Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 160.0b3 to 160.0b4. This is a routine metadata update with no evidence of altered sources, build logic, install scripts, or packaging behavior. No security-relevant red flags are present in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 160.0b3
+	pkgver = 160.0b4
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a straightforward version bump in .SRCINFO: it updates the Firefox beta tarball URL, the provided virtual package version, and the corresponding checksum. The source remains the official Mozilla archive over HTTPS, there are no new build-time commands, no added scripts, and no packaging/persistence red flags introduced by this diff. Risk is minimal.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=160.0b3
+	provides = firefox=160.0b4
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/160.0b3/linux-x86_64/en-US/firefox-160.0b3.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/160.0b4/linux-x86_64/en-US/firefox-160.0b4.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = f703b8ae5da292748c0056efa14bd527784f1e2191af01d09ed058219bf502f4
+	sha256sums = 902ee5a6e80c44e11fb130e7bba82773ba2e47a5d4eae3b3642603b40d2f3a08
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a simple version bump in PKGBUILD from 160.0b3 to 160.0b4 with no accompanying changes to sources, build logic, install scripts, or packaging behavior. I found no new integrity, execution, persistence, or privilege-escalation concerns in this diff hunk.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=160.0b3
+pkgver=160.0b4
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward upstream version bump for the Firefox beta binary package, updating the release tarball URL from 160.0b3 to 160.0b4 and its corresponding SHA-256 checksum. The source remains the official Mozilla archive over HTTPS, there are no new build-time downloads, scripts, patches, or packaging logic changes, and no new privilege/persistence concerns are introduced by this diff. Risk is therefore minimal.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/160.0b3/linux-x86_64/en-US/firefox-160.0b3.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/160.0b4/linux-x86_64/en-US/firefox-160.0b4.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('f703b8ae5da292748c0056efa14bd527784f1e2191af01d09ed058219bf502f4'
+sha256sums=('902ee5a6e80c44e11fb130e7bba82773ba2e47a5d4eae3b3642603b40d2f3a08'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')