AUR AI Reviewer

Review Results

Version #2088 of icecat · commit eab89f6e6245 · status Reviewed

Risk 0/5 · Safe .SRCINFO
Result #2825

Comment

The only change in this .SRCINFO diff is a pkgrel bump from 1 to 2, with no changes to sources, checksums, build steps, dependencies, install scripts, or package contents. This is a metadata-only rebuild indicator and does not introduce any new security risk on its own.

@@ -1,7 +1,7 @@
 pkgbase = icecat
 	pkgdesc = GNU version of the Firefox ESR browser
 	pkgver = 140.13.0
-	pkgrel = 1
+	pkgrel = 2
 	url = https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git
 	arch = x86_64
 	license = MPL-2.0
Risk 1/5 · Low .SRCINFO
Result #2826

Comment

The .SRCINFO change only renames five existing patch sources to include a python_3.14 prefix and adds one additional patch source, 0006-Add-FFmpeg-63-support.patch.xz. The underlying sources remain HTTPS and pinned, and there is no evidence in this diff of build-time network access, privilege escalation, or install-script persistence. Because .SRCINFO is metadata only, the main security question is whether the newly referenced patch is malicious; however, without the patch contents in this hunk there is no concrete indicator of abuse. Overall this looks like a routine packaging update with low risk, though the added patch should be reviewed in the corresponding patch file for unintended code changes.

@@ -65,16 +65,17 @@ pkgbase = icecat
 	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=715ab58c4226572511cad0496908b64124f6729d
 	source = firefox-esr-140.13.0-1-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/140.13.0esr-candidates/build1/source/firefox-140.13.0esr.source.tar.xz
 	source = 0000-parallelize-makeicecat.diff
-	source = 5fcff175718cd308bc6d6f2996de14eb8a93e2a2.patch
-	source = 23efd75219786d71acff0b4e7c1b0de297b84c4e.patch
-	source = b68b1f93a6e31188486458f32fbe37811257604f.patch
-	source = d4b3eb4f76e81f18c53863b1d55ee146d6ec7d10.patch
-	source = dbf9702ed87ea5c88c2a1ee615998532ac8f10cc.patch
+	source = 1001-python_3.14-5fcff175718cd308bc6d6f2996de14eb8a93e2a2.patch
+	source = 1002-python_3.14-23efd75219786d71acff0b4e7c1b0de297b84c4e.patch
+	source = 1003-python_3.14-b68b1f93a6e31188486458f32fbe37811257604f.patch
+	source = 1004-python_3.14-d4b3eb4f76e81f18c53863b1d55ee146d6ec7d10.patch
+	source = 1005-python_3.14-dbf9702ed87ea5c88c2a1ee615998532ac8f10cc.patch
 	source = 0001-Patch-glsl-optimizer-to-build-with-glibc-2.43.patch
 	source = 0002-Fix-sandbox-to-build-with-glibc-2.43.patch
 	source = 0003-Use-wasm32-wasip1-target.patch
 	source = 0004-update-rust-bindgen-to-fix-clang22-build.patch.xz
 	source = 0005-skia-m142-update.patch.xz
+	source = 0006-Add-FFmpeg-63-support.patch.xz
 	sha256sums = SKIP
 	sha256sums = f53b9dc6942abda1185aa7d79048f59fc075020da36b4dd6b31f668b88714d01
 	sha256sums = 1f1b71fcc22fe5e12bd57e7dcc544599e99071eb17b843b261c77fb86f943288
Risk 0/5 · Safe .SRCINFO
Result #2827

Comment

The change only updates .SRCINFO metadata: pkgrel is bumped from 1 to 2 and a new source entry/checksum is added for 0006-Add-FFmpeg-63-support.patch.xz, alongside renaming existing python_3.14 patch sources. There is no evidence here of malicious behavior, network fetches outside declared sources, privilege escalation, or packaging changes beyond normal source/checksum bookkeeping. The security impact of this diff alone is low; any risk would depend on the contents of the newly added patch, which is not shown in this hunk and is not itself suspicious from the metadata alone.

