Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 140.15.0 to 140.16.0. No sources, checksums, build steps, install scripts, permissions, or other packaging metadata were altered in the reviewed diff. Based on this hunk alone, there is no evident security impact.

@@ -1,6 +1,6 @@
 pkgbase = icecat
 	pkgdesc = GNU version of the Firefox ESR browser
-	pkgver = 140.15.0
+	pkgver = 140.16.0
 	pkgrel = 1
 	url = https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git
 	arch = x86_64

Comment

The change only removes `python-setuptools` from `.SRCINFO`'s makedepends list. This is a metadata-only adjustment with no impact on source integrity, build-time code execution, install scripts, or runtime behavior. No security-relevant red flags are introduced by this diff hunk.

@@ -20,7 +20,6 @@ pkgbase = icecat
 	makedepends = nasm
 	makedepends = nodejs
 	makedepends = python
-	makedepends = python-setuptools
 	makedepends = unzip
 	makedepends = wasi-compiler-rt
 	makedepends = wasi-libc

Comment

The change is a routine version bump in .SRCINFO: it updates pkgver, the pinned gnuzilla commit, the Firefox ESR source tarball URL/checksum, and the corresponding noextract entry. The source remains HTTPS and the VCS source is still pinned to an explicit commit, so there is no new supply-chain or execution red flag in this diff. The removal of python-setuptools from makedepends is not security-relevant for this review. No suspicious install scripts, patches, or packaging behavior are introduced by this change.

@@ -56,14 +55,14 @@ pkgbase = icecat
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = speech-dispatcher: Text-to-Speech
 	optdepends = xdg-desktop-portal: Screensharing with Wayland
-	noextract = firefox-esr-140.15.0-1-source.tar.xz
+	noextract = firefox-esr-140.16.0-1-source.tar.xz
 	options = !debug
 	options = !emptydirs
 	options = !lto
 	options = !makeflags
 	options = !strip
-	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=55f4022a5d5703cbc6877cb470d2b2dfba8e521d
-	source = firefox-esr-140.15.0-1-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/140.15.0esr-candidates/build1/source/firefox-140.15.0esr.source.tar.xz
+	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=8726dec784c7e50e95c823e37e6648cd7c45dbe3
+	source = firefox-esr-140.16.0-1-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/140.16.0esr-candidates/build1/source/firefox-140.16.0esr.source.tar.xz
 	source = 0000-parallelize-makeicecat.diff
 	source = 1001-python_3.14-5fcff175718cd308bc6d6f2996de14eb8a93e2a2.patch
 	source = 1002-python_3.14-23efd75219786d71acff0b4e7c1b0de297b84c4e.patch

Comment

The .SRCINFO update is a routine version bump for icecat: it pins a new upstream gnuzilla commit and Firefox ESR source tarball, and updates the corresponding checksum/noextract metadata. I do not see any new red flags such as unpinned VCS sources, HTTP downloads, extra build-time network fetches, or suspicious install-time behavior in this diff. The removal of python-setuptools from makedepends appears to be a packaging cleanup rather than a security concern. Overall this change looks low risk.

@@ -78,7 +77,7 @@ pkgbase = icecat
 	source = 0006-Add-FFmpeg-63-support.patch.xz
 	source = 0007-fix-rust-1.98-targets.patch
 	sha256sums = SKIP
-	sha256sums = 358bb03c550f95172f1e31694e4287da3411560df91e931cb25210efdf90e524
+	sha256sums = 15d2d359b8571ecd0898faa6e05aa902b0de7cb34aadfc4d94adf6c8428f84df
 	sha256sums = 1f1b71fcc22fe5e12bd57e7dcc544599e99071eb17b843b261c77fb86f943288
 	sha256sums = 10e928127276c934a51c053d3f7ceb247344afd2e82186e12c4f188dd743bc49
 	sha256sums = 6479aa1df3fda931d0e261edaffdcac2d162c0166c5cfd6adf6f45ccf632b852

Comment

The change is a routine version bump for icecat, updating the pinned upstream commit and checksum. The only functional code change refactors parallel job calculation into a helper and removes an unused makedepends entry (python-setuptools). I do not see any new network fetches, privilege escalation, persistence mechanisms, suspicious install scripts, or packaging writes outside $pkgdir. The new helper still only reads local system info (/proc/meminfo, lscpu, nproc) to choose build parallelism, which is benign. Overall this looks low risk.

