Review Results

Comment

The change is limited to .SRCINFO metadata: it updates pkgver from 15.0.26 to 16.0 and adds aarch64 while removing i686. No executable build logic, install script, sources, or package actions are changed in the reviewed hunk. On its face this is a routine metadata update and architecture support adjustment, with no direct security impact visible from the diff provided.

@@ -1,11 +1,11 @@
 pkgbase = tor-browser-bin
 	pkgdesc = Tor Browser Bundle: anonymous browsing using Firefox and Tor
-	pkgver = 15.0.26
+	pkgver = 16.0
 	pkgrel = 1
 	url = https://www.torproject.org/projects/torbrowser.html
 	install = tor-browser.install
-	arch = i686
 	arch = x86_64
+	arch = aarch64
 	license = MPL-2.0
 	depends = libxt
 	depends = startup-notification

Comment

The change is a routine package version/architecture update in .SRCINFO. Sources remain HTTPS and point to the official Tor Project archive, with detached signatures still referenced and checksums updated. No new build-time code, install-script behavior, or privilege/persistence mechanism is introduced by this metadata-only diff. The only notable change is dropping i686 and adding aarch64 support, which is not inherently suspicious in this context.

@@ -28,8 +28,8 @@ pkgbase = tor-browser-bin
 	optdepends = libnotify: Gnome dialog boxes
 	provides = tor-browser
 	conflicts = tor-browser
-	noextract = tor-browser-linux-i686-15.0.26.tar.xz
-	noextract = tor-browser-linux-x86_64-15.0.26.tar.xz
+	noextract = tor-browser-linux-x86_64-16.0.tar.xz
+	noextract = tor-browser-linux-aarch64-16.0.tar.xz
 	source = tor-browser.desktop.in
 	source = tor-browser.in
 	source = tor-browser.png

Comment

The change only updates .SRCINFO to point x86_64 and aarch64 sources at Tor Browser 16.0 archives on the official Tor Project archive over HTTPS, with matching SHA256 sums and the expected detached signature files. No new build-time code, install script, or packaging logic is introduced, and the source URLs are not suspicious. The only notable aspect is that i686 remains on the previous version while other architectures move to 16.0, but that is a packaging/versioning inconsistency rather than a security issue in this diff.

@@ -39,13 +39,13 @@ pkgbase = tor-browser-bin
 	sha256sums = 53754c8ff0ea01d8f79d3e725fa3516511faf1e53804c67dc8f573cdb39e35a3
 	sha256sums = f25ccf68b47f5eb14c6fec0664c74f30ea9c6c58d42fc6abac3b64670aaa3152
 	sha256sums = 7b28b5dbe8ad573bb46e61b4d542b33e01ca240825ca640b4893fee6203b021f
-	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.26/tor-browser-linux-i686-15.0.26.tar.xz
-	source_i686 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.26/tor-browser-linux-i686-15.0.26.tar.xz.asc
-	sha256sums_i686 = 7c629ebd22ef3b14e18ab5bf35de2fa6ef32c91a9bd69c5bf0aa431e86aecbb4
-	sha256sums_i686 = SKIP
-	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.26/tor-browser-linux-x86_64-15.0.26.tar.xz
-	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/15.0.26/tor-browser-linux-x86_64-15.0.26.tar.xz.asc
-	sha256sums_x86_64 = 327ac7443724b9eb6d3697506391b110ee159739bdc14bd731caa6fc16ffbf74
+	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/16.0/tor-browser-linux-x86_64-16.0.tar.xz
+	source_x86_64 = https://archive.torproject.org/tor-package-archive/torbrowser/16.0/tor-browser-linux-x86_64-16.0.tar.xz.asc
+	sha256sums_x86_64 = de3370b67389c2848738cdd515bb2e3b232a4ae93290eae74185c4c43a291a24
 	sha256sums_x86_64 = SKIP
+	source_aarch64 = https://archive.torproject.org/tor-package-archive/torbrowser/16.0/tor-browser-linux-aarch64-16.0.tar.xz
+	source_aarch64 = https://archive.torproject.org/tor-package-archive/torbrowser/16.0/tor-browser-linux-aarch64-16.0.tar.xz.asc
+	sha256sums_aarch64 = 1cc50cce2073d48c88299497e786d51f6f7d66d5cf38d32e3007772d6c146a77
+	sha256sums_aarch64 = SKIP
 
 pkgname = tor-browser-bin

Comment

The change is limited to bumping Tor Browser from 15.0.26 to 16.0 and switching the supported architectures from i686/x86_64 to x86_64/aarch64. The PKGBUILD still fetches release tarballs over HTTPS from Tor Project’s archive, verifies them via the existing checksum/signature mechanism, and does not introduce any new build-time code execution, install-script logic, or packaging writes outside $pkgdir. I did not see any new supply-chain red flags in the diff itself. The only notable risk is the usual one for a -bin package: it installs upstream prebuilt binaries, but that was already true before this change.

