Review Results

Comment

The change only bumps .SRCINFO pkgver from 154.0rc1 to 155.0b2. No build logic, sources, install scripts, permissions, or metadata beyond the version string changed. On its face this is a routine package version update with no security-relevant red flags in the provided diff hunk.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 154.0rc1
+	pkgver = 155.0b2
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

Risk is low. The change only updates .SRCINFO metadata for a Firefox beta-bin version bump: pkgver/provides, the upstream source URL, and the corresponding SHA-256 checksum. The source remains an HTTPS download from Mozilla’s archive, there are no new build-time commands, no added scripts, and no privilege/persistence mechanisms. I don’t see any supply-chain red flags in this diff alone.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=154.0rc1
+	provides = firefox=155.0b2
 	conflicts = firefox-beta
-	source = firefox-154.0rc1.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/154.0-candidates/build1/linux-x86_64/en-US/firefox-154.0.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/155.0b2/linux-x86_64/en-US/firefox-155.0b2.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 7665cd49ab13417270748325838e565136adbc76d41bbd76fb24d15a0cc7792b
+	sha256sums = 62db28902e89b466d44e1c879d4346885ef0a683392259ca132142146c72541d
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a straightforward version bump in PKGBUILD from 154.0rc1 to 155.0b2, with the corresponding upstream archive URL and checksum updated. I do not see any new execution paths, privilege changes, install-script changes, or suspicious sources introduced by this diff. The package still fetches from Mozilla's official archive over HTTPS and remains a binary repackaging of an upstream release.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=154.0rc1
+pkgver=155.0b2
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward version bump of the Firefox binary tarball from 154.0b10 to 155.0b2, with the corresponding SHA-256 updated. The source remains the official Mozilla archive over HTTPS, and there are no new scripts, patches, install-time actions, privilege changes, or other suspicious packaging changes in the provided diff. No integrity or persistence red flags are introduced by this hunk alone.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/154.0b10/linux-x86_64/en-US/firefox-154.0b10.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/155.0b2/linux-x86_64/en-US/firefox-155.0b2.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('7665cd49ab13417270748325838e565136adbc76d41bbd76fb24d15a0cc7792b'
+sha256sums=('62db28902e89b466d44e1c879d4346885ef0a683392259ca132142146c72541d'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')