@@ -88,5 +89,6 @@ pkgbase = icecat
 	sha256sums = 28b086f5492d8e6731fe0dfe34a2e4c6d4d502a9eefa15a31e44b5788cf4df89
 	sha256sums = 8f9b7458760b37766a73d4d2c0e93dc810e59d3844495b9d52b3b61dde59c05d
 	sha256sums = e11aba9839824096f07ca5dc17c9fd5bfa09209f8261ab09f7e473f350a82760
+	sha256sums = e7d30072641dfea9c3bff025db7e3a2c60201e630c5253bda1f2b54a0b5501ae
 
 pkgname = icecat
Risk 2/5 · Moderate .nvchecker.toml
Result #2828

Comment

The change only updates nvchecker metadata, but it introduces a malformed source URL: `https://https.git.savannah.gnu.org/git/gnuzilla.git`. This is not a valid official upstream Git URL and appears to be a typo or broken mirror reference. While this file is used for version checking rather than package build/install, a bad source URL can break update tracking and could be abused if later corrected to an untrusted mirror. The rest of the change switches from regex scraping to git-based version detection, which is reasonable, but the URL integrity issue makes the change unsafe to accept as-is.

@@ -1,4 +1,5 @@
 [icecat]
-source = "regex"
-url = "https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git"
-regex = '([0-9]+\.[0-9]+\.[0-9]+)'
+source = "git"
+git = "https://https.git.savannah.gnu.org/git/gnuzilla.git"
+sort_version_key = 'vercmp'
+prefix = "v"
Risk 0/5 · Safe 1001-python_3.14-5fcff175718cd308bc6d6f2996de14eb8a93e2a2.patch
Result #2829

Comment

The patch is a narrow upstream compatibility fix in a Python source file, replacing legacy AST string extraction (`getattr(keyword.value, "s", "")`) with the Python 3.14 `ast.Constant.value` access. It does not introduce new build-time downloads, privilege changes, persistence, or packaging behavior, and the change is confined to parsing decorator metadata in Mozilla's build tooling. No security-relevant regression is evident from the diff alone.

@@ -0,0 +1,36 @@
+
+# HG changeset patch
+# User Alex Hochheiden <ahochheiden@mozilla.com>
+# Date 1760506957 0
+# Node ID 5fcff175718cd308bc6d6f2996de14eb8a93e2a2
+# Parent  ee3d3f6039da36a2e7428cd8e0a04305de511679
+Bug 1993797 - Fix AST parsing in DecoratorVisitor for Python 3.14 r=firefox-build-system-reviewers,glandium
+
+This is necessary due to the `ast.Str` removal in 3.14.
+
+Differential Revision: https://phabricator.services.mozilla.com/D268646
+
+
+diff --git a/python/mach/mach/command_util.py b/python/mach/mach/command_util.py
+--- a/python/mach/mach/command_util.py
++++ b/python/mach/mach/command_util.py
+@@ -302,17 +302,17 @@ class DecoratorVisitor(ast.NodeVisitor):
+             for name, arg in zip(["command", "subcommand"], decorator.args):
+                 kwarg_dict[name] = arg.value
+ 
+             for keyword in decorator.keywords:
+                 if keyword.arg not in relevant_kwargs:
+                     # We only care about these 3 kwargs, so we can safely skip the rest
+                     continue
+ 
+-                kwarg_dict[keyword.arg] = getattr(keyword.value, "s", "")
++                kwarg_dict[keyword.arg] = keyword.value.value
+ 
+             command = kwarg_dict.pop("command")
+             self.results.setdefault(command, {})
+ 
+             sub_command = kwarg_dict.pop("subcommand", None)
+             virtualenv_name = kwarg_dict.pop("virtualenv_name", None)
+ 
+             if sub_command:
+
Risk 0/5 · Safe 1002-python_3.14-23efd75219786d71acff0b4e7c1b0de297b84c4e.patch
Result #2830

Comment

The patch is a straightforward compatibility update for Python 3.14 AST changes in Mozilla build tooling. It only replaces deprecated ast.Str handling with ast.Constant in parser/rewrite code, and does not introduce network access, privilege escalation, persistence, or packaging changes. The only notable behavior change is that one helper now rejects non-Constant string-like nodes more strictly, but this is in internal build metadata parsing and is not a security concern in the AUR packaging context.

