Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 159.0b3 to 159.0b5. No build logic, sources, checksums, install scripts, or packaging metadata affecting trust boundaries changed. On its face this is a routine upstream version update with no security-relevant red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 159.0b3
+	pkgver = 159.0b5
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a straightforward version bump in .SRCINFO for firefox-beta-bin: it updates the provided firefox version, the upstream Mozilla archive tarball URL, and the corresponding checksum. The source remains an HTTPS download from the official Mozilla archive, and there are no new scripts, build steps, or privilege-related artifacts introduced by this diff. Based on the provided hunk alone, I do not see a supply-chain or persistence risk.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=159.0b3
+	provides = firefox=159.0b5
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/159.0b3/linux-x86_64/en-US/firefox-159.0b3.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/159.0b5/linux-x86_64/en-US/firefox-159.0b5.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = a8dbab6a800f09129098a3392c3815b82ab3b88c6d93ffbae33ec3bf8510933e
+	sha256sums = f8430c0b2112bee6f79a38e3c9e287acf39c20a6a67c431e123d38afc58befcd
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a simple version bump in PKGBUILD from 159.0b3 to 159.0b5 with no accompanying changes to sources, build logic, install scripts, or packaging behavior. This does not introduce new execution paths, network fetches, privilege changes, or integrity risks on its own. Based on the provided diff hunk, the change is low risk.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=159.0b3
+pkgver=159.0b5
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward version bump of the Firefox beta tarball from 159.0b3 to 159.0b5, with the corresponding checksum updated. The source remains the official Mozilla archive over HTTPS, there are no new build-time commands, no added scripts, and no packaging behavior changes beyond fetching a newer upstream release. I don’t see any integrity or persistence red flags in this diff.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/159.0b3/linux-x86_64/en-US/firefox-159.0b3.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/159.0b5/linux-x86_64/en-US/firefox-159.0b5.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('a8dbab6a800f09129098a3392c3815b82ab3b88c6d93ffbae33ec3bf8510933e'
+sha256sums=('f8430c0b2112bee6f79a38e3c9e287acf39c20a6a67c431e123d38afc58befcd'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')