Review Results

Comment

The only change in this .SRCINFO hunk is a pkgver bump for firefox-nightly from one upstream nightly build identifier to the next. There are no changes to sources, checksums, build logic, install scripts, permissions, or package metadata that would introduce new attack surface. Based on the provided diff, this is a routine version update with no security red flags.

@@ -1,6 +1,6 @@
 pkgbase = firefox-nightly
 	pkgdesc = Fast, Private & Safe Web Browser (Nightly version)
-	pkgver = 155.0a1+20260724.2+hdc7f12a8cbce
+	pkgver = 155.0a1+20260725.1+hdb59e73163ec
 	pkgrel = 1
 	url = https://www.firefox.com/channel/desktop/#nightly
 	arch = x86_64

Comment

The .SRCINFO-only change removes one source entry and its corresponding checksums while bumping pkgver to a newer nightly snapshot. I do not see any added code, scripts, or integrity regressions in this diff itself; it is just metadata synchronization with the PKGBUILD/source set. Since the removed patch is not present in this change and there is no evidence here of malicious sources, build-time downloads, or privilege-related artifacts, the risk is low.

@@ -73,19 +73,16 @@ pkgbase = firefox-nightly
 	source = firefox-nightly.desktop
 	source = org.mozilla.firefox-nightly.metainfo.xml
 	source = 0001-Install-under-remoting-name.patch
-	source = 0002-Bug-2057594-Restore-dummy-call-to-gdk_display_get_de.patch
 	validpgpkeys = 14F26682D0916CDD81E37B6D61B7B526D98F0353
 	sha256sums = SKIP
 	sha256sums = cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8
 	sha256sums = 4304902899987928ea51b7020fb1298b01fa77e327ef66ab00b061f767042b9f
 	sha256sums = 3e8161b00492e2b2a1e86c54497ba87e38af1a48ae13b97e471f9d7c2089a5d2
 	sha256sums = 582fa099e402827bbe8aa98fac5d0cdc0e26baef9af22852cf6b2a6bcc96a1d0
-	sha256sums = 2cca2f6b9b1299bc27edbfdfb1dcae28e95f92e86a52ebb4a72bbf1addc3aa3d
 	b2sums = SKIP
 	b2sums = f2a9cfb758692584dd8057ab30d0ed9d22f5356d0021e1c8111a061866ee66d6b2d891351e11064f904fe8c90032e78f9def61ed54ae4208c8be4de6b4226277
 	b2sums = 9c748d4c330d37d10862c73b3092c0d4308030fb62ca80da56ba9b3c3350ba4d779570308d1dd8e2c7d873f269654b72030702c5abc772aabfdfe7f39320a8b9
 	b2sums = 75669773bcbdd27bad02f7e32e9c42fa9ffad89d7d614ad3ea35bb57a21d659dabe0cf6ae3e3007fc37954c7eec3d3f5a11be1a24b9fe3655e8547e29f31f2cd
 	b2sums = ac75481b855e521f94a2539bf617bab037428ba176b492ba9e81a2ee75bed9f0db59109ea06b8510ca214acfdddac420f520e940053e61cbe977c67fd7f801ce
-	b2sums = 7e07d1bc98bfe83593166495cc10ec0c222e0fffcf163eb743ea98fe07dede870e2cfe181a158f7a8e15b45eecc3b571e3f1336b4a40f2e2937b268b57ef45d1
 
 pkgname = firefox-nightly

Comment

The change only bumps pkgver to a newer Firefox Nightly snapshot string. No source URLs, build steps, dependencies, install scripts, or packaging logic changed in the provided hunk, and there are no new integrity or execution red flags visible here. This appears to be a routine version update with no security impact in the diff shown.

@@ -3,7 +3,7 @@
 # Contributor: Jakub Schmidtke <sjakub@gmail.com>
 
 pkgname=firefox-nightly
-pkgver=155.0a1+20260724.2+hdc7f12a8cbce
+pkgver=155.0a1+20260725.1+hdb59e73163ec
 pkgrel=1
 pkgdesc="Fast, Private & Safe Web Browser (Nightly version)"
 url="https://www.firefox.com/channel/desktop/#nightly"

Comment

The change only removes one source patch from the PKGBUILD source array. I checked the surrounding context and there are no new downloads, scripts, privilege changes, install hooks, or packaging behavior changes introduced by this diff. The removed patch was a local fix for Wayland hardware rendering, so this is a functional regression risk rather than a security issue. No supply-chain or integrity red flags are present in the reviewed hunk.

@@ -89,10 +89,6 @@ source=(
 
   # Make different channels installable in parallel
   0001-Install-under-remoting-name.patch
-
-  # Fix hardware rendering on Wayland
-  # https://bugzilla.mozilla.org/show_bug.cgi?id=2057594
-  0002-Bug-2057594-Restore-dummy-call-to-gdk_display_get_de.patch
 )
 validpgpkeys=(
   # Mozilla Software Releases <release@mozilla.com>

Comment

The change only updates the nightly version and removes one source patch plus its checksum entries. I do not see any new network fetches, privilege changes, install-script behavior, or other suspicious packaging logic in this diff. The removed patch appears to be a local Firefox Wayland fix, so dropping it is more likely a functional regression than a security issue. Overall risk is low.

@@ -103,14 +99,12 @@ sha256sums=('SKIP'
             'cb00ea359d6daf37900102307be4f515f1b7ef9c98825c64cc55bb562449d0d8'
             '4304902899987928ea51b7020fb1298b01fa77e327ef66ab00b061f767042b9f'
             '3e8161b00492e2b2a1e86c54497ba87e38af1a48ae13b97e471f9d7c2089a5d2'
-            '582fa099e402827bbe8aa98fac5d0cdc0e26baef9af22852cf6b2a6bcc96a1d0'
-            '2cca2f6b9b1299bc27edbfdfb1dcae28e95f92e86a52ebb4a72bbf1addc3aa3d')
+            '582fa099e402827bbe8aa98fac5d0cdc0e26baef9af22852cf6b2a6bcc96a1d0')
 b2sums=('SKIP'
         'f2a9cfb758692584dd8057ab30d0ed9d22f5356d0021e1c8111a061866ee66d6b2d891351e11064f904fe8c90032e78f9def61ed54ae4208c8be4de6b4226277'
         '9c748d4c330d37d10862c73b3092c0d4308030fb62ca80da56ba9b3c3350ba4d779570308d1dd8e2c7d873f269654b72030702c5abc772aabfdfe7f39320a8b9'
         '75669773bcbdd27bad02f7e32e9c42fa9ffad89d7d614ad3ea35bb57a21d659dabe0cf6ae3e3007fc37954c7eec3d3f5a11be1a24b9fe3655e8547e29f31f2cd'
-        'ac75481b855e521f94a2539bf617bab037428ba176b492ba9e81a2ee75bed9f0db59109ea06b8510ca214acfdddac420f520e940053e61cbe977c67fd7f801ce'
-        '7e07d1bc98bfe83593166495cc10ec0c222e0fffcf163eb743ea98fe07dede870e2cfe181a158f7a8e15b45eecc3b571e3f1336b4a40f2e2937b268b57ef45d1')
+        'ac75481b855e521f94a2539bf617bab037428ba176b492ba9e81a2ee75bed9f0db59109ea06b8510ca214acfdddac420f520e940053e61cbe977c67fd7f801ce')
 
 # Google API keys (see https://www.chromium.org/developers/how-tos/api-keys)
 # Note: These are for Arch Linux use ONLY. For your own distribution, please