Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 157.0b2 to 157.0b3. This is a routine metadata update with no evidence of altered sources, build logic, install scripts, or privilege-related behavior. Based on the provided diff, there are no security red flags.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 157.0b2
+	pkgver = 157.0b3
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a routine version bump in .SRCINFO for firefox-beta-bin from 157.0b2 to 157.0b3, updating the upstream Mozilla tarball URL and its checksum. No new sources, scripts, install logic, permissions, or packaging behavior are introduced, and the source remains an HTTPS download from the official Mozilla archive. Based on the provided diff, there are no security red flags beyond the normal trust in the upstream release artifact.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=157.0b2
+	provides = firefox=157.0b3
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/157.0b2/linux-x86_64/en-US/firefox-157.0b2.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/157.0b3/linux-x86_64/en-US/firefox-157.0b3.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 8c668e0bd4a94e7506c2f233f533552c3698a318b60823de42d54a3ded209e88
+	sha256sums = 59849638a15aace1aa035493a65df2bd81cd8ff8e2a429ba27489fe69565d585
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a simple version bump in PKGBUILD from 157.0b2 to 157.0b3 with no other modifications. There are no new sources, build steps, install scripts, permissions changes, or packaging logic changes to introduce supply-chain or privilege risks. Based on the provided diff alone, this is low risk.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=157.0b2
+pkgver=157.0b3
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward upstream version bump for the Firefox beta binary package: it switches the official Mozilla HTTPS archive URL from 157.0b2 to 157.0b3 and updates the corresponding SHA-256 checksum. No new sources, scripts, install logic, or privilege-related artifacts are introduced, and the source remains pinned to a specific release tarball from the official archive. I did not find any security-relevant red flags in this diff.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/157.0b2/linux-x86_64/en-US/firefox-157.0b2.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/157.0b3/linux-x86_64/en-US/firefox-157.0b3.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('8c668e0bd4a94e7506c2f233f533552c3698a318b60823de42d54a3ded209e88'
+sha256sums=('59849638a15aace1aa035493a65df2bd81cd8ff8e2a429ba27489fe69565d585'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')