Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 35.0.2 to 35.0.3. No sources, checksums, build steps, install scripts, permissions, or dependency metadata changed, and there is no evidence of added network access, persistence, or privilege escalation. On its face this is a routine package version update with no security impact in the reviewed diff.

@@ -1,6 +1,6 @@
 pkgbase = palemoon
 	pkgdesc = Open source web browser based on Firefox focusing on efficiency.
-	pkgver = 35.0.2
+	pkgver = 35.0.3
 	pkgrel = 1
 	epoch = 1
 	url = https://www.palemoon.org/

Comment

The change is limited to updating .SRCINFO metadata for a new upstream release commit and corresponding checksums. The source remains an HTTPS git URL pinned to a specific commit, with the same signed repository and PGP key verification. No new sources, scripts, install hooks, or build logic are introduced in this diff. Based on the provided hunk alone, there are no obvious security red flags.

@@ -37,14 +37,14 @@ pkgbase = palemoon
 	depends = pango
 	optdepends = libpulse: PulseAudio audio driver
 	optdepends = ffmpeg: various video and audio support
-	source = git+https://repo.palemoon.org/MoonchildProductions/Pale-Moon?signed#commit=964e969389
+	source = git+https://repo.palemoon.org/MoonchildProductions/Pale-Moon?signed#commit=502c2da4cb
 	source = git+https://repo.palemoon.org/MoonchildProductions/UXP
 	source = mozconfig.in
 	validpgpkeys = 3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC
-	sha1sums = 5794fe0b1fe96a90a405ac935b07f70883ab716a
+	sha1sums = 4e3d5c8efd78f4b70f24cf22323ae31d93dd0534
 	sha1sums = SKIP
 	sha1sums = a45ac7de3b664dcadb0917a975ee0b859385b719
-	sha256sums = a317040b1916b7f5170236c7a96d25f3b77be868bf7e0e4c7ae1b1b5a137631d
+	sha256sums = fc8933a21f3c6aaa6c375b23632c216d91c850010f6817e1934bcb9f19e90cfe
 	sha256sums = SKIP
 	sha256sums = d74ba2d07f5ddb9a8268c64745995a310f5aa2033ca3c8634a22e0cbcf0fa3c2
 

Comment

The change is a routine version bump in PKGBUILD: pkgver/_commit and the corresponding source checksums were updated to match a new upstream Pale Moon release commit. The source remains pinned to a specific commit over HTTPS, with signed git source and existing PGP verification intact. No new build steps, network fetches, install-script changes, or suspicious dependencies were introduced in this diff.

@@ -7,9 +7,9 @@
 pkgname=palemoon
 _repo=Pale-Moon
 epoch=1
-pkgver=35.0.2
+pkgver=35.0.3
 # Commit ID can be found at https://repo.palemoon.org/MoonchildProductions/Pale-Moon/tags
-_commit=964e969389
+_commit=502c2da4cb
 pkgrel=1
 pkgdesc="Open source web browser based on Firefox focusing on efficiency."
 arch=('i686' 'x86_64')

Comment

The change only updates the recorded checksums for an existing source file (`mozconfig.in`). The source URL remains the same HTTPS upstream git repository, and there are no new build steps, scripts, binaries, or privilege-related changes in this hunk. This is a low-risk integrity metadata update, not an execution-path change.

@@ -53,10 +53,10 @@ source=(git+"https://repo.palemoon.org/MoonchildProductions/${_repo}?signed#comm
         git+"https://repo.palemoon.org/MoonchildProductions/UXP"
         mozconfig.in)
 validpgpkeys=('3DAD8CD107197488D2A2A0BD40481E7B8FCF9CEC')
-sha1sums=('5794fe0b1fe96a90a405ac935b07f70883ab716a'
+sha1sums=('4e3d5c8efd78f4b70f24cf22323ae31d93dd0534'
           'SKIP'
           'a45ac7de3b664dcadb0917a975ee0b859385b719')
-sha256sums=('a317040b1916b7f5170236c7a96d25f3b77be868bf7e0e4c7ae1b1b5a137631d'
+sha256sums=('fc8933a21f3c6aaa6c375b23632c216d91c850010f6817e1934bcb9f19e90cfe'
             'SKIP'
             'd74ba2d07f5ddb9a8268c64745995a310f5aa2033ca3c8634a22e0cbcf0fa3c2')