Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 1 to 2. This is a metadata-only rebuild indicator and does not alter sources, build logic, dependencies, install scripts, or shipped artifacts. No security-relevant behavior is introduced by the diff shown.

@@ -1,7 +1,7 @@
 pkgbase = icecat
 	pkgdesc = GNU version of the Firefox ESR browser
 	pkgver = 153.6.0
-	pkgrel = 1
+	pkgrel = 2
 	url = https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git
 	arch = x86_64
 	license = MPL-2.0

Comment

The change only bumps pkgrel from 1 to 2 in PKGBUILD and does not alter sources, build steps, dependencies, install scripts, permissions, or any runtime behavior. No security-relevant content is introduced by this diff hunk.

@@ -33,7 +33,7 @@ _ffsum="91cb675ddfc678255f57ecd7aad498501961577686d19c1947a82b14edea7f25"
 _pkgname="icecat"
 pkgname="$_pkgname"
 pkgver="${_icver%%-*}"
-pkgrel=1
+pkgrel=2
 pkgdesc="GNU version of the Firefox ESR browser"
 url="https://gitweb.git.savannah.gnu.org/gitweb/?p=gnuzilla.git"
 license=('MPL-2.0')

Comment

The change is a small packaging-side sed tweak that rewrites a string in upstream moz.configure to avoid creating an empty ~/mozilla/icecat directory. I do not see any security-relevant behavior introduced: no new network access, privilege changes, persistence, or executable payloads. The edit is narrowly scoped and only adjusts a path string in the build tree. Risk is therefore minimal.

@@ -380,6 +380,9 @@ END
       patch -Np1 -F100 -i "${srcdir:?}/$src"
     fi
   done
+
+  # prevent empty ~/mozilla/icecat
+  sed -E -e '/imply_option/s&"(mozilla/icecat)"&".\1"&' -i browser/moz.configure
 )
 
 build() (