MainThreadUtils.h"
+ #include "WidgetUtils.h"
+-#include "WidgetUtilsGtk.h"
+-#include "mozilla/Services.h"
+ #include "mozilla/dom/Promise.h"
+-#include "nsIGIOService.h"
+ #include "nsIGlobalObject.h"
+-#include "nsIObserverService.h"
+ #include "nsIPrintSettings.h"
+ #include "nsIPrintSettingsService.h"
+ #include "nsIStringBundle.h"
+ #include "nsIWidget.h"
+ #include "nsPIDOMWindow.h"
+ #include "nsPrintSettingsGTK.h"
+-#include "nsPrintfCString.h"
+-#include "nsReadableUtils.h"
+ #include "nsServiceManagerUtils.h"
+ #include "nsString.h"
+-#include "nsThreadUtils.h"
+ #include "xpcpublic.h"
+ 
+-// for gdk_x11_window_get_xid
+-#include <gdk/gdk.h>
+-#ifdef MOZ_X11
+-#  include <gdk/gdkx.h>
+-#endif
+-#include <fcntl.h>
+-#include <gio/gunixfdlist.h>
+-#include <sys/stat.h>
+-#include <sys/types.h>
+-
+-// for dlsym
+-#include <dlfcn.h>
+-
+-#include "MainThreadUtils.h"
+-
+ using namespace mozilla;
+ using namespace mozilla::dom;
+ using namespace mozilla::widget;
+diff --git a/widget/gtk/nsUserIdleServiceGTK.cpp b/widget/gtk/nsUserIdleServiceGTK.cpp
+index 63a55fa8c768..334be476dfb6 100644
+--- a/widget/gtk/nsUserIdleServiceGTK.cpp
++++ b/widget/gtk/nsUserIdleServiceGTK.cpp
+@@ -5,27 +5,24 @@
+ #include "nsUserIdleServiceGTK.h"
+ 
+ #include <gtk/gtk.h>
+-
+-#include "WidgetUtilsGtk.h"
+-#include "mozilla/Logging.h"
+-#include "mozilla/SpinEventLoopUntil.h"
+-#include "nsDebug.h"
+-#include "nsITimer.h"
+-#include "prlink.h"
+ #ifdef MOZ_X11
+ #  include <X11/Xlib.h>
+ #  include <X11/Xutil.h>
+ #  include <gdk/gdkx.h>
++
++#  include "X11UndefineNone.h"
+ #endif
++
++#include "WidgetUtilsGtk.h"
++#include "mozilla/Logging.h"
++#include "mozilla/SpinEventLoopUntil.h"
++#include "nsITimer.h"
++#include "prlink.h"
++
+ #ifdef MOZ_ENABLE_DBUS
+-#  include <gio/gio.h>
+-
+ #  include "AsyncDBus.h"
+-#  include "WakeLockListener.h"
+-#  include "nsIObserverService.h"
+ #endif
+ 
+-using mozilla::LogLevel;
+ static mozilla::LazyLogModule sIdleLog("nsIUserIdleService");
+ 
+ using namespace mozilla;

Comment

The patch is a minimal upstream-style header fix that only adds a missing standard include (<cstdint>) to a Firefox source header. It does not introduce new build steps, network access, privilege changes, persistence mechanisms, or packaging/install-script behavior. No security-relevant red flags are present in the provided hunk.

@@ -0,0 +1,23 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: "Jan Alexander Steffens (heftig)" <heftig@archlinux.org>
+Date: Wed, 15 Jul 2026 19:48:33 +0200
+Subject: [PATCH] Bug 2055288 - Add missing include <cstdint> to
+ DataChannelProtocol.h
+
+---
+ netwerk/sctp/datachannel/DataChannelProtocol.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/netwerk/sctp/datachannel/DataChannelProtocol.h b/netwerk/sctp/datachannel/DataChannelProtocol.h
+index d73278f51a83..a093847ebc42 100644
+--- a/netwerk/sctp/datachannel/DataChannelProtocol.h
++++ b/netwerk/sctp/datachannel/DataChannelProtocol.h
+@@ -5,6 +5,8 @@
+ #ifndef NETWERK_SCTP_DATACHANNEL_DATACHANNELPROTOCOL_H_
+ #define NETWERK_SCTP_DATACHANNEL_DATACHANNELPROTOCOL_H_
+ 
++#include <cstdint>
++
+ #if defined(__GNUC__)
+ #  define SCTP_PACKED __attribute__((packed))
+ #elif defined(_MSC_VER)

Comment

The change only bumps pkgver in PKGBUILD to a newer Firefox Nightly snapshot. No build logic, sources, checksums, install scripts, or permissions changed, and there are no new network, privilege, or persistence concerns visible in this diff hunk. This appears to be a routine version update with minimal security risk.

