Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 153.0 to 153.1.0. No sources, checksums, build steps, install scripts, permissions, or package metadata beyond pkgver are altered in the provided diff. On its face this is a routine upstream version update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = firefox-esr-bin
 	pkgdesc = Standalone web browser from mozilla.org - Extended Support Release
-	pkgver = 153.0
+	pkgver = 153.1.0
 	pkgrel = 2
 	url = http://www.mozilla.org/en-US/firefox/organizations/
 	install = firefox-esr.install

Comment

The change is a routine upstream version bump in .SRCINFO: it updates the Firefox ESR tarball URL, the provided virtual package version, and the corresponding checksum. The source remains HTTPS on the official Mozilla FTP host, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. Risk is minimal.

@@ -14,12 +14,12 @@ pkgbase = firefox-esr-bin
 	depends = dbus-glib
 	depends = nss
 	depends = ffmpeg4.4
-	provides = firefox=153.0
-	source = https://ftp.mozilla.org/pub/firefox/releases/153.0esr/linux-x86_64/en-US/firefox-153.0esr.tar.xz
+	provides = firefox=153.1.0
+	source = https://ftp.mozilla.org/pub/firefox/releases/153.1.0esr/linux-x86_64/en-US/firefox-153.1.0esr.tar.xz
 	source = firefox-esr.desktop
 	source = firefox-esr-safe.desktop
 	source = policies.json
-	sha512sums = eea6a3ca2fdd93ae8f2a7e21c8792372faccb8591588cc983aacdebb34b0735f8d26eff54b6a6185dce9160add27052bef05a6a635ec286f184579d75cbcd6db
+	sha512sums = e4dc39977cec9dd3c6fba76decf9da05f5b8aa3d1d6cfe3507851a10e46075a3fa0a46e2e78d9246e1fae79661ea223eeebae405558ec3e98ab0802be2a6d06a
 	sha512sums = c585f6e8ac7abfc96ad4571940b6f0dcc3f7331a18a518b4fe5d19b45e4c2d96c394524ea5c115c8fdd256c9229ea2fabeb1fc04ca7102f1626fd20728aef47d
 	sha512sums = ab2fa2e08c7a65ac0bfe169a4b579e54b038bddabf838cd3df5ab341bd77be7c101092d0123598944d2174ab3a8fbc70dfbd692b2944016efdb7a69216a74428
 	sha512sums = 5ed67bde39175d4d10d50ba5b12063961e725e94948eadb354c0588b30d3f97d2178b66c1af466a6e7bd208ab694227a1391c4141f88d3da1a1178454eba5308

Comment

The change is a straightforward version bump of a binary Firefox ESR package from 153.0 to 153.1.0 with corresponding checksum updates. The source remains the official Mozilla HTTPS release tarball, and there are no new build steps, scripts, privileges, or additional sources introduced by this diff. I did note the existing PKGBUILD still uses an HTTP homepage URL, but that is pre-existing and unchanged here. No security issue is introduced by this specific change.

@@ -7,7 +7,7 @@
 
 pkgname=firefox-esr-bin
 _pkgname=${pkgname/-bin/}
-pkgver=153.0
+pkgver=153.1.0
 pkgrel=2
 pkgdesc='Standalone web browser from mozilla.org - Extended Support Release'
 url='http://www.mozilla.org/en-US/firefox/organizations/'

Comment

The change only updates SHA-512 checksums for the Firefox ESR tarball(s) in PKGBUILD. The source URL remains the official Mozilla HTTPS release endpoint, and there are no new build steps, scripts, or privilege-related changes. This looks like a routine integrity hash refresh for a new upstream release rather than a supply-chain or persistence risk.

@@ -18,11 +18,11 @@ provides=(firefox=${pkgver})
 license=('MPL' 'GPL' 'LGPL')
 install=$_pkgname.install
 
-sha512sums=('eea6a3ca2fdd93ae8f2a7e21c8792372faccb8591588cc983aacdebb34b0735f8d26eff54b6a6185dce9160add27052bef05a6a635ec286f184579d75cbcd6db'
+sha512sums=('e4dc39977cec9dd3c6fba76decf9da05f5b8aa3d1d6cfe3507851a10e46075a3fa0a46e2e78d9246e1fae79661ea223eeebae405558ec3e98ab0802be2a6d06a'
             'c585f6e8ac7abfc96ad4571940b6f0dcc3f7331a18a518b4fe5d19b45e4c2d96c394524ea5c115c8fdd256c9229ea2fabeb1fc04ca7102f1626fd20728aef47d'
             'ab2fa2e08c7a65ac0bfe169a4b579e54b038bddabf838cd3df5ab341bd77be7c101092d0123598944d2174ab3a8fbc70dfbd692b2944016efdb7a69216a74428'
             '5ed67bde39175d4d10d50ba5b12063961e725e94948eadb354c0588b30d3f97d2178b66c1af466a6e7bd208ab694227a1391c4141f88d3da1a1178454eba5308')
-[[ "$CARCH" == "i686" ]] && sha512sums[0]='439b8829a98ec5c5c7c47f1b5815160f20748fb1166711df14888dc663e945311c7a1085fa2e44c4a5da590dcfc034774a8bd46c6b78f4f195d9e8924acc2893'
+[[ "$CARCH" == "i686" ]] && sha512sums[0]='73bbf698482132b5fd60a0b58926fddec9055f8095a53bc52714e211e9340c3419736ceafd6b279667810114d306bfccdcfcddf51c0b67fe9e3c73c54583e574'
 
 source=(https://ftp.mozilla.org/pub/firefox/releases/${pkgver}esr/linux-$CARCH/en-US/firefox-${pkgver}esr.tar.xz
         $_pkgname.desktop