Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 15.0.19 to 15.0.20. No source URLs, checksums, build steps, install scripts, or package metadata affecting execution/persistence were changed in the provided diff. Based on this hunk alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = tor-browser-bin
 	pkgdesc = Tor Browser Bundle: anonymous browsing using Firefox and Tor
-	pkgver = 15.0.19
+	pkgver = 15.0.20
 	pkgrel = 1
 	url = https://www.torproject.org/projects/torbrowser.html
 	install = tor-browser.install

Comment

The change only updates the noextract filenames in .SRCINFO from Tor Browser 15.0.19 to 15.0.20 for the i686 and x86_64 tarballs. This is a metadata refresh consistent with a version bump and does not introduce new sources, scripts, permissions changes, or build-time execution. No security-relevant behavior is changed in the reviewed hunk.

@@ -28,8 +28,8 @@ pkgbase = tor-browser-bin
 	optdepends = libnotify: Gnome dialog boxes
 	provides = tor-browser
 	conflicts = tor-browser
-	noextract = tor-browser-linux-i686-15.0.19.tar.xz
-	noextract = tor-browser-linux-x86_64-15.0.19.tar.xz
+	noextract = tor-browser-linux-i686-15.0.20.tar.xz
+	noextract = tor-browser-linux-x86_64-15.0.20.tar.xz
 	source = tor-browser.desktop.in
 	source = tor-browser.in
 	source = tor-browser.png

Comment

The change is a routine version bump in .SRCINFO from Tor Browser 15.0.19 to 15.0.20, with HTTPS sources still pointing to the official Tor Project archive and matching updated checksums. No new sources, scripts, install hooks, or packaging behavior are introduced by this diff hunk. Based on the provided change alone, there are no evident security concerns.

@@ -39,13 +39,13 @@ pkgbase = tor-browser-bin
 	sha256sums = 53754c8ff0ea01d8f79d3e725fa3516511faf1e53804c67dc8f573cdb39e35a3
 	sha256sums = f25ccf68b47f5eb14c6fec0664c74f30ea9c6c58d42fc6abac3b64670aaa3152
 	sha256sums = 7b28b5dbe8ad573bb46e61b4d542b33e01ca240825ca640b4893fee6203b021f
-	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.19/tor-browser-linux-i686-15.0.19.tar.xz
-	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.19/tor-browser-linux-i686-15.0.19.tar.xz.asc
-	sha256sums_i686 = 37e4e3a49ac783c701eafc02aab4d69f3e3f770ceedbfaf9e6436690b7a65af5
+	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.20/tor-browser-linux-i686-15.0.20.tar.xz
+	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.20/tor-browser-linux-i686-15.0.20.tar.xz.asc
+	sha256sums_i686 = 8aabdf701b1514ddb926d00a0f22fde21a0bfcadeb33433ba5b2bb81b8abe590
 	sha256sums_i686 = SKIP
-	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.19/tor-browser-linux-x86_64-15.0.19.tar.xz
-	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.19/tor-browser-linux-x86_64-15.0.19.tar.xz.asc
-	sha256sums_x86_64 = 2eb4ab431f4921ca63b123b6f9f445a073fbf7b65f188f45a577d576eb2be2cf
+	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.20/tor-browser-linux-x86_64-15.0.20.tar.xz
+	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.20/tor-browser-linux-x86_64-15.0.20.tar.xz.asc
+	sha256sums_x86_64 = d4302633d6059d2dad94e2c883b31141dc7b3daa2bfa5aabb0fd29dda18d22e9
 	sha256sums_x86_64 = SKIP
 
 pkgname = tor-browser-bin

Comment

The change is a simple version bump in PKGBUILD from 15.0.19 to 15.0.20 with no other modifications shown. There are no new sources, scripts, install hooks, permissions changes, or build logic changes in the provided diff hunk. Based on this hunk alone, I see no security-relevant regression.

@@ -18,7 +18,7 @@
 
 _appname='tor-browser'
 pkgname="${_appname}-bin"
-pkgver='15.0.19'
+pkgver='15.0.20'
 pkgrel=1
 pkgdesc='Tor Browser Bundle: anonymous browsing using Firefox and Tor'
 url='https://www.torproject.org/projects/torbrowser.html'

Comment

The change only updates Tor Browser to a newer upstream release and switches the architecture-specific SHA256 entries from hardcoded values to a helper that fetches the official Tor Project checksum file from the Tor archive over HTTPS. The helper falls back from signed to unsigned checksum metadata, but it still only extracts the expected tarball hash for the pinned version and official archive path. I do not see added persistence, privilege escalation, unsafe install-script behavior, or build-time code execution beyond the existing curl-based checksum lookup already present in the PKGBUILD. Main risk remains the inherent network fetch during build, but this is from the official Tor archive and not newly introduced in a suspicious way.

@@ -72,9 +72,9 @@ sha256sums=('604f5d7cc642d56c919b9d2b7b20a785db4acebf58520f41845347bd81e8ec73'
             '53754c8ff0ea01d8f79d3e725fa3516511faf1e53804c67dc8f573cdb39e35a3'
             'f25ccf68b47f5eb14c6fec0664c74f30ea9c6c58d42fc6abac3b64670aaa3152'
             '7b28b5dbe8ad573bb46e61b4d542b33e01ca240825ca640b4893fee6203b021f')
-sha256sums_i686=('37e4e3a49ac783c701eafc02aab4d69f3e3f770ceedbfaf9e6436690b7a65af5'
+sha256sums_i686=("$(_dist_checksum "${_tag_i686}")"
                  'SKIP')
-sha256sums_x86_64=('2eb4ab431f4921ca63b123b6f9f445a073fbf7b65f188f45a577d576eb2be2cf'
+sha256sums_x86_64=("$(_dist_checksum "${_tag_x86_64}")"
                    'SKIP')
 
 noextract=("${_appname}-${_tag_i686}-${pkgver}.tar.xz"