@@ -3,7 +3,7 @@
 # Contributor: Jakub Schmidtke <sjakub@gmail.com>
 
 pkgname=firefox-nightly
-pkgver=154.0a1+20260629.1+h2cfe577bd498
+pkgver=154.0a1+20260716.1+hfd15e652209e
 pkgrel=1
 pkgdesc="Fast, Private & Safe Web Browser (Nightly version)"
 url="https://www.mozilla.org/firefox/channel/desktop/#nightly"

Comment

Risk score 0. The change only adds two upstream Mozilla source patches to the PKGBUILD and updates their checksums, plus a small refactor to apply all *.patch files from the declared source array. I checked the new patches: they are ordinary compile/fixup patches from Mozilla/Arch context, contain no network access, privilege escalation, persistence, or binary blobs. The new loop in prepare() still only applies local, checksum-pinned patch files from source=(), so it does not introduce an untrusted download path or execute arbitrary external content beyond the existing patch application step.

@@ -86,7 +86,13 @@ source=(
   $pkgname-symbolic.svg
   $pkgname.desktop
   org.mozilla.$pkgname.metainfo.xml
+
+  # Make different channels installable in parallel
   0001-Install-under-remoting-name.patch
+
+  # Fix fallout from https://bugzilla.mozilla.org/show_bug.cgi?id=2054311
+  0002-Bug-2055018-Add-some-missing-X11UndefineNone-include.patch
+  0003-Bug-2055288-Add-missing-include-cstdint-to-DataChann.patch
 )
 validpgpkeys=(
   # Mozilla Software Releases <release@mozilla.com>

Comment

Low risk. The PKGBUILD change only adds two upstream patch files and updates their checksums, then generalizes prepare() to apply all *.patch files from the declared source array. The new patches are small, upstream-authored source fixes (include cleanup / missing headers) and do not introduce network access, privilege escalation, persistence, or installation outside pkgdir. I did not see any suspicious build-time downloads or shell execution beyond the existing patch application. The only notable change is that prepare() now auto-applies every patch source, which is acceptable here because the patch list is explicit and checksum-pinned.

@@ -97,12 +103,16 @@ sha256sums=('SKIP'
             'cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8'
             '4304902899987928ea51b7020fb1298b01fa77e327ef66ab00b061f767042b9f'
             '9649563e8703b4f4b43469029fe20e3bd0c1209dbaa4c2d664c00e089abd7fa0'
-            '3cef02fd2fa711204ce25e73c8dc896a2a2bd0d48cd4a05df4d6349199645bb2')
+            '844423079aa1ffc5f6ee66df2f43d27879d2a761073939747945da5409bec191'
+            'add89c5abc3463548b4a401f5cde7b94df67dfe19fea09864db238dbb2681648'
+            'f1151ff907231aacf604a71c21dc17259146eb6c51d7ea01a7d728e19e62f07d')
 b2sums=('SKIP'
         'f2a9cfb758692584dd8057ab30d0ed9d22f5356d0021e1c8111a061866ee66d6b2d891351e11064f904fe8c90032e78f9def61ed54ae4208c8be4de6b4226277'
         '9c748d4c330d37d10862c73b3092c0d4308030fb62ca80da56ba9b3c3350ba4d779570308d1dd8e2c7d873f269654b72030702c5abc772aabfdfe7f39320a8b9'
         '561d6fd3b394eee3242c1db12c0520e865488b3e5c1943a398994857b1fcad520ed4387ea93bc9402356649a0b3db6911bcd3a9f8d388bbe88a58a2efec0aa14'
-        '9d652eb28c3762c91131e25e31912d8ad47a5143cebd0d8dd3a6042b219de44007703b318d13600c9fae9d3227c7f15bdd8c917837a1a07e8cbea6c75c9fcc41')
+        '70e8bfd40bf23afa3f6de2d975aa69043cb88ae14b625702b754cd3de56215be159cf69ba4ed522ca7122b8bbdb50cfe763694e7c7595f2fdcec40bab5e2739f'
+        '457f9d30311823107177558872a83ce2742de4d09b67f138e7914bfa73ca51c262cf1a8650b29d7d7e0d60ea8ce34375cc93ef0541ebdee3421985df3035d783'
+        '6421e6a2e5a02cd079ed00358373051e7a2380e9b97f45b181f6bb7267701325f232e18ef725f388f4ed0e4f56c94a08b074f10587b2f7c146192cf781fc81c6')
 
 # Google API keys (see https://www.chromium.org/developers/how-tos/api-keys)
 # Note: These are for Arch Linux use ONLY. For your own distribution, please

Comment

Risk is low. The change replaces a hardcoded patch application with a loop over all declared *.patch sources in PKGBUILD, but it still only applies files already listed in source=() and verified by checksums. I inspected the added patches: they are ordinary upstream/packaging fixes with no network access, privilege escalation, persistence, or embedded binaries. The new logic does slightly broaden which patch files get applied, but in this package the only patch sources are the three expected local patch files, so there is no meaningful security regression.

@@ -134,8 +144,15 @@ prepare() {
   mkdir mozbuild
   cd mozilla-central
 
-  # Make different channels installable in parallel
-  patch -Np1 -i ../0001-Install-under-remoting-name.patch
+  local src
+  for src in "${source[@]}"; do
+    src="${src%%::*}"
+    src="${src##*/}"
+    src="${src%.zst}"
+    [[ $src = *.patch ]] || continue
+    echo "Applying patch $src..."
+    patch -Np1 < "../$src"
+  done
 
   echo -n "$_google_api_key" >google-api-key