Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 35.0.0 to 35.0.1. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed. Based on the provided diff, there is no security-relevant behavior introduced.

@@ -1,6 +1,6 @@
 pkgbase = palemoon
 	pkgdesc = Open source web browser based on Firefox focusing on efficiency.
-	pkgver = 35.0.0
+	pkgver = 35.0.1
 	pkgrel = 1
 	epoch = 1
 	url = https://www.palemoon.org/

Comment

The change only updates pinned VCS source revisions and their corresponding checksums in .SRCINFO for the Pale Moon upstream repository and mozconfig metadata. This does not introduce new sources, network fetches, scripts, or packaging logic, and the source remains HTTPS with a pinned commit. No security-relevant red flags are visible in this diff alone.

@@ -37,14 +37,14 @@ pkgbase = palemoon
 	depends = pango
 	optdepends = libpulse: PulseAudio audio driver
 	optdepends = ffmpeg: various video and audio support
-	source = git+https://repo.palemoon.org/MoonchildProductions/Pale-Moon?signed#commit=fcd973b380
+	source = git+https://repo.palemoon.org/MoonchildProductions/Pale-Moon?signed#commit=ce387e806b
 	source = git+https://repo.palemoon.org/MoonchildProductions/UXP
 	source = mozconfig.in
 	validpgpkeys = 3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC
-	sha1sums = a07417b0a739fcfe545ece8cdd207892e482b2c0
+	sha1sums = 2c2f17bd3aa18c3ce692101dc9aa2550ba8ff51d
 	sha1sums = SKIP
 	sha1sums = a45ac7de3b664dcadb0917a975ee0b859385b719
-	sha256sums = 8ee134bd58544309eaadb40aa0302d3861c8b1ca8b44adf34c17190661c9b7d6
+	sha256sums = 39ff9fdbe2f7e67a898409cc46fc6a23925b6951687ead89fa5a9f3411f65dc3
 	sha256sums = SKIP
 	sha256sums = d74ba2d07f5ddb9a8268c64745995a310f5aa2033ca3c8634a22e0cbcf0fa3c2
 

Comment

The change is a straightforward version bump in PKGBUILD: pkgver and the pinned upstream commit were updated, along with the corresponding source checksums. The source remains fetched over HTTPS from the official Pale Moon repository, and there are no new build-time network fetches, scripts, privilege changes, or packaging behavior changes in this diff. I do not see any supply-chain or persistence red flags in the reviewed hunk.

@@ -7,9 +7,9 @@
 pkgname=palemoon
 _repo=Pale-Moon
 epoch=1
-pkgver=35.0.0
+pkgver=35.0.1
 # Commit ID can be found at https://repo.palemoon.org/MoonchildProductions/Pale-Moon/tags
-_commit=fcd973b380
+_commit=ce387e806b
 pkgrel=1
 pkgdesc="Open source web browser based on Firefox focusing on efficiency."
 arch=('i686' 'x86_64')

Comment

The change only updates the pinned upstream release identifiers and the corresponding integrity hashes in PKGBUILD. The source remains HTTPS from the official Pale Moon repository, still pinned to a specific commit, and there are no new build-time commands, network fetches, privilege escalations, or packaging changes. I did not see any suspicious new sources or install-time behavior. Risk is low; the main trust assumption remains the upstream commit itself, which is unchanged in nature from prior versions.

@@ -53,10 +53,10 @@ source=(git+"https://repo.palemoon.org/MoonchildProductions/${_repo}?signed#comm
         git+"https://repo.palemoon.org/MoonchildProductions/UXP"
         mozconfig.in)
 validpgpkeys=('3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC')
-sha1sums=('a07417b0a739fcfe545ece8cdd207892e482b2c0'
+sha1sums=('2c2f17bd3aa18c3ce692101dc9aa2550ba8ff51d'
           'SKIP'
           'a45ac7de3b664dcadb0917a975ee0b859385b719')
-sha256sums=('8ee134bd58544309eaadb40aa0302d3861c8b1ca8b44adf34c17190661c9b7d6'
+sha256sums=('39ff9fdbe2f7e67a898409cc46fc6a23925b6951687ead89fa5a9f3411f65dc3'
             'SKIP'
             'd74ba2d07f5ddb9a8268c64745995a310f5aa2033ca3c8634a22e0cbcf0fa3c2')