@@ -0,0 +1,109 @@
+
+# HG changeset patch
+# User Mike Hommey <mh+mozilla@glandium.org>
+# Date 1755580149 0
+# Node ID 23efd75219786d71acff0b4e7c1b0de297b84c4e
+# Parent  dbf9702ed87ea5c88c2a1ee615998532ac8f10cc
+Bug 1969769 - Change uses of ast.Str with ast.Constant. r=firefox-build-system-reviewers,ahochheiden
+
+ast.Str was deprecated in python 3.12 and removed in 3.14. It inherited
+from ast.Constant, `Str.s` was equivalent to `Constant.value`, so we can
+use the latter on both old and newer python versions.
+
+Differential Revision: https://phabricator.services.mozilla.com/D261512
+
+
+diff --git a/python/mozbuild/mozbuild/frontend/reader.py b/python/mozbuild/mozbuild/frontend/reader.py
+--- a/python/mozbuild/mozbuild/frontend/reader.py
++++ b/python/mozbuild/mozbuild/frontend/reader.py
+@@ -465,17 +465,17 @@ class TemplateFunction:
+                 return node
+ 
+             def c(new_node):
+                 return ast.copy_location(new_node, node)
+ 
+             return c(
+                 ast.Subscript(
+                     value=c(ast.Name(id=self._global_name, ctx=ast.Load())),
+-                    slice=c(ast.Index(value=c(ast.Str(s=node.id)))),
++                    slice=c(ast.Index(value=c(ast.Constant(value=node.id)))),
+                     ctx=node.ctx,
+                 )
+             )
+ 
+ 
+ class SandboxValidationError(Exception):
+     """Represents an error encountered when validating sandbox results."""
+ 
+@@ -1034,33 +1034,33 @@ class BuildReader:
+                 # We need to branch to deal with python version differences.
+                 if isinstance(target.slice, ast.Constant):
+                     # Python >= 3.9
+                     assert isinstance(target.slice.value, str)
+                     key = target.slice.value
+                 else:
+                     # Others
+                     assert isinstance(target.slice, ast.Index)
+-                    assert isinstance(target.slice.value, ast.Str)
+-                    key = target.slice.value.s
++                    assert isinstance(target.slice.value, ast.Constant)
++                    key = target.slice.value.value
+             elif isinstance(target, ast.Attribute):
+                 assert isinstance(target.attr, str)
+                 key = target.attr
+ 
+             return name, key
+ 
+         def assigned_values(node):
+             value = node.value
+             if isinstance(value, ast.List):
+                 for v in value.elts:
+-                    assert isinstance(v, ast.Str)
+-                    yield v.s
++                    assert isinstance(v, ast.Constant)
++                    yield v.value
+             else:
+-                assert isinstance(value, ast.Str)
+-                yield value.s
++                assert isinstance(value, ast.Constant)
++                yield value.value
+ 
+         assignments = []
+ 
+         class Visitor(ast.NodeVisitor):
+             def helper(self, node):
+                 name, key = assigned_variable(node)
+                 if not name:
+                     return
+diff --git a/python/mozbuild/mozbuild/vendor/rewrite_mozbuild.py b/python/mozbuild/mozbuild/vendor/rewrite_mozbuild.py
+--- a/python/mozbuild/mozbuild/vendor/rewrite_mozbuild.py
++++ b/python/mozbuild/mozbuild/vendor/rewrite_mozbuild.py
+@@ -322,25 +322,23 @@ def assignment_node_to_source_filename_l
+     If this happens, we'll return an empty list. The consequence of this is that we
+     won't be able to match a file against this list, so we may not be able to add it.
+ 
+     (But if the file matches a generated list, perhaps it will be included in the
+     Sources list automatically?)
+     """
+     if isinstance(node.value, ast.List) and "elts" in node.value._fields:
+         for f in node.value.elts:
+-            if not isinstance(f, ast.Constant) and not isinstance(f, ast.Str):
++            if not isinstance(f, ast.Constant):
+                 log(
+                     "Found non-constant source file name in list: ",
+                     ast_get_source_segment(code, f),
+                 )
+                 return []
+-        return [
+-            f.value if isinstance(f, ast.Constant) else f.s for f in node.value.elts
+-        ]
++        return [f.value for f in node.value.elts]
+     elif isinstance(node.value, ast.ListComp):
+         # SOURCES += [f for f in foo if blah]
+         log("Could not find the files for " + ast_get_source_segment(code, node.value))
+     elif isinstance(node.value, ast.Name) or isinstance(node.value, ast.Subscript):
+         # SOURCES += other_var
+         # SOURCES += files['X64_SOURCES']
+         log("Could not find the files for " + ast_get_source_segment(code, node))
+     elif isinstance(node.value, ast.Call):
+
Risk 0/5 · Safe 1003-python_3.14-b68b1f93a6e31188486458f32fbe37811257604f.patch
Result #2831

Comment

The patch only removes invalid `action="store_true"` from argparse help-only positional arguments in `mach/dispatcher.py`. This is a compatibility fix for Python 3.14 and does not introduce new code execution, network access, privilege changes, or packaging/install-time behavior. The change is limited to help text generation and preserves intended behavior for command/subcommand listing.

