Review Results

Comment

The change only bumps .SRCINFO pkgver from 15.0.17 to 15.0.19. No source URLs, checksums, build commands, install scripts, or packaging logic are altered in the provided diff hunk. On its face this is a routine version metadata update with no direct security impact visible in the reviewed change.

@@ -1,6 +1,6 @@
 pkgbase = tor-browser-bin
 	pkgdesc = Tor Browser Bundle: anonymous browsing using Firefox and Tor
-	pkgver = 15.0.17
+	pkgver = 15.0.19
 	pkgrel = 1
 	url = https://www.torproject.org/projects/torbrowser.html
 	install = tor-browser.install

Comment

The change is a straightforward version bump in .SRCINFO from Tor Browser 15.0.17 to 15.0.19, updating the noextract entries and source URLs/checksums to the Tor Project archive over HTTPS. There are no new build steps, scripts, permissions changes, or suspicious sources introduced in this diff. The package remains a prebuilt binary package from the official upstream archive, and the integrity metadata is updated accordingly. No security red flags are evident in the reviewed hunk.

@@ -28,8 +28,8 @@ pkgbase = tor-browser-bin
 	optdepends = libnotify: Gnome dialog boxes
 	provides = tor-browser
 	conflicts = tor-browser
-	noextract = tor-browser-linux-i686-15.0.17.tar.xz
-	noextract = tor-browser-linux-x86_64-15.0.17.tar.xz
+	noextract = tor-browser-linux-i686-15.0.19.tar.xz
+	noextract = tor-browser-linux-x86_64-15.0.19.tar.xz
 	source = tor-browser.desktop.in
 	source = tor-browser.in
 	source = tor-browser.png

Comment

The change is a straightforward version bump in .SRCINFO from Tor Browser 15.0.17 to 15.0.19, with HTTPS sources still pointing to the official Tor Project archive and matching updated checksums. No new sources, scripts, build steps, or packaging behavior are introduced in this diff, and the .asc signature files remain present. Based on the provided hunk alone, there are no obvious security red flags.

@@ -39,13 +39,13 @@ pkgbase = tor-browser-bin
 	sha256sums = 53754c8ff0ea01d8f79d3e725fa3516511faf1e53804c67dc8f573cdb39e35a3
 	sha256sums = f25ccf68b47f5eb14c6fec0664c74f30ea9c6c58d42fc6abac3b64670aaa3152
 	sha256sums = 7b28b5dbe8ad573bb46e61b4d542b33e01ca240825ca640b4893fee6203b021f
-	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.17/tor-browser-linux-i686-15.0.17.tar.xz
-	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.17/tor-browser-linux-i686-15.0.17.tar.xz.asc
-	sha256sums_i686 = a4a9802835aeb52a7ba6d27ae8f3224b9f5a57ea51b373b3f6957ae2446e79b2
+	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.19/tor-browser-linux-i686-15.0.19.tar.xz
+	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.19/tor-browser-linux-i686-15.0.19.tar.xz.asc
+	sha256sums_i686 = 37e4e3a49ac783c701eafc02aab4d69f3e3f770ceedbfaf9e6436690b7a65af5
 	sha256sums_i686 = SKIP
-	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.17/tor-browser-linux-x86_64-15.0.17.tar.xz
-	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.17/tor-browser-linux-x86_64-15.0.17.tar.xz.asc
-	sha256sums_x86_64 = 58914377e0d58f8a0a1e3bfba72df256bb6daeb08715c1c96f2bcb34ec028e1b
+	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.19/tor-browser-linux-x86_64-15.0.19.tar.xz
+	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.19/tor-browser-linux-x86_64-15.0.19.tar.xz.asc
+	sha256sums_x86_64 = 2eb4ab431f4921ca63b123b6f9f445a073fbf7b65f188f45a577d576eb2be2cf
 	sha256sums_x86_64 = SKIP
 
 pkgname = tor-browser-bin

Comment

The change only bumps pkgver from 15.0.17 to 15.0.19 and replaces the architecture-specific checksum helper calls with fixed SHA-256 values for the new release tarballs. I do not see any new code execution, network fetches outside source(), privilege changes, or packaging behavior changes in this diff. The package still points to the official Tor Project URL, and this looks like a routine version/update integrity refresh.

@@ -18,7 +18,7 @@
 
 _appname='tor-browser'
 pkgname="${_appname}-bin"
-pkgver='15.0.17'
+pkgver='15.0.19'
 pkgrel=1
 pkgdesc='Tor Browser Bundle: anonymous browsing using Firefox and Tor'
 url='https://www.torproject.org/projects/torbrowser.html'

Comment

The change is a straightforward version bump plus replacement of dynamic checksum computation for the i686/x86_64 tarballs with fixed SHA-256 values. That reduces flexibility but does not introduce any new execution paths, network fetches, privilege changes, or packaging behavior changes. The sources remain Tor Project release artifacts over HTTPS, and the diff does not add suspicious scripts or install-time actions. No security issue is evident from this hunk alone.

@@ -72,9 +72,9 @@ sha256sums=('604f5d7cc642d56c919b9d2b7b20a785db4acebf58520f41845347bd81e8ec73'
             '53754c8ff0ea01d8f79d3e725fa3516511faf1e53804c67dc8f573cdb39e35a3'
             'f25ccf68b47f5eb14c6fec0664c74f30ea9c6c58d42fc6abac3b64670aaa3152'
             '7b28b5dbe8ad573bb46e61b4d542b33e01ca240825ca640b4893fee6203b021f')
-sha256sums_i686=("$(_dist_checksum "${_tag_i686}")"
+sha256sums_i686=('37e4e3a49ac783c701eafc02aab4d69f3e3f770ceedbfaf9e6436690b7a65af5'
                  'SKIP')
-sha256sums_x86_64=("$(_dist_checksum "${_tag_x86_64}")"
+sha256sums_x86_64=('2eb4ab431f4921ca63b123b6f9f445a073fbf7b65f188f45a577d576eb2be2cf'
                    'SKIP')
 
 noextract=("${_appname}-${_tag_i686}-${pkgver}.tar.xz"