Review Results

Comment

The change is limited to bumping the package version in .SRCINFO from 159.0b5 to 159.0rc1. No sources, checksums, build steps, install scripts, permissions, or dependencies are altered by this diff. On its face this is a routine metadata update with no security impact visible in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 159.0b5
+	pkgver = 159.0rc1
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is low risk. It only updates the Firefox beta-bin package metadata to track a newer upstream release candidate: the provided version changes from 159.0b5 to 159.0rc1, and the source URL/sha256 are updated accordingly. The source remains HTTPS and points to Mozilla infrastructure, with no new scripts, build logic, or install-time behavior introduced. I do note the source filename is rewritten via a local filename prefix while still fetching from Mozilla, but that is a normal packaging pattern and not suspicious by itself.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=159.0b5
+	provides = firefox=159.0rc1
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/159.0b5/linux-x86_64/en-US/firefox-159.0b5.tar.xz
+	source = firefox-159.0rc1.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/159.0-candidates/build1/linux-x86_64/en-US/firefox-159.0.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = f8430c0b2112bee6f79a38e3c9e287acf39c20a6a67c431e123d38afc58befcd
+	sha256sums = 54536fcd120af484d4c56272a5a1cf4af57b9c713d1a3b1e775da192dd541fcd
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

Low risk change: this only bumps the packaged Firefox beta-bin version from 159.0b5 to 159.0rc1 and updates the corresponding upstream archive checksum. The source remains an HTTPS Mozilla archive URL, there are no new build steps, scripts, patches, or privilege-related changes, and no evidence of added network access or persistence mechanisms. The review scope is limited to a version/checksum update, so I see no security issue here.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=159.0b5
+pkgver=159.0rc1
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change only updates the SHA-256 checksum for the Firefox beta tarball source in PKGBUILD. The source URL remains the official Mozilla archive over HTTPS, and there are no new build steps, scripts, or privilege-related changes. This is a routine integrity-pin update with no apparent security impact beyond trusting the new checksum value.

@@ -26,7 +26,7 @@ source=("https://archive.mozilla.org/pub/firefox/releases/159.0b5/linux-x86_64/e
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('f8430c0b2112bee6f79a38e3c9e287acf39c20a6a67c431e123d38afc58befcd'
+sha256sums=('54536fcd120af484d4c56272a5a1cf4af57b9c713d1a3b1e775da192dd541fcd'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')