@@ -25,9 +25,9 @@
 : ${_build_limit_cores:=auto} # number of cores for parallelism; or auto, limited by RAM
 
 ## update
-_icver="140.15.0-1"
-_commit="55f4022a5d5703cbc6877cb470d2b2dfba8e521d"
-_ffsum="358bb03c550f95172f1e31694e4287da3411560df91e931cb25210efdf90e524"
+_icver="140.16.0-1"
+_commit="8726dec784c7e50e95c823e37e6648cd7c45dbe3"
+_ffsum="15d2d359b8571ecd0898faa6e05aa902b0de7cb34aadfc4d94adf6c8428f84df"
 
 ## package
 _pkgname="icecat"

Comment

The only substantive change in the provided hunk is removal of `python-setuptools` from `makedepends`. That reduces build-time dependencies and does not introduce any new execution, network, privilege, or persistence risk. The rest of the diff shown in the full PKGBUILD is unrelated version/parallelism maintenance and does not appear malicious in this change. No security impact is evident from the hunk itself.

@@ -64,7 +64,6 @@ makedepends=(
   nasm
   nodejs
   python
-  python-setuptools
   unzip
   wasi-compiler-rt
   wasi-libc

Comment

The change is a small refactor of the build parallelism calculation in PKGBUILD. It moves the logic into a helper function, but does not introduce new network access, privilege escalation, persistence, or packaging changes. The only notable behavior change is that the default job sentinel changes from "auto" to "mach" when no numeric limit is selected; this appears intended to preserve the existing mozconfig behavior and does not create a security issue. The rest of the diff is a version bump and removal of an unneeded makedepends entry. No high-risk supply-chain or execution red flags are present in the reviewed hunk.

@@ -233,6 +232,32 @@ _make_icecat() (
   fi
 )
 
+_calc_parallel_jobs() {
+  local _build_limit_cores="$1"
+  local _mem _mb _cores _threads _jobs
+  _mem=$(grep -Pom1 '^MemAvailable:\s*\K[0-9]+' /proc/meminfo)
+  _mb=$((_mem / (1024 * 1024)))
+  _cores=$(lscpu | grep -Pom1 'per socket:\s*\K[0-9]+')
+  _threads=$(nproc)
+  _jobs="mach"
+
+  if [[ "${_build_limit_cores}" =~ ^[at] ]]; then
+    # calculate core availability based on free RAM and CPU count
+    _jobs=$((_mb < _cores ? _mb : _cores - 1))
+    _jobs=$((_jobs < 1 ? 1 : _jobs))
+  elif [[ "${_build_limit_cores}" =~ ^[0-9]+$ ]]; then
+    # user-specified, capped by thread count
+    if ((${_build_limit_cores:-0} > 0)); then
+      _jobs=$((_build_limit_cores > _threads ? _threads : _build_limit_cores))
+      _jobs=$((_jobs < 1 ? 1 : _jobs))
+    fi
+  fi
+
+  >&2 printf '\n:: Free RAM: %-5s Cores: %-5s Threads: %-5s Jobs: %-5s\n\n' "$_mb" "$_cores" "$_threads" "$_jobs"
+
+  echo "${_jobs:-mach}"
+}
+
 _prepare_icecat() (
   cat > icecat.desktop << END
 [Desktop Entry]

Comment

The change is a refactor of the parallelism calculation into a helper function, with no new network access, privilege changes, or packaging/install behavior. The helper preserves the prior logic for auto/user-specified numeric limits and only changes the default sentinel from "auto" to "mach" while still emitting a non-numeric value that skips MOZ_PARALLEL_BUILD. I do note a minor behavior change in the default branch and a slightly different stderr logging path, but nothing security-relevant in this diff.

@@ -371,24 +396,7 @@ END
   fi
 
   # build parallelism
-  local _mem _threads _cores _jobs
-  _mem=$(grep -Pom1 '^MemAvailable:\s*\K[0-9]+' /proc/meminfo)
-  _cores=$(lscpu | grep -Pom1 'per socket:\s*\K[0-9]+')
-  _threads=$(nproc)
-  _jobs="auto"
-
-  if [[ "${_build_limit_cores}" =~ ^[at] ]]; then
-    # calculate core availability based on free RAM and CPU count
-    _jobs=$((_mem / (1024 * 1024) < _cores ? _mem / (1024 * 1024) : _cores - 1))
-    _jobs=$((_jobs < 1 ? 1 : _jobs))
-  elif ((${_build_limit_cores:-0} > 0)); then
-    # user-specified, capped by CPU count
-    _jobs=$((_build_limit_cores > _threads ? _threads : _build_limit_cores))
-    _jobs=$((_jobs < 1 ? 1 : _jobs))
-  fi
-
-  printf '\n:: Free RAM: %-5s Cores: %-5s Threads: %-5s Jobs: %-5s\n\n' "$((_mem / (1024 * 1024)))" "$_cores" "$_threads" "$_jobs"
-
+  local _jobs=$(_calc_parallel_jobs "$_build_limit_cores")
   if [[ "$_jobs" =~ ^[0-9]+$ ]]; then
     cat >> ../mozconfig << END
 mk_add_options MOZ_PARALLEL_BUILD=${_jobs}