@@ -0,0 +1,69 @@
+
+# HG changeset patch
+# User Alex Hochheiden <ahochheiden@mozilla.com>
+# Date 1761071214 0
+# Node ID b68b1f93a6e31188486458f32fbe37811257604f
+# Parent  05f3a58efd9ab2ba64517a959bf9483650f58dbe
+Bug 1993797 - Remove invalid `action="store_true"` from positional arguments in `dispatcher.py` r=firefox-build-system-reviewers,sergesanspaille
+
+In Python 3.14, positional arguments cannot have `action="store_true"`. It seems these were only used
+for help text anyway, and not parsed, so removing this fixes it for Python 3.14 without changing the
+behavior, while maintaining backwards compatibility with Python 3.9.
+
+Differential Revision: https://phabricator.services.mozilla.com/D269410
+
+
+diff --git a/python/mach/mach/dispatcher.py b/python/mach/mach/dispatcher.py
+--- a/python/mach/mach/dispatcher.py
++++ b/python/mach/mach/dispatcher.py
+@@ -284,26 +284,24 @@ class CommandAction(argparse.Action):
+                         disabled_commands.append(disabled_command)
+                         continue
+ 
+                 if group is None:
+                     title, description, _priority = r.categories[category]
+                     group = parser.add_argument_group(title, description)
+ 
+                 description = handler.description
+-                group.add_argument(command, help=description, action="store_true")
++                group.add_argument(command, help=description)
+ 
+         if disabled_commands and "disabled" in r.categories:
+             title, description, _priority = r.categories["disabled"]
+             group = parser.add_argument_group(title, description)
+             if verbose:
+                 for c in disabled_commands:
+-                    group.add_argument(
+-                        c["command"], help=c["description"], action="store_true"
+-                    )
++                    group.add_argument(c["command"], help=c["description"])
+ 
+         parser.print_help()
+ 
+     def _populate_command_group(self, parser, handler, group):
+         extra_groups = {}
+         for group_name in handler.argument_group_names:
+             group_full_name = "Command Arguments for " + group_name
+             extra_groups[group_name] = parser.add_argument_group(group_full_name)
+@@ -400,19 +398,17 @@ class CommandAction(argparse.Action):
+         def by_name(item):
+             return item[1].subcommand
+ 
+         subhandlers = handler.subcommand_handlers.items()
+         for subcommand, subhandler in sorted(
+             subhandlers,
+             key=by_decl_order if handler.order == "declaration" else by_name,
+         ):
+-            group.add_argument(
+-                subcommand, help=subhandler.description, action="store_true"
+-            )
++            group.add_argument(subcommand, help=subhandler.description)
+ 
+         if handler.docstring:
+             parser.description = format_docstring(handler.docstring)
+ 
+         c_parser = self._get_command_arguments_help(handler)
+ 
+         parser.formatter_class = argparse.RawDescriptionHelpFormatter
+ 
+
Risk 0/5 · Safe 1004-python_3.14-d4b3eb4f76e81f18c53863b1d55ee146d6ec7d10.patch
Result #2832

Comment

The patch is a narrow upstream compatibility fix in vendored jsonschema and the mozbuild vendor exclusion list. It does not add any new build-time network access, privilege escalation, persistence, or packaging behavior. The code change only skips non-string $id values when resolving subschemas, which is a defensive type check and reduces the chance of exceptions on malformed input. The vendor_python.py comment explains why jsonschema is excluded from vendoring; that is a packaging policy change, not a security concern by itself. No suspicious sources, scripts, or binaries are introduced in this diff.

