Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 35.0.1 to 35.0.2. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were changed in the reviewed diff. On its face this is a routine upstream version update with no security red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = palemoon
 	pkgdesc = Open source web browser based on Firefox focusing on efficiency.
-	pkgver = 35.0.1
+	pkgver = 35.0.2
 	pkgrel = 1
 	epoch = 1
 	url = https://www.palemoon.org/

Comment

Low risk. This .SRCINFO-only change updates the package version and pins the Pale Moon source to a different upstream commit, with corresponding checksum updates. The source remains HTTPS on the official upstream repository and still uses a fixed commit plus PGP verification. No new build steps, scripts, permissions changes, or additional sources were introduced in this diff.

@@ -37,14 +37,14 @@ pkgbase = palemoon
 	depends = pango
 	optdepends = libpulse: PulseAudio audio driver
 	optdepends = ffmpeg: various video and audio support
-	source = git+https://repo.palemoon.org/MoonchildProductions/Pale-Moon?signed#commit=ce387e806b
+	source = git+https://repo.palemoon.org/MoonchildProductions/Pale-Moon?signed#commit=964e969389
 	source = git+https://repo.palemoon.org/MoonchildProductions/UXP
 	source = mozconfig.in
 	validpgpkeys = 3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC
-	sha1sums = 2c2f17bd3aa18c3ce692101dc9aa2550ba8ff51d
+	sha1sums = 5794fe0b1fe96a90a405ac935b07f70883ab716a
 	sha1sums = SKIP
 	sha1sums = a45ac7de3b664dcadb0917a975ee0b859385b719
-	sha256sums = 39ff9fdbe2f7e67a898409cc46fc6a23925b6951687ead89fa5a9f3411f65dc3
+	sha256sums = a317040b1916b7f5170236c7a96d25f3b77be868bf7e0e4c7ae1b1b5a137631d
 	sha256sums = SKIP
 	sha256sums = d74ba2d07f5ddb9a8268c64745995a310f5aa2033ca3c8634a22e0cbcf0fa3c2
 

Comment

The change is a routine version bump in PKGBUILD: pkgver and the pinned upstream commit were updated, along with the corresponding source checksums. The source remains fetched over HTTPS from the official Pale Moon repository, and the package continues to pin a specific commit rather than tracking a floating branch. No new build steps, scripts, privileges, or additional sources were introduced. I do not see any security-relevant regression in this diff.

@@ -7,9 +7,9 @@
 pkgname=palemoon
 _repo=Pale-Moon
 epoch=1
-pkgver=35.0.1
+pkgver=35.0.2
 # Commit ID can be found at https://repo.palemoon.org/MoonchildProductions/Pale-Moon/tags
-_commit=ce387e806b
+_commit=964e969389
 pkgrel=1
 pkgdesc="Open source web browser based on Firefox focusing on efficiency."
 arch=('i686' 'x86_64')

Comment

The change only bumps Pale Moon from 35.0.1 to 35.0.2 and updates the corresponding source checksums/commit pin. The source remains fetched over HTTPS from the official upstream repo, the VCS source is still pinned to a specific commit, and there are no new build-time downloads, scripts, privilege changes, or packaging behavior changes in this diff. No security red flags are introduced by the checksum refresh itself.

@@ -53,10 +53,10 @@ source=(git+"https://repo.palemoon.org/MoonchildProductions/${_repo}?signed#comm
         git+"https://repo.palemoon.org/MoonchildProductions/UXP"
         mozconfig.in)
 validpgpkeys=('3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC')
-sha1sums=('2c2f17bd3aa18c3ce692101dc9aa2550ba8ff51d'
+sha1sums=('5794fe0b1fe96a90a405ac935b07f70883ab716a'
           'SKIP'
           'a45ac7de3b664dcadb0917a975ee0b859385b719')
-sha256sums=('39ff9fdbe2f7e67a898409cc46fc6a23925b6951687ead89fa5a9f3411f65dc3'
+sha256sums=('a317040b1916b7f5170236c7a96d25f3b77be868bf7e0e4c7ae1b1b5a137631d'
             'SKIP'
             'd74ba2d07f5ddb9a8268c64745995a310f5aa2033ca3c8634a22e0cbcf0fa3c2')