Review Results

Comment

The change only bumps pkgver in .SRCINFO from 155.0b2 to 155.0rc1. This is a metadata-only version update with no evidence of altered sources, build logic, install scripts, or package contents. I did not find any security-relevant red flags in the provided diff hunk.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 155.0b2
+	pkgver = 155.0rc1
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is limited to metadata in .SRCINFO and updates the packaged Firefox beta-bin version from 155.0b2 to 155.0rc1. The source URL remains HTTPS and points to Mozilla infrastructure, with a matching checksum update. No new scripts, install hooks, privilege changes, or build-time network behavior are introduced by this diff. The only notable issue is that the source filename is renamed to firefox-155.0rc1.tar.xz while the upstream URL still ends in firefox-155.0.tar.xz, but this is a standard AUR filename override and not inherently suspicious given the checksum pinning. Overall this looks like a routine version bump with no security red flags in the provided change.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=155.0b2
+	provides = firefox=155.0rc1
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/155.0b2/linux-x86_64/en-US/firefox-155.0b2.tar.xz
+	source = firefox-155.0rc1.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/155.0-candidates/build1/linux-x86_64/en-US/firefox-155.0.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 62db28902e89b466d44e1c879d4346885ef0a683392259ca132142146c72541d
+	sha256sums = fd9ec3f5f113d0825ca0bd1ab3c0756fbc40241034eefce6743be953bcca7473
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a straightforward version bump from 155.0b2 to 155.0rc1 with the corresponding upstream archive checksum update. The source remains an HTTPS Mozilla archive URL, there are no new build steps, no added scripts, and no changes to install-time behavior or permissions. I do not see any supply-chain or privilege-related risk introduced by this diff.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=155.0b2
+pkgver=155.0rc1
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change only updates the package version from 155.0b2 to 155.0rc1 and refreshes the SHA256 for the corresponding upstream Firefox archive. No new sources, scripts, build steps, permissions changes, or install-time behavior are introduced. This is a routine integrity update with no evident security impact in the diff reviewed.

@@ -26,7 +26,7 @@ source=("https://archive.mozilla.org/pub/firefox/releases/155.0b2/linux-x86_64/e
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('62db28902e89b466d44e1c879d4346885ef0a683392259ca132142146c72541d'
+sha256sums=('fd9ec3f5f113d0825ca0bd1ab3c0756fbc40241034eefce6743be953bcca7473'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')