@@ -0,0 +1,62 @@
+
+# HG changeset patch
+# User Jan-Erik Rediger <jrediger@mozilla.com>
+# Date 1756256998 0
+# Node ID d4b3eb4f76e81f18c53863b1d55ee146d6ec7d10
+# Parent  3f3cecb96480b861cfb31c2f1c0cba0da92e98ef
+Bug 1983736 - Patch jsonschema to work with Python 3.14+ r=mach-reviewers,ahal,ahochheiden
+
+Differential Revision: https://phabricator.services.mozilla.com/D262335
+
+
+diff --git a/python/mozbuild/mozbuild/vendor/vendor_python.py b/python/mozbuild/mozbuild/vendor/vendor_python.py
+--- a/python/mozbuild/mozbuild/vendor/vendor_python.py
++++ b/python/mozbuild/mozbuild/vendor/vendor_python.py
+@@ -35,16 +35,20 @@ EXCLUDED_PACKAGES = {
+     "pyproject.toml",
+     "requirements.txt",
+     # The ansicon package contains DLLs and we don't want to arbitrarily vendor
+     # them since they could be unsafe. This module should rarely be used in practice
+     # (it's a fallback for old versions of windows). We've intentionally vendored a
+     # modified 'dummy' version of it so that the dependency checks still succeed, but
+     # if it ever is attempted to be used, it will fail gracefully.
+     "ansicon",
++    # jsonschema 4.17.3 is incompatible with Python 3.14+,
++    # but later versions use a dependency with Rust components, which we thus can't vendor.
++    # For now we apply the minimal patch to jsonschema to make it work again.
++    "jsonschema",
+ }
+ 
+ 
+ class VendorPython(MozbuildObject):
+     def __init__(self, *args, **kwargs):
+         super().__init__(*args, virtualenv_name="vendor", **kwargs)
+         self.removed = []
+         self.added = []
+diff --git a/third_party/python/jsonschema/jsonschema/validators.py b/third_party/python/jsonschema/jsonschema/validators.py
+--- a/third_party/python/jsonschema/jsonschema/validators.py
++++ b/third_party/python/jsonschema/jsonschema/validators.py
+@@ -870,18 +870,21 @@ class RefResolver:
+ 
+     @lru_cache()  # noqa: B019
+     def _find_in_subschemas(self, url):
+         subschemas = self._get_subschemas_cache()["$id"]
+         if not subschemas:
+             return None
+         uri, fragment = urldefrag(url)
+         for subschema in subschemas:
++            id = subschema["$id"]
++            if not isinstance(id, str):
++                continue
+             target_uri = self._urljoin_cache(
+-                self.resolution_scope, subschema["$id"],
++                self.resolution_scope, id,
+             )
+             if target_uri.rstrip("/") == uri.rstrip("/"):
+                 if fragment:
+                     subschema = self.resolve_fragment(subschema, fragment)
+                 self.store[url] = subschema
+                 return url, subschema
+         return None
+ 
+
Risk 0/5 · Safe 1005-python_3.14-dbf9702ed87ea5c88c2a1ee615998532ac8f10cc.patch
Result #2833

Comment

The patch is a small compatibility fix in a Python source file: it replaces deprecated ast.Str access (`arg.s`) with the modern `arg.value` for decorator positional arguments. There are no added sources, build steps, network calls, privilege changes, or packaging/install-script changes. The change is narrowly scoped and does not introduce security-relevant behavior.

@@ -0,0 +1,38 @@
+
+# HG changeset patch
+# User Mike Hommey <mh+mozilla@glandium.org>
+# Date 1755580114 0
+# Node ID dbf9702ed87ea5c88c2a1ee615998532ac8f10cc
+# Parent  256a75a8756dc70d9c849cb2d6af260837496ebc
+Bug 1983713 - Use non-deprecated ast value. r=firefox-build-system-reviewers,nalexander,ahochheiden
+
+ast.Str was deprecated in python 3.12 and removed in 3.14. It inherited
+from ast.Constant, `Str.s` was equivalent to `Constant.value`, so we can
+use the latter on both old and newer python versions.
+
+Differential Revision: https://phabricator.services.mozilla.com/D261511
+
+
+diff --git a/python/mach/mach/command_util.py b/python/mach/mach/command_util.py
+--- a/python/mach/mach/command_util.py
++++ b/python/mach/mach/command_util.py
+@@ -292,17 +292,17 @@ class DecoratorVisitor(ast.NodeVisitor):
+         ]
+ 
+         relevant_kwargs = ["command", "subcommand", "virtualenv_name"]
+ 
+         for decorator in decorators:
+             kwarg_dict = {}
+ 
+             for name, arg in zip(["command", "subcommand"], decorator.args):
+-                kwarg_dict[name] = arg.s
++                kwarg_dict[name] = arg.value
+ 
+             for keyword in decorator.keywords:
+                 if keyword.arg not in relevant_kwargs:
+                     # We only care about these 3 kwargs, so we can safely skip the rest
+                     continue
+ 
+                 kwarg_dict[keyword.arg] = getattr(keyword.value, "s", "")
+ 
+
Risk 0/5 · Safe PKGBUILD
Result #2834

Comment

The change only bumps pkgrel from 1 to 2 with no alterations to sources, build steps, install scripts, permissions, dependencies, or packaging behavior. This is a metadata-only rebuild and does not introduce any new security-relevant behavior.

