Review Results

Comment

The change only bumps the package version in .SRCINFO from 153.0rc1 to 154.0b1. No source URLs, checksums, build steps, install scripts, permissions, or other packaging metadata are altered in this diff hunk. On its face this is a routine version update with no added security risk visible in the provided change.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 153.0rc1
+	pkgver = 154.0b1
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a straightforward version bump in .SRCINFO for the Firefox beta binary package. The source remains an HTTPS download from Mozilla’s official archive, and the checksum was updated accordingly. No new build-time commands, install scripts, privilege changes, or additional sources were introduced in this diff. The only notable point is that the source URL moved from an FTP candidates path to the official archive release path, which is an improvement in integrity rather than a risk.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=153.0rc1
+	provides = firefox=154.0b1
 	conflicts = firefox-beta
-	source = firefox-153.0rc1.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/153.0-candidates/build1/linux-x86_64/en-US/firefox-153.0.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/154.0b1/linux-x86_64/en-US/firefox-154.0b1.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = bfc57e7b6b4e6204b11e7e03c4b93cff708e9fb37f6b9948be243455311d82ee
+	sha256sums = 6bf5f825bb99858c1b4896c69a643b2724cfda885b3f8aa67e217830cbbbdf03
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

This change only bumps pkgver from 153.0rc1 to 154.0b1 in PKGBUILD. No new sources, build steps, install scripts, permissions, or packaging logic are introduced by the diff. Based on the provided hunk alone, there are no security-relevant changes.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=153.0rc1
+pkgver=154.0b1
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward version bump of the Firefox beta binary tarball from 153.0b12 to 154.0b1, with the corresponding SHA-256 checksum updated. The source remains the official Mozilla archive over HTTPS, and no new scripts, patches, install logic, or packaging behavior were introduced. I don’t see any supply-chain red flags in this diff alone.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/153.0b12/linux-x86_64/en-US/firefox-153.0b12.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/154.0b1/linux-x86_64/en-US/firefox-154.0b1.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('bfc57e7b6b4e6204b11e7e03c4b93cff708e9fb37f6b9948be243455311d82ee'
+sha256sums=('6bf5f825bb99858c1b4896c69a643b2724cfda885b3f8aa67e217830cbbbdf03'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')