Review Results

Comment

The change only bumps pkgver in .SRCINFO from 156.0rc1 to 157.0b2. This is metadata-only and does not alter sources, checksums, build steps, install scripts, permissions, or package contents. No security-relevant behavior is introduced by this diff hunk alone.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 156.0rc1
+	pkgver = 157.0b2
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a routine version bump in .SRCINFO: it updates the provided firefox version, switches the source URL from one Mozilla-hosted release artifact to another Mozilla-hosted release artifact over HTTPS, and refreshes the corresponding checksum. No new build-time code, scripts, or privilege/persistence mechanisms are introduced by this diff. The source remains on an official Mozilla domain and is pinned by checksum, so there is no obvious supply-chain or integrity regression in the reviewed hunk.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=156.0rc1
+	provides = firefox=157.0b2
 	conflicts = firefox-beta
-	source = firefox-156.0rc1.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/156.0-candidates/build1/linux-x86_64/en-US/firefox-156.0.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/157.0b2/linux-x86_64/en-US/firefox-157.0b2.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 1d44cd02351c307c3e19061ea2a4d18a30f236e6be862b94f2282564afdb0167
+	sha256sums = 8c668e0bd4a94e7506c2f233f533552c3698a318b60823de42d54a3ded209e88
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a straightforward version bump in PKGBUILD from Firefox beta 156.0rc1/156.0b4 to 157.0b2, with the source URL and checksum updated accordingly. The source remains the official Mozilla archive over HTTPS, there are no new build-time commands, no added scripts, and no packaging/persistence red flags introduced by this diff. Risk is minimal.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=156.0rc1
+pkgver=157.0b2
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward version bump of the Firefox beta binary source from 156.0b4 to 157.0b2, with the corresponding SHA-256 updated. The source remains the official Mozilla archive over HTTPS, there are no new build-time commands, no added scripts, and no packaging logic changes. I don’t see any integrity or persistence red flags in this diff.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/156.0b4/linux-x86_64/en-US/firefox-156.0b4.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/157.0b2/linux-x86_64/en-US/firefox-157.0b2.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('1d44cd02351c307c3e19061ea2a4d18a30f236e6be862b94f2282564afdb0167'
+sha256sums=('8c668e0bd4a94e7506c2f233f533552c3698a318b60823de42d54a3ded209e88'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')