Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 157.0b5 to 158.0b1. No sources, checksums, install scripts, dependencies, or packaging logic are altered here, so there is no new security-relevant behavior introduced by this diff alone. This appears to be a routine upstream version update in metadata only.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 157.0b5
+	pkgver = 158.0b1
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a straightforward version bump in .SRCINFO for firefox-beta-bin: it updates the provided virtual package version and the upstream Mozilla release tarball URL/checksum from 157.0b5 to 158.0b1. The source remains the official HTTPS archive.mozilla.org release tarball, with no new scripts, patches, binaries, install hooks, or build-time network behavior introduced by this diff. No integrity or privilege-escalation red flags are present in the reviewed hunk.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=157.0b5
+	provides = firefox=158.0b1
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/157.0b5/linux-x86_64/en-US/firefox-157.0b5.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/158.0b1/linux-x86_64/en-US/firefox-158.0b1.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 6195bdb6e2dfb24545e6c1c1870b62f703271ece786e4103f6afeee04957ac9c
+	sha256sums = e2ac2febb34aad64f82fabf8f048087e56655523bebe42e93767a81e00ad4f3e
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a routine version bump for a binary Firefox beta package. The source remains the official Mozilla archive over HTTPS, with the tarball checksum updated accordingly. No new build steps, scripts, privileges, or external fetches were introduced, and the package metadata changes are consistent with an upstream release update. I do not see any security-relevant red flags in this diff.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=157.0b5
+pkgver=158.0b1
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a routine version bump of the Firefox beta binary tarball from 157.0b5 to 158.0b1, with the corresponding SHA-256 checksum updated. The source remains the official Mozilla archive over HTTPS, and no new build steps, scripts, or packaging behaviors were introduced. I do not see any supply-chain red flags in this diff alone.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/157.0b5/linux-x86_64/en-US/firefox-157.0b5.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/158.0b1/linux-x86_64/en-US/firefox-158.0b1.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('6195bdb6e2dfb24545e6c1c1870b62f703271ece786e4103f6afeee04957ac9c'
+sha256sums=('e2ac2febb34aad64f82fabf8f048087e56655523bebe42e93767a81e00ad4f3e'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')