Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 15.0.25 to 15.0.26. No source URLs, checksums, build steps, install scripts, or package metadata affecting execution/persistence were modified in the reviewed diff. Based on this hunk alone, there is no security-relevant concern.

@@ -1,6 +1,6 @@
 pkgbase = tor-browser-bin
 	pkgdesc = Tor Browser Bundle: anonymous browsing using Firefox and Tor
-	pkgver = 15.0.25
+	pkgver = 15.0.26
 	pkgrel = 1
 	url = https://www.torproject.org/projects/torbrowser.html
 	install = tor-browser.install

Comment

The change only bumps the noextract filenames in .SRCINFO from Tor Browser 15.0.25 to 15.0.26 for the i686 and x86_64 release tarballs. This is metadata-only and does not introduce new sources, scripts, build steps, or privilege-related behavior. No security-relevant red flags are present in the provided hunk.

@@ -28,8 +28,8 @@ pkgbase = tor-browser-bin
 	optdepends = libnotify: Gnome dialog boxes
 	provides = tor-browser
 	conflicts = tor-browser
-	noextract = tor-browser-linux-i686-15.0.25.tar.xz
-	noextract = tor-browser-linux-x86_64-15.0.25.tar.xz
+	noextract = tor-browser-linux-i686-15.0.26.tar.xz
+	noextract = tor-browser-linux-x86_64-15.0.26.tar.xz
 	source = tor-browser.desktop.in
 	source = tor-browser.in
 	source = tor-browser.png

Comment

The change is a straightforward version bump in .SRCINFO from Tor Browser 15.0.25 to 15.0.26, with source URLs still using HTTPS on the official Tor Project archive and updated checksums. No new sources, scripts, build steps, or packaging behavior are introduced by this diff. Based on the provided hunk alone, there are no obvious supply-chain or privilege-escalation concerns.

@@ -39,13 +39,13 @@ pkgbase = tor-browser-bin
 	sha256sums = 53754c8ff0ea01d8f79d3e725fa3516511faf1e53804c67dc8f573cdb39e35a3
 	sha256sums = f25ccf68b47f5eb14c6fec0664c74f30ea9c6c58d42fc6abac3b64670aaa3152
 	sha256sums = 7b28b5dbe8ad573bb46e61b4d542b33e01ca240825ca640b4893fee6203b021f
-	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.25/tor-browser-linux-i686-15.0.25.tar.xz
-	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.25/tor-browser-linux-i686-15.0.25.tar.xz.asc
-	sha256sums_i686 = 2c836601e0f49b21b9aace8c9df613cd1de01468c0f02c67d62e1bdea6a676a9
+	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.26/tor-browser-linux-i686-15.0.26.tar.xz
+	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.26/tor-browser-linux-i686-15.0.26.tar.xz.asc
+	sha256sums_i686 = 7c629ebd22ef3b14e18ab5bf35de2fa6ef32c91a9bd69c5bf0aa431e86aecbb4
 	sha256sums_i686 = SKIP
-	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.25/tor-browser-linux-x86_64-15.0.25.tar.xz
-	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.25/tor-browser-linux-x86_64-15.0.25.tar.xz.asc
-	sha256sums_x86_64 = 37432d6f4d9b1f1190ba2cfbbd4ab9dad5ccd52c14aa47a21795d08273f4a165
+	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.26/tor-browser-linux-x86_64-15.0.26.tar.xz
+	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.26/tor-browser-linux-x86_64-15.0.26.tar.xz.asc
+	sha256sums_x86_64 = 327ac7443724b9eb6d3697506391b110ee159739bdc14bd731caa6fc16ffbf74
 	sha256sums_x86_64 = SKIP
 
 pkgname = tor-browser-bin

Comment

The change is a simple version bump in PKGBUILD from 15.0.25 to 15.0.26 with no accompanying changes to sources, build logic, install scripts, or packaging behavior. Based on the provided diff, there are no new security concerns introduced by this commit.

@@ -21,7 +21,7 @@
 
 _appname='tor-browser'
 pkgname="${_appname}-bin"
-pkgver='15.0.25'
+pkgver='15.0.26'
 pkgrel=1
 pkgdesc='Tor Browser Bundle: anonymous browsing using Firefox and Tor'
 url='https://www.torproject.org/projects/torbrowser.html'