Review Results

Comment

The change only bumps the package version in .SRCINFO from 140.16.0 to 140.17.0. No source URLs, checksums, build steps, install scripts, or packaging metadata affecting execution/persistence were modified in the provided diff. Based on this diff alone, there is no security concern.

@@ -1,6 +1,6 @@
 pkgbase = icecat
 	pkgdesc = GNU version of the Firefox ESR browser
-	pkgver = 140.16.0
+	pkgver = 140.17.0
 	pkgrel = 1
 	url = https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO: it updates the pinned gnuzilla commit and the Firefox ESR source tarball to newer upstream releases, with matching noextract metadata. The sources remain HTTPS and are still pinned to a specific commit/version, and there are no new build-time commands, scripts, or privilege/persistence mechanisms introduced by this diff. No security red flags are evident from the .SRCINFO-only change.

@@ -55,14 +55,14 @@ pkgbase = icecat
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = speech-dispatcher: Text-to-Speech
 	optdepends = xdg-desktop-portal: Screensharing with Wayland
-	noextract = firefox-esr-140.16.0-1-source.tar.xz
+	noextract = firefox-esr-140.17.0-1-source.tar.xz
 	options = !debug
 	options = !emptydirs
 	options = !lto
 	options = !makeflags
 	options = !strip
-	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=8726dec784c7e50e95c823e37e6648cd7c45dbe3
-	source = firefox-esr-140.16.0-1-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/140.16.0esr-candidates/build1/source/firefox-140.16.0esr.source.tar.xz
+	source = gnuzilla::git+https://https.git.savannah.gnu.org/git/gnuzilla.git#commit=d7ffa7cbb29e7047b491ebbf5e50549548d480cb
+	source = firefox-esr-140.17.0-1-source.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/140.17.0esr-candidates/build1/source/firefox-140.17.0esr.source.tar.xz
 	source = 0000-parallelize-makeicecat.diff
 	source = 1001-python_3.14-5fcff175718cd308bc6d6f2996de14eb8a93e2a2.patch
 	source = 1002-python_3.14-23efd75219786d71acff0b4e7c1b0de297b84c4e.patch

Comment

The .SRCINFO change is a routine version bump for icecat from 140.16.0 to 140.17.0, updating the pinned gnuzilla commit and Firefox ESR source tarball checksum accordingly. The only notable change is removal of an obsolete patch entry (0007-fix-rust-1.98-targets.patch) and the corresponding checksum line, which is consistent with the PKGBUILD context and does not introduce any new execution paths, network fetches beyond the existing declared sources, or packaging red flags. No evidence of malicious sources, build-time downloads outside source=(), or privilege/persistence mechanisms in this diff.

@@ -75,9 +75,8 @@ pkgbase = icecat
 	source = 0004-update-rust-bindgen-to-fix-clang22-build.patch.xz
 	source = 0005-skia-m142-update.patch.xz
 	source = 0006-Add-FFmpeg-63-support.patch.xz
-	source = 0007-fix-rust-1.98-targets.patch
 	sha256sums = SKIP
-	sha256sums = 15d2d359b8571ecd0898faa6e05aa902b0de7cb34aadfc4d94adf6c8428f84df
+	sha256sums = 4d6ed3b18b2069c55bab12d8ba95da6013ac0b036d8a031df8b9f39a25d05c33
 	sha256sums = 1f1b71fcc22fe5e12bd57e7dcc544599e99071eb17b843b261c77fb86f943288
 	sha256sums = 10e928127276c934a51c053d3f7ceb247344afd2e82186e12c4f188dd743bc49
 	sha256sums = 6479aa1df3fda931d0e261edaffdcac2d162c0166c5cfd6adf6f45ccf632b852

Comment

The change only removes one sha256 checksum entry from .SRCINFO. By itself this does not introduce new code execution, network access, privilege escalation, or packaging behavior; it merely makes the metadata inconsistent with the PKGBUILD/source array until regenerated. I don't see evidence in this diff of a supply-chain or persistence issue.

@@ -90,6 +89,5 @@ pkgbase = icecat
 	sha256sums = 8f9b7458760b37766a73d4d2c0e93dc810e59d3844495b9d52b3b61dde59c05d
 	sha256sums = 43cf4f00643c1144f6debeec6a7cabde63de4089cca5d3bb3501beadd2c837bc
 	sha256sums = e7d30072641dfea9c3bff025db7e3a2c60201e630c5253bda1f2b54a0b5501ae
-	sha256sums = 8e93bc3f7745bd4a6bcf952120b60a260ea867f0c8319ea8f6df18ed1281bc1f
 
 pkgname = icecat

Comment

The change is a straightforward version bump in PKGBUILD metadata: it updates the IceCat release version, the pinned upstream commit, and the corresponding source checksum. There are no added build steps, no new network fetches beyond the existing source pinning, no install-script or systemd changes, and no suspicious packaging flags or privilege-related modifications in the provided hunk. Based on this diff alone, I see no security regression.

@@ -25,9 +25,9 @@
 : ${_build_limit_cores:=auto} # number of cores for parallelism; or auto, limited by RAM
 
 ## update
-_icver="140.16.0-1"
-_commit="8726dec784c7e50e95c823e37e6648cd7c45dbe3"
-_ffsum="15d2d359b8571ecd0898faa6e05aa902b0de7cb34aadfc4d94adf6c8428f84df"
+_icver="140.17.0-1"
+_commit="d7ffa7cbb29e7047b491ebbf5e50549548d480cb"
+_ffsum="4d6ed3b18b2069c55bab12d8ba95da6013ac0b036d8a031df8b9f39a25d05c33"
 
 ## package
 _pkgname="icecat"

Comment

The change only removes one source patch from PKGBUILD: the Rust 1.98 compatibility patch. There are no new sources, commands, network fetches, privilege changes, or packaging path changes introduced by this diff. The only plausible impact is a build failure or incompatibility with newer Rust toolchains, which is a reliability issue rather than a security issue. No evidence of malicious behavior or integrity weakening in the reviewed hunk.

@@ -157,9 +157,6 @@ source=(
 
   # fix for ffmpeg 9
   0006-Add-FFmpeg-63-support.patch.xz
-
-  # fix for rust 1.98
-  0007-fix-rust-1.98-targets.patch
 )
 sha256sums=(
   'SKIP'

Comment

The diff only removes one SHA256 entry from PKGBUILD after dropping the corresponding source patch (0007-fix-rust-1.98-targets.patch) from the source array. This is a routine maintenance change with no new code execution, no added network fetches, no privilege changes, and no suspicious packaging behavior. The remaining sources are unchanged and still pinned/hashed as before. Risk is therefore minimal.

@@ -176,7 +173,6 @@ sha256sums=(
   '8f9b7458760b37766a73d4d2c0e93dc810e59d3844495b9d52b3b61dde59c05d'
   '43cf4f00643c1144f6debeec6a7cabde63de4089cca5d3bb3501beadd2c837bc'
   'e7d30072641dfea9c3bff025db7e3a2c60201e630c5253bda1f2b54a0b5501ae'
-  '8e93bc3f7745bd4a6bcf952120b60a260ea867f0c8319ea8f6df18ed1281bc1f'
 )
 
 _make_icecat() (