Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 158.0b4 to 158.0b5 with no other metadata changes. .SRCINFO is generated package metadata and this diff does not introduce new sources, scripts, dependencies, install actions, or privilege-related behavior. No security concerns are evident from the provided hunk alone.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 158.0b4
+	pkgver = 158.0b5
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a routine version bump in .SRCINFO for firefox-beta-bin from 158.0b4 to 158.0b5, updating the upstream Mozilla archive URL and the corresponding checksum/provides entry. The source remains HTTPS on the official Mozilla archive, there are no new sources, scripts, or packaging behaviors introduced, and no evidence of privilege escalation or persistence mechanisms in this diff. Risk is minimal and limited to normal upstream release trust.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=158.0b4
+	provides = firefox=158.0b5
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/158.0b4/linux-x86_64/en-US/firefox-158.0b4.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/158.0b5/linux-x86_64/en-US/firefox-158.0b5.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = e0deab5e83c3576b82821305469bfa2863589f79567ff8b3b27e840face9088e
+	sha256sums = 015ac2484f14f1e75cec00e42c1391285dd649226a272378b3a1142d2d8cfa28
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a simple version bump in PKGBUILD from 158.0b4 to 158.0b5 with no accompanying logic changes. There are no new sources, scripts, install hooks, permissions changes, or build steps introduced in the reviewed hunk. On its face this is a routine upstream version update and does not add security risk by itself.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=158.0b4
+pkgver=158.0b5
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward upstream version bump for the Firefox beta binary package: it updates the official Mozilla HTTPS archive URL from 158.0b4 to 158.0b5 and refreshes the corresponding SHA-256 checksum. No new build steps, scripts, patches, privilege changes, or additional sources are introduced. The package still pulls from the official Mozilla archive and remains pinned to a specific release tarball, so there is no supply-chain red flag in this diff.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/158.0b4/linux-x86_64/en-US/firefox-158.0b4.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/158.0b5/linux-x86_64/en-US/firefox-158.0b5.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('e0deab5e83c3576b82821305469bfa2863589f79567ff8b3b27e840face9088e'
+sha256sums=('015ac2484f14f1e75cec00e42c1391285dd649226a272378b3a1142d2d8cfa28'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')