Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 159.0b1 to 159.0b2. No sources, checksums, install scripts, dependencies, or packaging logic are modified here, so there is no new security concern introduced by this diff alone.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 159.0b1
+	pkgver = 159.0b2
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a routine version bump in .SRCINFO for firefox-beta-bin, updating the upstream Mozilla archive URL, provided virtual package version, and matching checksum from 159.0b1 to 159.0b2. The source remains HTTPS from the official Mozilla archive, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. Based on the provided hunk alone, this looks safe.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=159.0b1
+	provides = firefox=159.0b2
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/159.0b1/linux-x86_64/en-US/firefox-159.0b1.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/159.0b2/linux-x86_64/en-US/firefox-159.0b2.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 25fe7b5c039f33582f3e7961f4b4feb281b3061e311d372b8c12590324056053
+	sha256sums = 332e4260fdc080994039721672c961c09362916464272de471b00bfdac4850c3
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a simple version bump in PKGBUILD from 159.0b1 to 159.0b2 with no alterations to sources, build steps, install scripts, dependencies, or packaging behavior. I see no new supply-chain, persistence, privilege, or integrity risks introduced by this diff alone.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=159.0b1
+pkgver=159.0b2
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward upstream version bump for the Firefox beta binary package, updating the official Mozilla HTTPS archive URL from 159.0b1 to 159.0b2 and replacing the corresponding SHA-256 checksum. No new sources, scripts, build steps, or privilege-related artifacts are introduced, and the source remains pinned to a specific release tarball from the official archive. I did not find any security red flags in this diff.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/159.0b1/linux-x86_64/en-US/firefox-159.0b1.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/159.0b2/linux-x86_64/en-US/firefox-159.0b2.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('25fe7b5c039f33582f3e7961f4b4feb281b3061e311d372b8c12590324056053'
+sha256sums=('332e4260fdc080994039721672c961c09362916464272de471b00bfdac4850c3'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')