Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 155.0rc1 to 156.0b2. No sources, checksums, install scripts, dependencies, or build logic are altered, and there are no new integrity or execution red flags visible in the provided diff. This appears to be a routine package update with no security impact in the reviewed change.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 155.0rc1
+	pkgver = 156.0b2
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a routine upstream version bump in .SRCINFO: it updates the provided firefox version, switches the source tarball from Mozilla FTP candidate build1 to the official Mozilla archive release URL over HTTPS, and refreshes the corresponding checksum. No new build-time commands, scripts, or privilege/persistence mechanisms are introduced by this diff. The source remains an official Mozilla artifact and is pinned by checksum, so there is no evident supply-chain red flag in the reviewed hunk.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=155.0rc1
+	provides = firefox=156.0b2
 	conflicts = firefox-beta
-	source = firefox-155.0rc1.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/155.0-candidates/build1/linux-x86_64/en-US/firefox-155.0.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/156.0b2/linux-x86_64/en-US/firefox-156.0b2.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = fd9ec3f5f113d0825ca0bd1ab3c0756fbc40241034eefce6743be953bcca7473
+	sha256sums = 253933601916a019a7a818eae24a7db0566c16e7c50ec7e859012fde14aac8fd
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change only bumps pkgver from 155.0rc1 to 156.0b2 in PKGBUILD. No new sources, scripts, build steps, permissions, or install-time behavior are introduced by this diff hunk. Based on the provided change alone, there are no security red flags.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=155.0rc1
+pkgver=156.0b2
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward version bump of the Firefox beta binary tarball from 155.0b2 to 156.0b2 with the corresponding SHA-256 updated. The source remains the official Mozilla archive over HTTPS, there are no new build-time downloads, scripts, patches, or packaging logic changes, and no new privilege/persistence concerns are introduced by this diff. Risk is low.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/155.0b2/linux-x86_64/en-US/firefox-155.0b2.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/156.0b2/linux-x86_64/en-US/firefox-156.0b2.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('fd9ec3f5f113d0825ca0bd1ab3c0756fbc40241034eefce6743be953bcca7473'
+sha256sums=('253933601916a019a7a818eae24a7db0566c16e7c50ec7e859012fde14aac8fd'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')