AUR AI Reviewer

Review Results

Version #2313 of icecat · commit 917cb3e0d32b · status Reviewed

Risk 0/5 · Safe .SRCINFO
Result #2999

Comment

The only change in this .SRCINFO diff is a version bump from 140.14.0 to 140.15.0. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the reviewed hunk. Based on this diff alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = icecat
 	pkgdesc = GNU version of the Firefox ESR browser
-	pkgver = 140.14.0
+	pkgver = 140.15.0
 	pkgrel = 1
 	url = https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git
 	arch = x86_64
Risk 0/5 · Safe .SRCINFO
Result #3000

Comment

The change is a routine source/version bump in .SRCINFO: it updates the pinned gnuzilla commit and the Firefox ESR source tarball version to 140.15.0, while keeping HTTPS and a fixed commit hash. No new sources, no build-script changes, and no suspicious install/persistence behavior are introduced by this diff. The only notable issue is that the source URL still uses the odd `https://https.git.savannah.gnu.org/...` host, but that pre-existed this change and is not newly introduced here. Overall this specific change looks low risk.

@@ -56,14 +56,14 @@ pkgbase = icecat
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = speech-dispatcher: Text-to-Speech
 	optdepends = xdg-desktop-portal: Screensharing with Wayland
-	noextract = firefox-esr-140.14.0-1-source.tar.xz
+	noextract = firefox-esr-140.15.0-1-source.tar.xz
 	options = !debug
 	options = !emptydirs
 	options = !lto
 	options = !makeflags
 	options = !strip
-	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=c30067bdb3fc64b60acede199896d1187f4fd42b
-	source = firefox-esr-140.14.0-1-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/140.14.0esr-candidates/build1/source/firefox-140.14.0esr.source.tar.xz
+	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=55f4022a5d5703cbc6877cb470d2b2dfba8e521d
+	source = firefox-esr-140.15.0-1-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/140.15.0esr-candidates/build1/source/firefox-140.15.0esr.source.tar.xz
 	source = 0000-parallelize-makeicecat.diff
 	source = 1001-python_3.14-5fcff175718cd308bc6d6f2996de14eb8a93e2a2.patch
 	source = 1002-python_3.14-23efd75219786d71acff0b4e7c1b0de297b84c4e.patch
Risk 0/5 · Safe .SRCINFO
Result #3001

Comment

The change is a routine version bump in .SRCINFO: it updates the upstream Firefox ESR source tarball, the pinned gnuzilla git commit, and the corresponding checksum for that source. The source URLs remain HTTPS and the VCS source is still pinned to a specific commit, with no new build-time execution, install-script, or packaging-logic changes visible in this diff. I don’t see any supply-chain red flags in the metadata update itself.

@@ -78,7 +78,7 @@ pkgbase = icecat
 	source = 0006-Add-FFmpeg-63-support.patch.xz
 	source = 0007-fix-rust-1.98-targets.patch
 	sha256sums = SKIP
-	sha256sums = 28006bd454e703932e1ea804918165774a1e21478b18e551cd1b38111d664239
+	sha256sums = 358bb03c550f95172f1e31694e4287da3411560df91e931cb25210efdf90e524
 	sha256sums = 1f1b71fcc22fe5e12bd57e7dcc544599e99071eb17b843b261c77fb86f943288
 	sha256sums = 10e928127276c934a51c053d3f7ceb247344afd2e82186e12c4f188dd743bc49
 	sha256sums = 6479aa1df3fda931d0e261edaffdcac2d162c0166c5cfd6adf6f45ccf632b852
Risk 0/5 · Safe PKGBUILD
Result #3002

Comment

The change is low risk. It only updates the IceCat version/commit and adjusts the local parallelism heuristic in PKGBUILD. The new source commit is pinned over HTTPS, and the checksum is updated accordingly. The build-parallelism logic still only writes to the generated mozconfig under the build directory; it does not introduce network access, privilege escalation, persistence, or installation outside $pkgdir. The only notable issue is a potential robustness regression: switching from MemFree to MemAvailable and from a boolean to an 'auto' mode changes how job count is computed, and the new lscpu-based core detection may be less portable or miscompute on some systems, but that is a build reliability concern rather than a security issue.

