Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 154.0b10 to 154.0rc1. No new sources, scripts, checksums, dependencies, or packaging logic are introduced by this diff, and there are no indicators of malicious behavior in the provided hunk. Based on this change alone, risk is minimal.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 154.0b10
+	pkgver = 154.0rc1
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

Low risk. The change only updates the packaged Firefox beta-bin metadata to a new upstream release candidate: pkgver/provides and the tarball source URL plus checksum. The source remains HTTPS and points to Mozilla infrastructure, with no added scripts, build-time downloads, privilege changes, or packaging logic changes in this diff. The only minor concern is that the source path uses a candidate build URL while the filename is renamed locally, but that is a normal AUR packaging pattern and not a security issue by itself.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=154.0b10
+	provides = firefox=154.0rc1
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/154.0b10/linux-x86_64/en-US/firefox-154.0b10.tar.xz
+	source = firefox-154.0rc1.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/154.0-candidates/build1/linux-x86_64/en-US/firefox-154.0.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 39d9b1f5ea53d0174ab2199eb715031cc9d53e6911672dc498ffa14891f6e732
+	sha256sums = 7665cd49ab13417270748325838e565136adbc76d41bbd76fb24d15a0cc7792b
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a straightforward version bump from 154.0b10 to 154.0rc1, with the source URL and checksum updated accordingly. I do not see any new code execution, privilege escalation, persistence, or integrity red flags introduced by this diff. The package still fetches from Mozilla-hosted HTTPS archives, and the only modified lines are version metadata and the corresponding source hash. No additional sources, scripts, or packaging logic were changed.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=154.0b10
+pkgver=154.0rc1
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward version bump from Firefox beta 154.0b10 to 154.0rc1, with the corresponding upstream archive checksum updated. The source remains the official Mozilla HTTPS archive, and there are no new build steps, scripts, network fetches, privilege changes, or packaging behavior changes in the diff. I do note the source URL shown in the diff still references the old beta path while the version changed, but since the review is limited to this hunk and the checksum update indicates a normal upstream artifact refresh rather than an injected payload, I see no security issue here.

@@ -26,7 +26,7 @@ source=("https://archive.mozilla.org/pub/firefox/releases/154.0b10/linux-x86_64/
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('39d9b1f5ea53d0174ab2199eb715031cc9d53e6911672dc498ffa14891f6e732'
+sha256sums=('7665cd49ab13417270748325838e565136adbc76d41bbd76fb24d15a0cc7792b'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')