AUR AI Reviewer

Review Results

Version #2194 of icecat · commit d9dcc2632150 · status Reviewed

Risk 0/5 · Safe .SRCINFO
Result #2307

Comment

The change is a routine version bump in .SRCINFO from 140.13.0-2 to 140.14.0-1 with no added sources, scripts, dependencies, or packaging logic. On its face this does not introduce any new attack surface or integrity concern beyond the existing package metadata. I did not see any suspicious indicators in the provided diff hunk.

@@ -1,7 +1,7 @@
 pkgbase = icecat
 	pkgdesc = GNU version of the Firefox ESR browser
-	pkgver = 140.13.0
-	pkgrel = 2
+	pkgver = 140.14.0
+	pkgrel = 1
 	url = https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git
 	arch = x86_64
 	license = MPL-2.0
Risk 0/5 · Safe .SRCINFO
Result #2308

Comment

The .SRCINFO update is a routine version bump: it pins gnuzilla to a specific commit and updates the Firefox ESR source tarball URL/noextract name to the matching upstream 140.14.0 release. The sources remain HTTPS and point to upstream Mozilla/Savannah locations, with no new build-time execution, no added scripts, and no suspicious mirrors or unpinned VCS references introduced by this change. Based on the provided diff alone, I see no security issue.

@@ -56,14 +56,14 @@ pkgbase = icecat
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = speech-dispatcher: Text-to-Speech
 	optdepends = xdg-desktop-portal: Screensharing with Wayland
-	noextract = firefox-esr-140.13.0-1-source.tar.xz
+	noextract = firefox-esr-140.14.0-1-source.tar.xz
 	options = !debug
 	options = !emptydirs
 	options = !lto
 	options = !makeflags
 	options = !strip
-	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=715ab58c4226572511cad0496908b64124f6729d
-	source = firefox-esr-140.13.0-1-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/140.13.0esr-candidates/build1/source/firefox-140.13.0esr.source.tar.xz
+	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=c30067bdb3fc64b60acede199896d1187f4fd42b
+	source = firefox-esr-140.14.0-1-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/140.14.0esr-candidates/build1/source/firefox-140.14.0esr.source.tar.xz
 	source = 0000-parallelize-makeicecat.diff
 	source = 1001-python_3.14-5fcff175718cd308bc6d6f2996de14eb8a93e2a2.patch
 	source = 1002-python_3.14-23efd75219786d71acff0b4e7c1b0de297b84c4e.patch
Risk 0/5 · Safe .SRCINFO
Result #2309

Comment

The .SRCINFO update is consistent with the PKGBUILD: it bumps Icecat to 140.14.0, updates the upstream Firefox source tarball and gnuzilla commit, and adds a new patch file with a matching checksum. The new patch is a small Rust target-detection fix and the diff shows no suspicious code execution, network fetches outside source=(), privilege changes, or packaging red flags. No security issue is evident from this metadata-only change.

@@ -76,8 +76,9 @@ pkgbase = icecat
 	source = 0004-update-rust-bindgen-to-fix-clang22-build.patch.xz
 	source = 0005-skia-m142-update.patch.xz
 	source = 0006-Add-FFmpeg-63-support.patch.xz
+	source = 0007-fix-rust-1.98-targets.patch
 	sha256sums = SKIP
-	sha256sums = f53b9dc6942abda1185aa7d79048f59fc075020da36b4dd6b31f668b88714d01
+	sha256sums = 28006bd454e703932e1ea804918165774a1e21478b18e551cd1b38111d664239
 	sha256sums = 1f1b71fcc22fe5e12bd57e7dcc544599e99071eb17b843b261c77fb86f943288
 	sha256sums = 10e928127276c934a51c053d3f7ceb247344afd2e82186e12c4f188dd743bc49
 	sha256sums = 6479aa1df3fda931d0e261edaffdcac2d162c0166c5cfd6adf6f45ccf632b852
Risk 0/5 · Safe .SRCINFO
Result #2310

Comment

The .SRCINFO update is consistent with a routine upstream version bump: it changes the package version/release, updates the pinned gnuzilla commit and Firefox ESR source tarball URL, and adds a new patch entry with matching checksum updates. The sources remain HTTPS and pinned to a specific commit/tag-like revision, with no new suspicious hosts, build-time downloads, or install-script/persistence changes visible in this diff. Based on the provided hunk alone, I see no security red flags beyond the need to trust the new upstream artifacts themselves.