@@ -33,7 +33,7 @@ _ffsum="f53b9dc6942abda1185aa7d79048f59fc075020da36b4dd6b31f668b88714d01"
 _pkgname="icecat"
 pkgname="$_pkgname"
 pkgver="${_icver%%-*}"
-pkgrel=1
+pkgrel=2
 pkgdesc="GNU version of the Firefox ESR browser"
 url="https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git"
 license=('MPL-2.0')
Risk 0/5 · Safe PKGBUILD
Result #2835

Comment

The PKGBUILD change is limited to renaming local patch files, adding one new patch source, and bumping pkgrel. I did not see any new build-time execution, network fetches outside source=(), privilege escalation, install-script changes, or suspicious metadata. The new FFmpeg support patch is shipped as a checked source artifact with a pinned checksum, so the integrity model is unchanged. Overall this looks like a routine maintenance update with low security risk.

@@ -141,20 +141,23 @@ source=(
   0000-parallelize-makeicecat.diff
 
   # fix for python 3.14
-  5fcff175718cd308bc6d6f2996de14eb8a93e2a2.patch
-  23efd75219786d71acff0b4e7c1b0de297b84c4e.patch
-  b68b1f93a6e31188486458f32fbe37811257604f.patch
-  d4b3eb4f76e81f18c53863b1d55ee146d6ec7d10.patch
-  dbf9702ed87ea5c88c2a1ee615998532ac8f10cc.patch
+  1001-python_3.14-5fcff175718cd308bc6d6f2996de14eb8a93e2a2.patch
+  1002-python_3.14-23efd75219786d71acff0b4e7c1b0de297b84c4e.patch
+  1003-python_3.14-b68b1f93a6e31188486458f32fbe37811257604f.patch
+  1004-python_3.14-d4b3eb4f76e81f18c53863b1d55ee146d6ec7d10.patch
+  1005-python_3.14-dbf9702ed87ea5c88c2a1ee615998532ac8f10cc.patch
 
-  # Fix for glibc 2.43
+  # fix for glibc 2.43
   0001-Patch-glsl-optimizer-to-build-with-glibc-2.43.patch
   0002-Fix-sandbox-to-build-with-glibc-2.43.patch
 
-  # Fix for clang 22
+  # fix for clang 22
   0003-Use-wasm32-wasip1-target.patch
   0004-update-rust-bindgen-to-fix-clang22-build.patch.xz
   0005-skia-m142-update.patch.xz
+
+  # fix for ffmpeg 9
+  0006-Add-FFmpeg-63-support.patch.xz
 )
 sha256sums=(
   'SKIP'
Risk 0/5 · Safe PKGBUILD
Result #2836

Comment

The change only adds a new source checksum entry for an additional upstream patch archive (`0006-Add-FFmpeg-63-support.patch.xz`) and bumps `pkgrel`. I checked the surrounding PKGBUILD context: the source is fetched from the package’s existing upstream patch set, over HTTPS, and there are no new build-time downloads, shell pipelines, privilege escalations, or install-script changes introduced by this diff. The added artifact is a compressed patch, not an embedded binary, and the checksum pins it for integrity. No security-relevant red flags are visible in this hunk.

@@ -170,6 +173,7 @@ sha256sums=(
   '28b086f5492d8e6731fe0dfe34a2e4c6d4d502a9eefa15a31e44b5788cf4df89'
   '8f9b7458760b37766a73d4d2c0e93dc810e59d3844495b9d52b3b61dde59c05d'
   'e11aba9839824096f07ca5dc17c9fd5bfa09209f8261ab09f7e473f350a82760'
+  'e7d30072641dfea9c3bff025db7e3a2c60201e630c5253bda1f2b54a0b5501ae'
 )
 
 _make_icecat() (