Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 156.0b4 to 156.0rc1 with no other metadata changes. .SRCINFO is generated package metadata and does not itself introduce executable behavior, new sources, install scripts, or privilege-related changes. Based on the provided diff, there are no security-relevant red flags.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 156.0b4
+	pkgver = 156.0rc1
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a straightforward version/source refresh in .SRCINFO: it updates the provided Firefox version from 156.0b4 to 156.0rc1 and switches the tarball URL to Mozilla’s official FTP candidate location over HTTPS. No new sources, scripts, patches, or packaging logic are introduced, and the checksum is updated accordingly. I don’t see any supply-chain red flags in this diff alone.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=156.0b4
+	provides = firefox=156.0rc1
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/156.0b4/linux-x86_64/en-US/firefox-156.0b4.tar.xz
+	source = firefox-156.0rc1.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/156.0-candidates/build1/linux-x86_64/en-US/firefox-156.0.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 12da6322acfb2ff3676ef04f9aff93aa1feec1c23630c8afbc58997016587b52
+	sha256sums = 1d44cd02351c307c3e19061ea2a4d18a30f236e6be862b94f2282564afdb0167
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

Low-risk version bump only. The PKGBUILD changes the Firefox beta-bin package from 156.0b4 to 156.0rc1 and updates the corresponding upstream archive checksum. The source remains an HTTPS Mozilla archive URL, there are no new build steps, no added scripts, no network fetches outside source=(), and no packaging/persistence changes. This looks like a routine upstream release update with no security red flags in the diff provided.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=156.0b4
+pkgver=156.0rc1
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change only updates the SHA-256 checksum for the Firefox beta tarball source. The source URL remains an HTTPS Mozilla archive URL, and there are no new build steps, scripts, or packaging changes introduced by this diff. This is a normal integrity update consistent with a versioned upstream release artifact, with no obvious security red flags in the provided hunk.

@@ -26,7 +26,7 @@ source=("https://archive.mozilla.org/pub/firefox/releases/156.0b4/linux-x86_64/e
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('12da6322acfb2ff3676ef04f9aff93aa1feec1c23630c8afbc58997016587b52'
+sha256sums=('1d44cd02351c307c3e19061ea2a4d18a30f236e6be862b94f2282564afdb0167'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')