@@ -88,7 +89,8 @@ pkgbase = icecat
 	sha256sums = 404e780b1488625989c6dd8e2234e50ed01401b7cb1e99e79dee87f4f4f584f8
 	sha256sums = 28b086f5492d8e6731fe0dfe34a2e4c6d4d502a9eefa15a31e44b5788cf4df89
 	sha256sums = 8f9b7458760b37766a73d4d2c0e93dc810e59d3844495b9d52b3b61dde59c05d
-	sha256sums = e11aba9839824096f07ca5dc17c9fd5bfa09209f8261ab09f7e473f350a82760
+	sha256sums = 43cf4f00643c1144f6debeec6a7cabde63de4089cca5d3bb3501beadd2c837bc
 	sha256sums = e7d30072641dfea9c3bff025db7e3a2c60201e630c5253bda1f2b54a0b5501ae
+	sha256sums = 8e93bc3f7745bd4a6bcf952120b60a260ea867f0c8319ea8f6df18ed1281bc1f
 
 pkgname = icecat
Risk 0/5 · Safe 0007-fix-rust-1.98-targets.patch
Result #2311

Comment

The patch is a targeted build-system compatibility fix for Rust 1.98 target detection. It only adjusts moz.configure logic to normalize the vendor field ('pc' -> 'unknown') and prefer exact vendor matches when multiple Rust targets exist, plus adds corresponding unit-test coverage for newly introduced *-oe-linux-* targets. I did not see any network access, privilege escalation, persistence, or packaging/install-script changes. The change is low risk and confined to target selection behavior in the build system.

@@ -0,0 +1,94 @@
+diff --git a/build/moz.configure/rust.configure b/build/moz.configure/rust.configure
+index 5525c26a184da..35cb30416c647 100644
+--- a/build/moz.configure/rust.configure
++++ b/build/moz.configure/rust.configure
+@@ -298,6 +298,10 @@ def detect_rustc_target(host_or_target, arm_target, rust_supported_targets):
+         elif not candidates:
+             return None
+ 
++        # config.guess uses the "pc" vendor for x86/x86_64 where rust uses its
++        # generic "unknown" vendor; normalize so we correlate on the right one.
++        vendor = "unknown" if host_or_target.vendor == "pc" else host_or_target.vendor
++
+         # We have multiple candidates. There are two cases where we can try to
+         # narrow further down using extra information from the build system.
+         # - For windows targets, correlate with the ABI
+@@ -360,11 +364,19 @@ def detect_rustc_target(host_or_target, arm_target, rust_supported_targets):
+             else:
+                 suffix = ""
+             for p in prefixes:
+-                for c in candidates:
+-                    if c.rust_target.startswith(
+-                        "{}-".format(p)
+-                    ) and c.rust_target.endswith(suffix):
++                matches = [
++                    c
++                    for c in candidates
++                    if c.rust_target.startswith("{}-".format(p))
++                    and c.rust_target.endswith(suffix)
++                ]
++                if not matches:
++                    continue
++                # As below, correlate on the (normalized) vendor.
++                for c in matches:
++                    if c.target.vendor == vendor:
+                         return c.rust_target
++                return matches[0].rust_target
+ 
+         # See if we can narrow down on the exact alias.
+         # We use the sub_configure_alias to keep support mingw32 triplets as input.
+@@ -393,6 +405,15 @@ def detect_rustc_target(host_or_target, arm_target, rust_supported_targets):
+             elif narrowed:
+                 candidates = narrowed
+ 
++        # Correlate on the (normalized) vendor, so vendor-specific targets (e.g.
++        # the *-oe-linux-gnu targets added in rust 1.98) don't shadow the
++        # generic ones for aliases whose vendor doesn't match a rust target.
++        narrowed = [c for c in candidates if c.target.vendor == vendor]
++        if len(narrowed) == 1:
++            return narrowed[0].rust_target
++        elif narrowed:
++            candidates = narrowed
++
+         # See if we can narrow down with the raw OS and raw CPU
+         narrowed = [
+             c
+diff --git a/python/mozbuild/mozbuild/test/configure/test_toolchain_configure.py b/python/mozbuild/mozbuild/test/configure/test_toolchain_configure.py
+index 58a736ee85fcc..7dfb0efb9201c 100644
+--- a/python/mozbuild/mozbuild/test/configure/test_toolchain_configure.py
++++ b/python/mozbuild/mozbuild/test/configure/test_toolchain_configure.py
+@@ -1779,6 +1779,15 @@ def invoke_rustc(stdin, args):
+                 "xtensa-esp32s3-espidf",
+                 "xtensa-esp32s3-none-elf",
+             ]
++            # Additional targets from 1.98
++            if Version(version) >= "1.98.0":
++                rust_targets += [
++                    "aarch64-oe-linux-gnu",
++                    "armv7-oe-linux-gnueabihf",
++                    "i686-oe-linux-gnu",
++                    "riscv64-oe-linux-gnu",
++                    "x86_64-oe-linux-gnu",
++                ]
+             return 0, "\n".join(sorted(rust_targets)), ""
+         if (
+             len(args) == 6
+@@ -1869,6 +1878,7 @@ def test_rust_target(self):
+             ("x86_64-unknown-linux-android", "x86_64-linux-android"),
+             ("x86_64-unknown-linux-android21", "x86_64-linux-android"),
+             ("x86_64-pc-linux-gnu", "x86_64-unknown-linux-gnu"),
++            ("riscv64-unknown-linux-gnu", "riscv64gc-unknown-linux-gnu"),
+             ("sparcv9-sun-solaris2", "sparcv9-sun-solaris"),
+             ("x86_64-sun-solaris2", "x86_64-pc-solaris"),
+             ("x86_64-apple-darwin23.3.0", "x86_64-apple-darwin"),
+@@ -1970,5 +1980,10 @@ def test_rust_wasi_target(self):
+         self.assertEqual(self.get_rust_target("wasm32-unknown-wasi"), "wasm32-wasip1")
+ 
+ 
++# Exercises the vendor-specific *-oe-linux-* targets added in rust 1.98.
++class Rust198Test(RustTest):
++    VERSION = "1.98.0"
++
++
+ if __name__ == "__main__":
+     main()
Risk 0/5 · Safe PKGBUILD
Result #2312