@@ -22,12 +22,12 @@
 : ${_build_lto:=false}        # link-time optimization; may cause spurious errors
 : ${_build_system_libs:=true} # use system libraries, reduces build time
 
-: ${_build_limit_cores:=true} # detect usable cores for parallelism, limited by RAM
+: ${_build_limit_cores:=auto} # number of cores for parallelism; or auto, limited by RAM
 
 ## update
-_icver="140.14.0-1"
-_commit="c30067bdb3fc64b60acede199896d1187f4fd42b"
-_ffsum="28006bd454e703932e1ea804918165774a1e21478b18e551cd1b38111d664239"
+_icver="140.15.0-1"
+_commit="55f4022a5d5703cbc6877cb470d2b2dfba8e521d"
+_ffsum="358bb03c550f95172f1e31694e4287da3411560df91e931cb25210efdf90e524"
 
 ## package
 _pkgname="icecat"
Risk 0/5 · Safe PKGBUILD
Result #3003

Comment

The change only adjusts how the PKGBUILD chooses a parallel build job count. It still reads local system information from /proc/meminfo, lscpu, and nproc, and only writes a numeric MOZ_PARALLEL_BUILD value into the generated mozconfig when the computed value matches a number. There are no new network fetches, privilege escalations, persistence mechanisms, or writes outside the build tree. The main effect is a build-performance heuristic change, not a security-sensitive one. One minor concern is that it now invokes lscpu unconditionally, which could fail on unusual build environments, but that is a reliability issue rather than a security issue.

@@ -370,27 +370,29 @@ ac_add_options --enable-lto=cross,full
 END
   fi
 
-  # build paralleism
-  local _mem _nproc _cores
-  _mem=$(grep -Pom1 '^MemFree.*\b\K[0-9]+' /proc/meminfo)
-  _nproc=$(nproc)
+  # build parallelism
+  local _mem _threads _cores _jobs
+  _mem=$(grep -Pom1 '^MemAvailable:\s*\K[0-9]+' /proc/meminfo)
+  _cores=$(lscpu | grep -Pom1 'per socket:\s*\K[0-9]+')
+  _threads=$(nproc)
+  _jobs="auto"
 
-  if [[ "${_build_limit_cores::1}" == "t" ]]; then
+  if [[ "${_build_limit_cores}" =~ ^[at] ]]; then
     # calculate core availability based on free RAM and CPU count
-    _cores=$((_mem / (1024 * 1024) < _nproc ? _mem / (1024 * 1024) : _nproc))
-    _cores=$((_cores < 1 ? 1 : _cores))
+    _jobs=$((_mem / (1024 * 1024) < _cores ? _mem / (1024 * 1024) : _cores - 1))
+    _jobs=$((_jobs < 1 ? 1 : _jobs))
   elif ((${_build_limit_cores:-0} > 0)); then
     # user-specified, capped by CPU count
-    _cores=$((_build_limit_cores > _nproc ? _nproc : _build_limit_cores))
+    _jobs=$((_build_limit_cores > _threads ? _threads : _build_limit_cores))
+    _jobs=$((_jobs < 1 ? 1 : _jobs))
   fi
 
-  if [ -n "${_cores:-}" ]; then
-    printf '\nFree RAM: %s\nCores: %s\nUsing: %s\n\n' "$((_mem / (1024 * 1024)))" "$_nproc" "$_cores"
+  printf '\n:: Free RAM: %-5s Cores: %-5s Threads: %-5s Jobs: %-5s\n\n' "$((_mem / (1024 * 1024)))" "$_cores" "$_threads" "$_jobs"
+
+  if [[ "$_jobs" =~ ^[0-9]+$ ]]; then
     cat >> ../mozconfig << END
-mk_add_options MOZ_PARALLEL_BUILD=${_cores}
+mk_add_options MOZ_PARALLEL_BUILD=${_jobs}
 END
-  else
-    printf '\nFree RAM: %s\nCores: %s\nUsing: auto\n\n' "$((_mem / (1024 * 1024)))" "$_nproc"
   fi
 
   # apply patches