Review Results

Comment

The change only bumps pkgver in .SRCINFO from 152.0.6_1 to 153.0.0_3 and does not alter sources, checksums, build steps, install scripts, or package metadata in a way that introduces new security concerns. On its own this is a routine version update with no evidence of malicious behavior or integrity regression in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = librewolf-bin
 	pkgdesc = Community-maintained fork of Firefox, focused on privacy, security and freedom.
-	pkgver = 152.0.6_1
+	pkgver = 153.0.0_3
 	pkgrel = 1
 	epoch = 1
 	url = https://librewolf.net/

Comment

The change is a straightforward version bump in .SRCINFO from LibreWolf 152.0.6-1 to 153.0-3, with corresponding checksum and per-arch package URL updates. The added !strip and !debug options only affect packaging/debug symbol handling and do not introduce execution or persistence behavior. Sources remain HTTPS on the upstream Codeberg project, and the package tarballs are still accompanied by signature files. No suspicious new sources, scripts, or privilege-related metadata appear in this diff.

@@ -50,22 +50,24 @@ pkgbase = librewolf-bin
 	provides = librewolf
 	conflicts = librewolf
 	options = !emptydirs
+	options = !strip
+	options = !debug
 	backup = usr/lib/librewolf/librewolf.cfg
 	backup = usr/lib/librewolf/distribution/policies.json
-	source = git+https://codeberg.org/librewolf/source.git#tag=152.0.6-1
+	source = git+https://codeberg.org/librewolf/source.git#tag=153.0-3
 	source = default192x192.png
 	source = librewolf.desktop
 	validpgpkeys = 662E3CDD6FE329002D0CA5BB40339DD82B12EF16
-	sha256sums = 963d9b951be30735116b2fb866cae7df8dd417d5d0d113532381f5a3c076f0e3
+	sha256sums = 14f26f3550a40ccacb261e708fc0bc5d963040f1757dc4f8738fd8871f8c3ef2
 	sha256sums = 959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1
 	sha256sums = 3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae
-	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.6-1/librewolf-152.0.6-1-linux-x86_64-package.tar.xz
-	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.6-1/librewolf-152.0.6-1-linux-x86_64-package.tar.xz.sig
-	sha256sums_x86_64 = 75974b75c9d8d492dd5cd742ddf3e667cb12d39ad67dcc67cb70484ccd76c9da
+	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/153.0-3/librewolf-153.0-3-linux-x86_64-package.tar.xz
+	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/153.0-3/librewolf-153.0-3-linux-x86_64-package.tar.xz.sig
+	sha256sums_x86_64 = 208a64b6c099440f1d61169b40afef1fda2b61e3c90b0b26f28036b7e21df2be
 	sha256sums_x86_64 = SKIP
-	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.6-1/librewolf-152.0.6-1-linux-arm64-package.tar.xz
-	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.6-1/librewolf-152.0.6-1-linux-arm64-package.tar.xz.sig
-	sha256sums_aarch64 = 20d8c01f808ea51f1211875b37d30efaf3d5a5eb771a58249dcddb9c70b845c2
+	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/153.0-3/librewolf-153.0-3-linux-arm64-package.tar.xz
+	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/153.0-3/librewolf-153.0-3-linux-arm64-package.tar.xz.sig
+	sha256sums_aarch64 = e0c8303db024d7ca7a35f967adfed5f6e4edddbb9573731b55b4f40fd089168f
 	sha256sums_aarch64 = SKIP
 
 pkgname = librewolf-bin

Comment

The change is a routine version bump for a binary package, with updated source checksums and no new build logic, scripts, or install-time behavior. The only notable packaging change is adding `!strip !debug`, which reduces symbol stripping/debug splitting but does not introduce code execution or persistence. Sources remain pinned to a specific git tag and Codeberg-hosted release artifacts over HTTPS, and I do not see any new integrity or supply-chain red flags in this diff alone.

@@ -4,7 +4,7 @@ pkgname=librewolf-bin
 provides=(${pkgname//-bin/""})
 conflicts=(${pkgname//-bin/""})
 epoch=1
-pkgver=152.0.6_1
+pkgver=153.0.0_3
 _fixedfirefoxver="${pkgver%_*}" # Version of Firefox this LibreWolf version is based on, but the Firefox patch number is always included
 _librewolfver="${pkgver#*_}"
 _firefoxver="${_fixedfirefoxver%.0}" # Removes ".0" from the end. For "136.0.0" this will result in "136.0" but for "136.0.1" won't do anything.

Comment

The change only adds `!strip` and `!debug` to PKGBUILD options. This does not introduce code execution, network access, privilege escalation, or packaging-path changes; it merely preserves symbols/debug info in the packaged binaries. For a prebuilt `-bin` package this is somewhat unusual and can increase package size and reduce hardening/obfuscation, but it is not itself a security issue in the reviewed diff.

@@ -59,7 +59,7 @@ optdepends=(
 validpgpkeys=('662E3CDD6FE329002D0CA5BB40339DD82B12EF16') # librewolf maintainers
 backup=('usr/lib/librewolf/librewolf.cfg'
         'usr/lib/librewolf/distribution/policies.json')
-options=(!emptydirs)
+options=(!emptydirs !strip !debug)
 install='librewolf-bin.install'
 
 

Comment

The change is low risk. It only bumps the package version and refreshes the SHA-256 checksums for the upstream release artifacts, with no new sources, commands, or install-time behavior introduced. The added `!strip !debug` options reduce stripping/debug handling but do not by themselves introduce code execution or privilege escalation in this binary package. I did not see any suspicious network fetches, scripts, or packaging changes beyond the expected version/checksum update.

@@ -76,12 +76,12 @@ source=(
 )
 source_aarch64=("${_uploadpath_aarch64}" "${_uploadpath_sig_aarch64}")
 source_x86_64=("${_uploadpath_x86_64}" "${_uploadpath_sig_x86_64}")
-sha256sums=('963d9b951be30735116b2fb866cae7df8dd417d5d0d113532381f5a3c076f0e3'
+sha256sums=('14f26f3550a40ccacb261e708fc0bc5d963040f1757dc4f8738fd8871f8c3ef2'
             '959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1'
             '3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae')
-sha256sums_x86_64=('75974b75c9d8d492dd5cd742ddf3e667cb12d39ad67dcc67cb70484ccd76c9da'
+sha256sums_x86_64=('208a64b6c099440f1d61169b40afef1fda2b61e3c90b0b26f28036b7e21df2be'
                    'SKIP')
-sha256sums_aarch64=('20d8c01f808ea51f1211875b37d30efaf3d5a5eb771a58249dcddb9c70b845c2'
+sha256sums_aarch64=('e0c8303db024d7ca7a35f967adfed5f6e4edddbb9573731b55b4f40fd089168f'
                     'SKIP')
 
 package() {