Review Results

Comment

The change is a routine version bump in .SRCINFO for palemoon, with the source commit hash and checksums updated accordingly. The source remains HTTPS, pinned to a specific commit, and there are no new sources, scripts, install actions, or packaging permission changes introduced by this diff. No obvious security red flags are present in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = palemoon
 	pkgdesc = Open source web browser based on Firefox focusing on efficiency.
-	pkgver = 34.3.2.1
+	pkgver = 35.0.0
 	pkgrel = 1
 	epoch = 1
 	url = https://www.palemoon.org/

Comment

The change only updates .SRCINFO metadata to match a new upstream Pale Moon release: pkgver, pinned git commit, and corresponding source checksums. The source remains HTTPS and pinned to a specific commit, with the same signed repo and valid PGP key. No build logic, install scripts, permissions, or package contents are changed here, so there is no evident security impact from this diff alone.

@@ -37,14 +37,14 @@ pkgbase = palemoon
 	depends = pango
 	optdepends = libpulse: PulseAudio audio driver
 	optdepends = ffmpeg: various video and audio support
-	source = git+https://repo.palemoon.org/MoonchildProductions/Pale-Moon?signed#commit=eb57a4069a
+	source = git+https://repo.palemoon.org/MoonchildProductions/Pale-Moon?signed#commit=fcd973b380
 	source = git+https://repo.palemoon.org/MoonchildProductions/UXP
 	source = mozconfig.in
 	validpgpkeys = 3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC
-	sha1sums = 2522097b64a0040ce51a52c005b6549921aa4e66
+	sha1sums = a07417b0a739fcfe545ece8cdd207892e482b2c0
 	sha1sums = SKIP
 	sha1sums = a45ac7de3b664dcadb0917a975ee0b859385b719
-	sha256sums = d815234c61ee62850ca607ad87788196a58698bec6990a00a3a773c09efbdcb1
+	sha256sums = 8ee134bd58544309eaadb40aa0302d3861c8b1ca8b44adf34c17190661c9b7d6
 	sha256sums = SKIP
 	sha256sums = d74ba2d07f5ddb9a8268c64745995a310f5aa2033ca3c8634a22e0cbcf0fa3c2
 

Comment

The change only updates the package to a new upstream release by pinning a new commit and refreshing the corresponding source checksums. The source remains fetched over HTTPS from the official Pale Moon repository with signed git verification, and there are no new build steps, scripts, privilege changes, or additional sources introduced. No security-relevant red flags are visible in this diff alone.

@@ -7,9 +7,9 @@
 pkgname=palemoon
 _repo=Pale-Moon
 epoch=1
-pkgver=34.3.2.1
+pkgver=35.0.0
 # Commit ID can be found at https://repo.palemoon.org/MoonchildProductions/Pale-Moon/tags
-_commit=eb57a4069a
+_commit=fcd973b380
 pkgrel=1
 pkgdesc="Open source web browser based on Firefox focusing on efficiency."
 arch=('i686' 'x86_64')

Comment

The change only updates the pinned upstream release commit and the corresponding source checksums in PKGBUILD. The source remains fetched over HTTPS from the official Pale Moon repository with a fixed commit and PGP verification enabled, and there are no new build-time commands, network fetches, privilege changes, or packaging/install-script changes. I do not see any security-relevant behavior introduced by this diff.

@@ -53,10 +53,10 @@ source=(git+"https://repo.palemoon.org/MoonchildProductions/${_repo}?signed#comm
         git+"https://repo.palemoon.org/MoonchildProductions/UXP"
         mozconfig.in)
 validpgpkeys=('3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC')
-sha1sums=('2522097b64a0040ce51a52c005b6549921aa4e66'
+sha1sums=('a07417b0a739fcfe545ece8cdd207892e482b2c0'
           'SKIP'
           'a45ac7de3b664dcadb0917a975ee0b859385b719')
-sha256sums=('d815234c61ee62850ca607ad87788196a58698bec6990a00a3a773c09efbdcb1'
+sha256sums=('8ee134bd58544309eaadb40aa0302d3861c8b1ca8b44adf34c17190661c9b7d6'
             'SKIP'
             'd74ba2d07f5ddb9a8268c64745995a310f5aa2033ca3c8634a22e0cbcf0fa3c2')