Review Results

Comment

The change only bumps .SRCINFO pkgver from 158.0rc2 to 159.0b1. No build logic, sources, checksums, install scripts, or package metadata beyond the version string changed in the provided diff. On its face this is a routine version update with no security-relevant red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 158.0rc2
+	pkgver = 159.0b1
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a straightforward version bump in .SRCINFO: it updates the provided Firefox version and switches the source tarball from Mozilla’s FTP candidates URL to the official archive.mozilla.org release URL, with a matching checksum update. I do not see any new build-time execution, privilege escalation, suspicious mirrors, or integrity regressions in this diff. The source remains HTTPS and points to Mozilla infrastructure, and the package metadata changes are consistent with a normal upstream release update.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=158.0rc2
+	provides = firefox=159.0b1
 	conflicts = firefox-beta
-	source = firefox-158.0rc2.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/158.0-candidates/build2/linux-x86_64/en-US/firefox-158.0.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/159.0b1/linux-x86_64/en-US/firefox-159.0b1.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 9549b054ec4cf85f50f6a19d8c6fb79580312e71ebc4ec2cb217ec9af09dc12a
+	sha256sums = 25fe7b5c039f33582f3e7961f4b4feb281b3061e311d372b8c12590324056053
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a straightforward version bump for a binary Firefox beta package. The source remains an HTTPS download from Mozilla’s official archive, with the checksum updated accordingly. No new scripts, patches, install logic, permissions changes, or network-at-build-time behavior were introduced in this diff. I don’t see any supply-chain or privilege-escalation concern in the hunk provided.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=158.0rc2
+pkgver=159.0b1
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward version bump of the Firefox beta binary package from 158.0b5 to 159.0b1, with the source URL still pointing to Mozilla's official HTTPS archive and the checksum updated accordingly. No new build-time commands, scripts, privileges, or additional sources were introduced in this hunk. The only risk is the usual trust in upstream prebuilt binaries, which is inherent to -bin packages and not newly introduced here.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/158.0b5/linux-x86_64/en-US/firefox-158.0b5.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/159.0b1/linux-x86_64/en-US/firefox-159.0b1.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('9549b054ec4cf85f50f6a19d8c6fb79580312e71ebc4ec2cb217ec9af09dc12a'
+sha256sums=('25fe7b5c039f33582f3e7961f4b4feb281b3061e311d372b8c12590324056053'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')