Review Results

Comment

The change only bumps pkgver in .SRCINFO from 34.3.1 to 34.3.2. No build logic, sources, checksums, install scripts, or permissions are altered, and there are no new network, privilege, or persistence concerns visible in this diff. This is a low-risk metadata update.

@@ -1,6 +1,6 @@
 pkgbase = palemoon
 	pkgdesc = Open source web browser based on Firefox focusing on efficiency.
-	pkgver = 34.3.1
+	pkgver = 34.3.2
 	pkgrel = 1
 	epoch = 1
 	url = https://www.palemoon.org/

Comment

The .SRCINFO update is a routine version bump from 34.3.1 to 34.3.2 with corresponding source commit and checksum refreshes. The source remains pinned to an HTTPS git commit and still uses the existing signed upstream repository with the same valid PGP key. No new sources, scripts, install hooks, privilege changes, or other suspicious packaging behavior are introduced in this diff. Risk is low.

@@ -37,14 +37,14 @@ pkgbase = palemoon
 	depends = pango
 	optdepends = libpulse: PulseAudio audio driver
 	optdepends = ffmpeg: various video and audio support
-	source = git+https://repo.palemoon.org/MoonchildProductions/Pale-Moon?signed#commit=0d869b85fe
+	source = git+https://repo.palemoon.org/MoonchildProductions/Pale-Moon?signed#commit=ea761d3236
 	source = git+https://repo.palemoon.org/MoonchildProductions/UXP
 	source = mozconfig.in
 	validpgpkeys = 3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC
-	sha1sums = edf8c5dbbcb30a9223bed2c8803490c8fd9e0b50
+	sha1sums = 36c7cd453131dc189f985e422989080b6bb2126c
 	sha1sums = SKIP
 	sha1sums = a45ac7de3b664dcadb0917a975ee0b859385b719
-	sha256sums = 308d62a79fded39c006b247a7b8a1659269d320a8d93bac4ce6b4a3a5e21f332
+	sha256sums = c00dad257151197af6023abaecff88697a60186707554e06361210985426b4ca
 	sha256sums = SKIP
 	sha256sums = d74ba2d07f5ddb9a8268c64745995a310f5aa2033ca3c8634a22e0cbcf0fa3c2
 

Comment

The change is a routine version bump for palemoon: it updates pkgver and the pinned upstream commit, and refreshes the corresponding source checksums. The source remains fetched over HTTPS from the official Pale Moon repository, with the git source still pinned to a specific commit and signed-tag verification retained. No new build steps, scripts, network fetches, privilege changes, or packaging behavior were introduced in this diff. I found no security-relevant red flags in the reviewed hunk.

@@ -7,9 +7,9 @@
 pkgname=palemoon
 _repo=Pale-Moon
 epoch=1
-pkgver=34.3.1
+pkgver=34.3.2
 # Commit ID can be found at https://repo.palemoon.org/MoonchildProductions/Pale-Moon/tags
-_commit=0d869b85fe
+_commit=ea761d3236
 pkgrel=1
 pkgdesc="Open source web browser based on Firefox focusing on efficiency."
 arch=('i686' 'x86_64')

Comment

The change is a routine version bump for Pale Moon from 34.3.1 to 34.3.2, updating the pinned upstream commit and the corresponding source checksums. The source remains fetched over HTTPS from the official repository, and there are no new build-time downloads, scripts, privilege changes, or packaging logic changes in the diff. No security red flags are evident from this change alone.

@@ -53,10 +53,10 @@ source=(git+"https://repo.palemoon.org/MoonchildProductions/${_repo}?signed#comm
         git+"https://repo.palemoon.org/MoonchildProductions/UXP"
         mozconfig.in)
 validpgpkeys=('3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC')
-sha1sums=('edf8c5dbbcb30a9223bed2c8803490c8fd9e0b50'
+sha1sums=('36c7cd453131dc189f985e422989080b6bb2126c'
           'SKIP'
           'a45ac7de3b664dcadb0917a975ee0b859385b719')
-sha256sums=('308d62a79fded39c006b247a7b8a1659269d320a8d93bac4ce6b4a3a5e21f332'
+sha256sums=('c00dad257151197af6023abaecff88697a60186707554e06361210985426b4ca'
             'SKIP'
             'd74ba2d07f5ddb9a8268c64745995a310f5aa2033ca3c8634a22e0cbcf0fa3c2')