Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 34.1.0 to 34.3.2.1. No build logic, sources, checksums, install scripts, or permissions are changed here, so there is no direct security impact visible in this diff. The remaining metadata still shows an HTTP homepage URL, but that pre-existed and is not introduced by this change. Based on the provided hunk alone, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = palemoon-bin
 	pkgdesc = Open source web browser based on Firefox focusing on efficiency.
-	pkgver = 34.1.0
+	pkgver = 34.3.2.1
 	pkgrel = 1
 	epoch = 1
 	url = http://linux.palemoon.org/

Comment

This is a routine version bump in .SRCINFO for an AUR binary package. The change updates the advertised package version, desktop file tag URL, release tarball URL, and corresponding checksum to Pale Moon 34.3.2.1. The sources are HTTPS, point to the upstream Pale Moon release infrastructure, and there are no new build-time commands, install-script changes, or packaging permission/persistence red flags in this diff. Based on the provided hunk alone, I do not see a security issue.

@@ -16,16 +16,16 @@ pkgbase = palemoon-bin
 	depends = mime-types
 	depends = nss
 	optdepends = ffmpeg: record, convert, and stream audio and video
-	provides = palemoon=34.1.0
+	provides = palemoon=34.3.2.1
 	conflicts = palemoon
 	options = !strip
-	source = palemoon.desktop-34.1.0::https://repo.palemoon.org/MoonchildProductions/Pale-Moon/raw/tag/34.1.0_Release/palemoon/branding/official/palemoon.desktop
-	source = https://rm-eu.palemoon.org/release/palemoon-34.1.0.linux-x86_64-gtk2.tar.xz
-	source = https://rm-eu.palemoon.org/release/palemoon-34.1.0.linux-x86_64-gtk2.tar.xz.sig
+	source = palemoon.desktop-34.3.2.1::https://repo.palemoon.org/MoonchildProductions/Pale-Moon/raw/tag/34.3.2.1_Release/palemoon/branding/official/palemoon.desktop
+	source = https://rm-eu.palemoon.org/release/palemoon-34.3.2.1.linux-x86_64-gtk2.tar.xz
+	source = https://rm-eu.palemoon.org/release/palemoon-34.3.2.1.linux-x86_64-gtk2.tar.xz.sig
 	validpgpkeys = 439F46F42C6AE3D23CF52E70865E6C87C65285EC
 	validpgpkeys = 3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC
 	sha256sums = b3803b30b5e6b9589387b7162cd24247da242fe77c0aed0d09bc51338d36d7d8
-	sha256sums = da6e8e00854ce0af53883397c7b58c44309837c2afda519bb53fc087c8c16cc2
+	sha256sums = 14c854afb69a78fae7b3b2a7bd700751c61cf5b95007ec94038d813675009bec
 	sha256sums = SKIP
 
 pkgname = palemoon-bin

Comment

The change is a routine version bump for a prebuilt browser package, with the only substantive modification being the tarball checksum update to match the new upstream release. The source URLs remain HTTPS and point to the official Pale Moon repository, and there are no added build-time downloads, scripts, privilege changes, or packaging logic changes in this diff. No security red flags are introduced by this hunk alone.

@@ -5,7 +5,7 @@
 
 pkgname=palemoon-bin
 epoch=1
-pkgver=34.1.0
+pkgver=34.3.2.1
 pkgrel=1
 pkgdesc="Open source web browser based on Firefox focusing on efficiency."
 arch=('x86_64')

Comment

The change only updates the PKGBUILD to a new upstream Pale Moon release and refreshes the tarball checksum. The source URLs remain HTTPS and point to the official Pale Moon infrastructure, the package still verifies the release signature via the existing .sig and pinned PGP keys, and there are no new build-time commands, install-script changes, or packaging behavior changes. I do note the package still uses an HTTP homepage URL in metadata, but that predates this change and is not part of the diff under review. No new security issue is introduced by this patch.

@@ -27,7 +27,7 @@ source=(palemoon.desktop-${pkgver}::"https://repo.palemoon.org/MoonchildProducti
 #      "https://rm-us.palemoon.org/release/palemoon-${pkgver}.linux-x86_64-gtk2.tar.xz"{,.sig}) # US link
 # link to latest tarball: https://www.palemoon.org/download.shtml
 sha256sums=('b3803b30b5e6b9589387b7162cd24247da242fe77c0aed0d09bc51338d36d7d8'
-            'da6e8e00854ce0af53883397c7b58c44309837c2afda519bb53fc087c8c16cc2'
+            '14c854afb69a78fae7b3b2a7bd700751c61cf5b95007ec94038d813675009bec'
             'SKIP')
 validpgpkeys=('439F46F42C6AE3D23CF52E70865E6C87C65285EC' # T. Wine
               '3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC') # Moonchild, see https://forum.palemoon.org/viewtopic.php?f=1&t=7176