Review Results

Comment

The .SRCINFO update is a routine version bump for librewolf, and the changed source URL remains on the official Codeberg package endpoint over HTTPS with the expected PGP key pinning. No new sources, scripts, or packaging behavior are introduced by this diff, and the PKGBUILD context shows the version variables are derived consistently from pkgver. I don’t see any integrity or execution red flags in this change alone.

@@ -1,6 +1,6 @@
 pkgbase = librewolf
 	pkgdesc = Community-maintained fork of Firefox, focused on privacy, security and freedom.
-	pkgver = 152.0.6_1
+	pkgver = 153.0.0_3
 	pkgrel = 1
 	epoch = 1
 	url = https://librewolf.net/

Comment

The change is a straightforward upstream version bump in .SRCINFO, updating the source tarball URL and checksum from LibreWolf 152.0.6-1 to 153.0-3. The source remains on the official Codeberg package endpoint over HTTPS, and the PGP key pinning is unchanged. No new scripts, binaries, install hooks, or build-time network behavior are introduced by this metadata-only change. Risk is low.

@@ -73,12 +73,12 @@ pkgbase = librewolf
 	options = !makeflags
 	backup = usr/lib/librewolf/librewolf.cfg
 	backup = usr/lib/librewolf/distribution/policies.json
-	source = https://codeberg.org/api/packages/librewolf/generic/librewolf-source/152.0.6-1/librewolf-152.0.6-1.source.tar.gz
-	source = https://codeberg.org/api/packages/librewolf/generic/librewolf-source/152.0.6-1/librewolf-152.0.6-1.source.tar.gz.sig
+	source = https://codeberg.org/api/packages/librewolf/generic/librewolf-source/153.0-3/librewolf-153.0-3.source.tar.gz
+	source = https://codeberg.org/api/packages/librewolf/generic/librewolf-source/153.0-3/librewolf-153.0-3.source.tar.gz.sig
 	source = librewolf.desktop
 	source = default192x192.png
 	validpgpkeys = 662E3CDD6FE329002D0CA5BB40339DD82B12EF16
-	sha256sums = 041930cb71eeb565b736ff8e6d044381314633b2c3c2b19ab674bf3e19f7f870
+	sha256sums = 48ace24a1d6af6c65e3a663402e7b0af154ff7206ab76fbe5c08311a745e39e3
 	sha256sums = SKIP
 	sha256sums = 3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae
 	sha256sums = 959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1

Comment

The change is a routine version bump in PKGBUILD from 152.0.6_1 to 153.0.0_3 with a corresponding checksum update for one source artifact. I do not see any new sources, build-time downloads, privilege changes, install-script changes, or other suspicious packaging behavior in this diff. Based on the provided hunk alone, this appears low risk.

@@ -7,7 +7,7 @@
 pkgname=librewolf
 _pkgname=LibreWolf
 epoch=1
-pkgver=152.0.6_1
+pkgver=153.0.0_3
 _fixedfirefoxver="${pkgver%_*}" # Version of Firefox this LibreWolf version is based on, but the Firefox patch number is always included
 _librewolfver="${pkgver#*_}"
 _firefoxver="${_fixedfirefoxver%.0}" # Removes ".0" from the end. For "136.0.0" this will result in "136.0" but for "136.0.1" won't do anything.

Comment

The change only updates the PKGBUILD to a new upstream release and refreshes the source tarball checksum. The source is still fetched over HTTPS from the official LibreWolf Codeberg package endpoint, with the signature file retained and the existing PGP key pinning unchanged. I do not see any new build-time network fetches, execution, privilege escalation, or packaging behavior changes in this diff hunk. Risk is low and limited to the usual trust in the new upstream release artifact.

@@ -111,7 +111,7 @@ source=(
   "default192x192.png"
 )
 
-sha256sums=('041930cb71eeb565b736ff8e6d044381314633b2c3c2b19ab674bf3e19f7f870'
+sha256sums=('48ace24a1d6af6c65e3a663402e7b0af154ff7206ab76fbe5c08311a745e39e3'
             'SKIP'
             '3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae'
             '959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1')