Review Results

Comment

The change only bumps pkgver in .SRCINFO from 34.3.2 to 34.3.2.1. No sources, checksums, build steps, install scripts, permissions, or package metadata beyond the version string are altered. Based on the provided diff, there is no security-relevant behavior change.

@@ -1,6 +1,6 @@
 pkgbase = palemoon
 	pkgdesc = Open source web browser based on Firefox focusing on efficiency.
-	pkgver = 34.3.2
+	pkgver = 34.3.2.1
 	pkgrel = 1
 	epoch = 1
 	url = https://www.palemoon.org/

Comment

The .SRCINFO change is a routine version/source checksum bump for the Pale Moon package. The source remains pinned to a specific git commit over HTTPS, and the only other changes are updated checksums and pkgver metadata. I do not see any new sources, build-time network fetches, privilege escalation, or packaging red flags in this diff alone.

@@ -37,14 +37,14 @@ pkgbase = palemoon
 	depends = pango
 	optdepends = libpulse: PulseAudio audio driver
 	optdepends = ffmpeg: various video and audio support
-	source = git+https://repo.palemoon.org/MoonchildProductions/Pale-Moon?signed#commit=ea761d3236
+	source = git+https://repo.palemoon.org/MoonchildProductions/Pale-Moon?signed#commit=eb57a4069a
 	source = git+https://repo.palemoon.org/MoonchildProductions/UXP
 	source = mozconfig.in
 	validpgpkeys = 3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC
-	sha1sums = 36c7cd453131dc189f985e422989080b6bb2126c
+	sha1sums = 2522097b64a0040ce51a52c005b6549921aa4e66
 	sha1sums = SKIP
 	sha1sums = a45ac7de3b664dcadb0917a975ee0b859385b719
-	sha256sums = c00dad257151197af6023abaecff88697a60186707554e06361210985426b4ca
+	sha256sums = d815234c61ee62850ca607ad87788196a58698bec6990a00a3a773c09efbdcb1
 	sha256sums = SKIP
 	sha256sums = d74ba2d07f5ddb9a8268c64745995a310f5aa2033ca3c8634a22e0cbcf0fa3c2
 

Comment

The change is a routine version bump for a VCS-sourced package: it updates pkgver/_commit to a newer upstream commit and refreshes the corresponding source checksums. The source remains pinned to an explicit commit over HTTPS, there are no new build-time downloads, no added scripts, and no packaging/persistence red flags in the diff. Based on the provided hunk, this looks low risk.

@@ -7,9 +7,9 @@
 pkgname=palemoon
 _repo=Pale-Moon
 epoch=1
-pkgver=34.3.2
+pkgver=34.3.2.1
 # Commit ID can be found at https://repo.palemoon.org/MoonchildProductions/Pale-Moon/tags
-_commit=ea761d3236
+_commit=eb57a4069a
 pkgrel=1
 pkgdesc="Open source web browser based on Firefox focusing on efficiency."
 arch=('i686' 'x86_64')

Comment

The change only updates the pinned upstream version/commit and refreshes the corresponding source checksums in PKGBUILD. The source URLs remain HTTPS and point to the upstream Pale Moon repositories, with the git source still pinned to a specific commit. No new build steps, scripts, network fetches, privilege changes, or packaging behavior were introduced in this diff. Security risk appears low and limited to the usual trust in upstream source integrity.

@@ -53,10 +53,10 @@ source=(git+"https://repo.palemoon.org/MoonchildProductions/${_repo}?signed#comm
         git+"https://repo.palemoon.org/MoonchildProductions/UXP"
         mozconfig.in)
 validpgpkeys=('3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC')
-sha1sums=('36c7cd453131dc189f985e422989080b6bb2126c'
+sha1sums=('2522097b64a0040ce51a52c005b6549921aa4e66'
           'SKIP'
           'a45ac7de3b664dcadb0917a975ee0b859385b719')
-sha256sums=('c00dad257151197af6023abaecff88697a60186707554e06361210985426b4ca'
+sha256sums=('d815234c61ee62850ca607ad87788196a58698bec6990a00a3a773c09efbdcb1'
             'SKIP'
             'd74ba2d07f5ddb9a8268c64745995a310f5aa2033ca3c8634a22e0cbcf0fa3c2')