Review Results

Comment

The change only bumps pkgver in .SRCINFO from 158.0b5 to 158.0rc2. This is a metadata-only version update with no evidence of altered sources, build steps, install scripts, or packaging behavior. I do not see any security-relevant red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 158.0b5
+	pkgver = 158.0rc2
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a straightforward metadata update in .SRCINFO: it bumps the provided Firefox version from 158.0b5 to 158.0rc2 and switches the source URL to Mozilla’s official FTP candidate build, with a matching checksum update. The source remains HTTPS and points to an official Mozilla host, with no new build-time execution, install-script, or packaging-logic changes visible in this hunk. No obvious supply-chain or privilege-escalation risk is introduced by this diff alone.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=158.0b5
+	provides = firefox=158.0rc2
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/158.0b5/linux-x86_64/en-US/firefox-158.0b5.tar.xz
+	source = firefox-158.0rc2.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/158.0-candidates/build2/linux-x86_64/en-US/firefox-158.0.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 015ac2484f14f1e75cec00e42c1391285dd649226a272378b3a1142d2d8cfa28
+	sha256sums = 9549b054ec4cf85f50f6a19d8c6fb79580312e71ebc4ec2cb217ec9af09dc12a
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a straightforward version bump from Firefox 158.0b5 to 158.0rc2, with the source URL and checksum updated accordingly. No new build logic, scripts, network fetches, privilege changes, or packaging behavior were introduced. The only security-relevant question is whether the new tarball/checksum correspond to the intended upstream Mozilla release, and the diff itself shows a normal pinned HTTPS archive.mozilla.org source. No obvious supply-chain or persistence concerns in this hunk.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=158.0b5
+pkgver=158.0rc2
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change only updates the SHA-256 checksum for the Firefox beta tarball source in PKGBUILD. The source URL remains the official Mozilla archive over HTTPS, and there are no new build steps, scripts, or privilege-related changes. This is a routine integrity update consistent with an upstream release refresh, with no obvious security red flags in the provided hunk.

@@ -26,7 +26,7 @@ source=("https://archive.mozilla.org/pub/firefox/releases/158.0b5/linux-x86_64/e
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('015ac2484f14f1e75cec00e42c1391285dd649226a272378b3a1142d2d8cfa28'
+sha256sums=('9549b054ec4cf85f50f6a19d8c6fb79580312e71ebc4ec2cb217ec9af09dc12a'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')