Review Results

Comment

The change is a straightforward version bump in .SRCINFO, updating pkgver/provides/source checksums to match the new Pale Moon release. I did not see any new red flags in the metadata itself: sources remain HTTPS, the upstream repo/tag naming is consistent, and there are no added scripts, patches, or privilege-related changes. The package still points to the same upstream binary release and signature flow as before. Risk is low because this diff only refreshes metadata for a new version and does not introduce new attack surface.

@@ -1,6 +1,6 @@
 pkgbase = palemoon-bin
 	pkgdesc = Open source web browser based on Firefox focusing on efficiency.
-	pkgver = 34.3.2.1
+	pkgver = 35.0.2
 	pkgrel = 1
 	epoch = 1
 	url = http://linux.palemoon.org/

Comment

The change is a straightforward version bump in .SRCINFO: it updates the provided version, upstream desktop file tag, release tarball URL, and checksum to Pale Moon 35.0.2. The sources remain HTTPS and point to the project’s official domains, and there are no new build-time commands, scripts, or privilege-related artifacts introduced in this diff. Since this is only metadata and the tarball is still checksum- and signature-pinned, I don’t see a security issue in the reviewed hunk.

@@ -16,16 +16,16 @@ pkgbase = palemoon-bin
 	depends = mime-types
 	depends = nss
 	optdepends = ffmpeg: record, convert, and stream audio and video
-	provides = palemoon=34.3.2.1
+	provides = palemoon=35.0.2
 	conflicts = palemoon
 	options = !strip
-	source = palemoon.desktop-34.3.2.1::https://repo.palemoon.org/MoonchildProductions/Pale-Moon/raw/tag/34.3.2.1_Release/palemoon/branding/official/palemoon.desktop
-	source = https://rm-eu.palemoon.org/release/palemoon-34.3.2.1.linux-x86_64-gtk2.tar.xz
-	source = https://rm-eu.palemoon.org/release/palemoon-34.3.2.1.linux-x86_64-gtk2.tar.xz.sig
+	source = palemoon.desktop-35.0.2::https://repo.palemoon.org/MoonchildProductions/Pale-Moon/raw/tag/35.0.2_Release/palemoon/branding/official/palemoon.desktop
+	source = https://rm-eu.palemoon.org/release/palemoon-35.0.2.linux-x86_64-gtk2.tar.xz
+	source = https://rm-eu.palemoon.org/release/palemoon-35.0.2.linux-x86_64-gtk2.tar.xz.sig
 	validpgpkeys = 439F46F42C6AE3D23CF52E70865E6C87C65285EC
 	validpgpkeys = 3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC
 	sha256sums = b3803b30b5e6b9589387b7162cd24247da242fe77c0aed0d09bc51338d36d7d8
-	sha256sums = 14c854afb69a78fae7b3b2a7bd700751c61cf5b95007ec94038d813675009bec
+	sha256sums = a70e0f0517f99021790d6c42378d022bafac1fc1c22d02910bf8e3f619ffc0cd
 	sha256sums = SKIP
 
 pkgname = palemoon-bin

Comment

The change is a straightforward version bump in PKGBUILD from 34.3.2.1 to 35.0.2, with the corresponding source tarball checksum updated. The package still downloads from the upstream Pale Moon release host over HTTPS, uses a pinned release tarball rather than a floating branch, and there are no new build steps, scripts, or privilege-related changes. No suspicious sources, commands, or packaging behavior were introduced in this diff hunk.

@@ -5,7 +5,7 @@
 
 pkgname=palemoon-bin
 epoch=1
-pkgver=34.3.2.1
+pkgver=35.0.2
 pkgrel=1
 pkgdesc="Open source web browser based on Firefox focusing on efficiency."
 arch=('x86_64')

Comment

The change is limited to bumping the package version and updating the SHA256 for the corresponding desktop file/source entry. The source URLs remain HTTPS and point to the upstream Pale Moon repository/site, with no new build-time downloads, scripts, privilege changes, or packaging logic introduced. I do not see any supply-chain red flags in this diff alone.

@@ -27,7 +27,7 @@ source=(palemoon.desktop-${pkgver}::"https://repo.palemoon.org/MoonchildProducti
 #      "https://rm-us.palemoon.org/release/palemoon-${pkgver}.linux-x86_64-gtk2.tar.xz"{,.sig}) # US link
 # link to latest tarball: https://www.palemoon.org/download.shtml
 sha256sums=('b3803b30b5e6b9589387b7162cd24247da242fe77c0aed0d09bc51338d36d7d8'
-            '14c854afb69a78fae7b3b2a7bd700751c61cf5b95007ec94038d813675009bec'
+            'a70e0f0517f99021790d6c42378d022bafac1fc1c22d02910bf8e3f619ffc0cd'
             'SKIP')
 validpgpkeys=('439F46F42C6AE3D23CF52E70865E6C87C65285EC' # T. Wine
               '3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC') # Moonchild, see https://forum.palemoon.org/viewtopic.php?f=1&t=7176