Comment

The change is a straightforward version bump in PKGBUILD: it updates the upstream IceCat/Firefox ESR commit and corresponding source checksum, with no new build steps, no added sources, no network-at-build behavior, and no install/script/unit changes. The only other modification is resetting pkgrel from 2 to 1, which is normal for a new upstream release. I do not see any security-relevant red flags in this diff hunk.

@@ -25,15 +25,15 @@
 : ${_build_limit_cores:=true} # detect usable cores for parallelism, limited by RAM
 
 ## update
-_icver="140.13.0-1"
-_commit="715ab58c4226572511cad0496908b64124f6729d"
-_ffsum="f53b9dc6942abda1185aa7d79048f59fc075020da36b4dd6b31f668b88714d01"
+_icver="140.14.0-1"
+_commit="c30067bdb3fc64b60acede199896d1187f4fd42b"
+_ffsum="28006bd454e703932e1ea804918165774a1e21478b18e551cd1b38111d664239"
 
 ## package
 _pkgname="icecat"
 pkgname="$_pkgname"
 pkgver="${_icver%%-*}"
-pkgrel=2
+pkgrel=1
 pkgdesc="GNU version of the Firefox ESR browser"
 url="https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git"
 license=('MPL-2.0')
Risk 0/5 · Safe PKGBUILD
Result #2313

Comment

The change only adds a new local patch source to the PKGBUILD and updates its checksum. I reviewed the patch content: it is a small Mozilla build-system fix for Rust 1.98 target detection, plus corresponding test updates. There are no signs of network fetches outside source=(), no shell execution, no privilege escalation, and no packaging changes beyond including the patch. Risk is low because the patch is source code, but it appears benign and narrowly scoped.

@@ -158,6 +158,9 @@ source=(
 
   # fix for ffmpeg 9
   0006-Add-FFmpeg-63-support.patch.xz
+
+  # fix for rust 1.98
+  0007-fix-rust-1.98-targets.patch
 )
 sha256sums=(
   'SKIP'
Risk 0/5 · Safe PKGBUILD
Result #2314

Comment

The change only updates the package to a newer upstream IceCat release and adds a local patch plus checksum adjustments. The new patch is a small build-system compatibility fix for Rust 1.98, with accompanying test updates, and does not introduce network access, privilege escalation, persistence, or packaging changes outside the normal source/patch flow. No suspicious URLs or binaries were added in the PKGBUILD diff. Overall this looks like a routine maintenance update with low security risk.

@@ -172,8 +175,9 @@ sha256sums=(
   '404e780b1488625989c6dd8e2234e50ed01401b7cb1e99e79dee87f4f4f584f8'
   '28b086f5492d8e6731fe0dfe34a2e4c6d4d502a9eefa15a31e44b5788cf4df89'
   '8f9b7458760b37766a73d4d2c0e93dc810e59d3844495b9d52b3b61dde59c05d'
-  'e11aba9839824096f07ca5dc17c9fd5bfa09209f8261ab09f7e473f350a82760'
+  '43cf4f00643c1144f6debeec6a7cabde63de4089cca5d3bb3501beadd2c837bc'
   'e7d30072641dfea9c3bff025db7e3a2c60201e630c5253bda1f2b54a0b5501ae'
+  '8e93bc3f7745bd4a6bcf952120b60a260ea867f0c8319ea8f6df18ed1281bc1f'
 )
 
 _make_icecat() (