Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 157.0b3 to 157.0b5. No sources, checksums, build steps, install scripts, or permissions are altered here, so there is no new security-relevant behavior introduced by this diff alone. This appears to be a routine package version update.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 157.0b3
+	pkgver = 157.0b5
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a routine version bump in .SRCINFO from Firefox beta 157.0b3 to 157.0b5, updating the upstream archive URL and matching checksum/provides entry. The source remains the official Mozilla archive over HTTPS, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. Risk is low and limited to normal upstream version tracking.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=157.0b3
+	provides = firefox=157.0b5
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/157.0b3/linux-x86_64/en-US/firefox-157.0b3.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/157.0b5/linux-x86_64/en-US/firefox-157.0b5.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 59849638a15aace1aa035493a65df2bd81cd8ff8e2a429ba27489fe69565d585
+	sha256sums = 6195bdb6e2dfb24545e6c1c1870b62f703271ece786e4103f6afeee04957ac9c
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change only bumps pkgver from 157.0b3 to 157.0b5 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or packaging logic were altered. This is a routine version update with no security-relevant behavior introduced by the diff shown.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=157.0b3
+pkgver=157.0b5
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward upstream version bump for the Firefox beta binary tarball, with the source still coming from Mozilla over HTTPS and the checksum updated accordingly. No new build steps, scripts, permissions changes, or additional sources were introduced in this hunk. I don’t see any supply-chain or persistence red flags in the provided diff.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/157.0b3/linux-x86_64/en-US/firefox-157.0b3.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/157.0b5/linux-x86_64/en-US/firefox-157.0b5.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('59849638a15aace1aa035493a65df2bd81cd8ff8e2a429ba27489fe69565d585'
+sha256sums=('6195bdb6e2dfb24545e6c1c1870b62f703271ece786e4103f6afeee04957ac9c'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')