Review Results

Comment

The change only bumps pkgver in .SRCINFO from 153.0.0_3 to 153.0.1_1. No build logic, sources, checksums, install scripts, or permissions are altered in the provided diff, so there is no direct security impact visible here. This appears to be a routine version update metadata change.

@@ -1,6 +1,6 @@
 pkgbase = librewolf-bin
 	pkgdesc = Community-maintained fork of Firefox, focused on privacy, security and freedom.
-	pkgver = 153.0.0_3
+	pkgver = 153.0.1_1
 	pkgrel = 1
 	epoch = 1
 	url = https://librewolf.net/

Comment

The change is a straightforward version bump in .SRCINFO from LibreWolf 153.0-3 to 153.0.1-1, updating the pinned VCS tag, package tarball URLs, and corresponding SHA-256 checksums for x86_64 and aarch64. The sources remain HTTPS and point to the same official Codeberg project/package endpoints, with no new build-time commands, scripts, or privilege-related artifacts introduced by this diff. I do not see any security red flags in the metadata change itself.

@@ -54,20 +54,20 @@ pkgbase = librewolf-bin
 	options = !debug
 	backup = usr/lib/librewolf/librewolf.cfg
 	backup = usr/lib/librewolf/distribution/policies.json
-	source = git+https://codeberg.org/librewolf/source.git#tag=153.0-3
+	source = git+https://codeberg.org/librewolf/source.git#tag=153.0.1-1
 	source = default192x192.png
 	source = librewolf.desktop
 	validpgpkeys = 662E3CDD6FE329002D0CA5BB40339DD82B12EF16
-	sha256sums = 14f26f3550a40ccacb261e708fc0bc5d963040f1757dc4f8738fd8871f8c3ef2
+	sha256sums = 8c2d1e319836c569a4c3c1d5b920631a0d3055b5ff3acdc1be75adf7ffe935b0
 	sha256sums = 959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1
 	sha256sums = 3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae
-	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/153.0-3/librewolf-153.0-3-linux-x86_64-package.tar.xz
-	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/153.0-3/librewolf-153.0-3-linux-x86_64-package.tar.xz.sig
-	sha256sums_x86_64 = 208a64b6c099440f1d61169b40afef1fda2b61e3c90b0b26f28036b7e21df2be
+	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/153.0.1-1/librewolf-153.0.1-1-linux-x86_64-package.tar.xz
+	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/153.0.1-1/librewolf-153.0.1-1-linux-x86_64-package.tar.xz.sig
+	sha256sums_x86_64 = 7b56e06071ece9e711a1c811e64129a3a14775c5fe00a4b777e5cbb0b087b5b5
 	sha256sums_x86_64 = SKIP
-	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/153.0-3/librewolf-153.0-3-linux-arm64-package.tar.xz
-	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/153.0-3/librewolf-153.0-3-linux-arm64-package.tar.xz.sig
-	sha256sums_aarch64 = e0c8303db024d7ca7a35f967adfed5f6e4edddbb9573731b55b4f40fd089168f
+	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/153.0.1-1/librewolf-153.0.1-1-linux-arm64-package.tar.xz
+	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/153.0.1-1/librewolf-153.0.1-1-linux-arm64-package.tar.xz.sig
+	sha256sums_aarch64 = 951930d522d2b043e70a4e08912a3de401408a9c935b2531d7ee224f57f7cbe0
 	sha256sums_aarch64 = SKIP
 
 pkgname = librewolf-bin

Comment

The change is a straightforward version bump in PKGBUILD: it updates pkgver and the corresponding source checksums for the upstream LibreWolf release artifacts and the pinned git tag. I did not see any new build-time commands, network fetches outside source=(), privilege changes, install-script changes, or other suspicious packaging behavior introduced by this diff. Risk is low because the only effect is to trust a new upstream release and refreshed hashes.

@@ -4,7 +4,7 @@ pkgname=librewolf-bin
 provides=(${pkgname//-bin/""})
 conflicts=(${pkgname//-bin/""})
 epoch=1
-pkgver=153.0.0_3
+pkgver=153.0.1_1
 _fixedfirefoxver="${pkgver%_*}" # Version of Firefox this LibreWolf version is based on, but the Firefox patch number is always included
 _librewolfver="${pkgver#*_}"
 _firefoxver="${_fixedfirefoxver%.0}" # Removes ".0" from the end. For "136.0.0" this will result in "136.0" but for "136.0.1" won't do anything.

Comment

The change only updates SHA-256 checksums for the existing source tarball and architecture-specific uploads/signatures. No build logic, install scripts, permissions, or network behavior changed. I did not find any new red flags in the provided hunk; this appears to be a routine source refresh/integrity update. Risk is low because the security impact is limited to trusting the new upstream artifacts, which is expected for a version bump in a binary package.

@@ -76,12 +76,12 @@ source=(
 )
 source_aarch64=("${_uploadpath_aarch64}" "${_uploadpath_sig_aarch64}")
 source_x86_64=("${_uploadpath_x86_64}" "${_uploadpath_sig_x86_64}")
-sha256sums=('14f26f3550a40ccacb261e708fc0bc5d963040f1757dc4f8738fd8871f8c3ef2'
+sha256sums=('8c2d1e319836c569a4c3c1d5b920631a0d3055b5ff3acdc1be75adf7ffe935b0'
             '959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1'
             '3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae')
-sha256sums_x86_64=('208a64b6c099440f1d61169b40afef1fda2b61e3c90b0b26f28036b7e21df2be'
+sha256sums_x86_64=('7b56e06071ece9e711a1c811e64129a3a14775c5fe00a4b777e5cbb0b087b5b5'
                    'SKIP')
-sha256sums_aarch64=('e0c8303db024d7ca7a35f967adfed5f6e4edddbb9573731b55b4f40fd089168f'
+sha256sums_aarch64=('951930d522d2b043e70a4e08912a3de401408a9c935b2531d7ee224f57f7cbe0'
                     'SKIP')
 
 package() {