@@ -21,11 +21,11 @@
 
 _appname='tor-browser'
 pkgname="${_appname}-bin"
-pkgver='15.0.26'
+pkgver='16.0'
 pkgrel=1
 pkgdesc='Tor Browser Bundle: anonymous browsing using Firefox and Tor'
 url='https://www.torproject.org/projects/torbrowser.html'
-arch=('i686' 'x86_64')
+arch=('x86_64' 'aarch64')
 license=(MPL-2.0)
 depends=('libxt' 'startup-notification' 'mime-types' 'dbus-glib'
 	'alsa-lib' 'desktop-file-utils' 'hicolor-icon-theme'

Comment

The change is a straightforward architecture support update for Tor Browser: it replaces i686 with aarch64, updates the arch array, source/checksum variables, and noextract entries accordingly. I do not see any new code execution, network behavior beyond the existing checksum/source fetches from Tor Project archives, or packaging actions outside pkgdir. The source URLs remain HTTPS and point to the official Tor archive. No suspicious install script or unit changes are involved in this diff.

@@ -41,12 +41,12 @@ conflicts=("${_appname}")
 install="${_appname}.install"
 validpgpkeys=('EF6E286DDA85EA2A4BA7DE684E2C6E8793298290')
 
-_tag_i686='linux-i686'
 _tag_x86_64='linux-x86_64'
+_tag_aarch64='linux-aarch64'
 _urlbase="https://archive.torproject.org/tor-package-archive/torbrowser/${pkgver}"
-_archstr=$([[ "${CARCH}" == 'x86_64' ]] && echo -n "${_tag_x86_64}" || echo -n "${_tag_i686}")
+_archstr=$([[ "${CARCH}" == 'aarch64' ]] && echo -n "${_tag_aarch64}" || echo -n "${_tag_x86_64}")
 
-# Syntax: _dist_checksum 'linux-i686'/'linux-x86_64'
+# Syntax: _dist_checksum 'linux-x86_64'/'linux-aarch64'
 _dist_checksum() {
 
 	(curl --silent --fail "${_urlbase}/sha256sums-signed-build.txt" || \

Comment

The change is limited to adding aarch64 support and removing i686. It updates the architecture list, source/checksum arrays, and the architecture selector to use the Tor Project's official archive over HTTPS with pinned release tarballs and detached signatures. I do not see any new build-time network fetches beyond the existing checksum helper, no suspicious scripts, and no packaging actions outside $pkgdir. The only notable behavior is that _archstr now defaults to x86_64 for any non-aarch64 build, but since arch() is restricted to x86_64/aarch64 this is not a security issue in this diff.

@@ -60,8 +60,8 @@ _sed_escape() {
 	echo "${1}" | sed 's/[]\/&.*$^[]/\\&/g'
 }
 
-source_i686=("${_urlbase}/${_appname}-${_tag_i686}-${pkgver}.tar.xz"{,.asc})
 source_x86_64=("${_urlbase}/${_appname}-${_tag_x86_64}-${pkgver}.tar.xz"{,.asc})
+source_aarch64=("${_urlbase}/${_appname}-${_tag_aarch64}-${pkgver}.tar.xz"{,.asc})
 source=("${_appname}.desktop.in"
 	    "${_appname}.in"
 	    "${_appname}.png"

Comment

The change is a straightforward architecture update for the Tor Browser binary package: it replaces i686 support with aarch64, updates the architecture-specific source URLs/checksums, and adjusts noextract entries accordingly. I do not see any new code execution, privilege escalation, persistence, or integrity regressions in the diff itself. The sources remain HTTPS from the official Tor Project archive, and the package still uses checksum verification for the downloaded tarballs. Main risk is limited to the usual trust in upstream binary releases, not introduced by this change.

@@ -75,13 +75,13 @@ sha256sums=('604f5d7cc642d56c919b9d2b7b20a785db4acebf58520f41845347bd81e8ec73'
             '53754c8ff0ea01d8f79d3e725fa3516511faf1e53804c67dc8f573cdb39e35a3'
             'f25ccf68b47f5eb14c6fec0664c74f30ea9c6c58d42fc6abac3b64670aaa3152'
             '7b28b5dbe8ad573bb46e61b4d542b33e01ca240825ca640b4893fee6203b021f')
-sha256sums_i686=("$(_dist_checksum "${_tag_i686}")"
-                 'SKIP')
 sha256sums_x86_64=("$(_dist_checksum "${_tag_x86_64}")"
                    'SKIP')
+sha256sums_aarch64=("$(_dist_checksum "${_tag_aarch64}")"
+                    'SKIP')
 
-noextract=("${_appname}-${_tag_i686}-${pkgver}.tar.xz"
-           "${_appname}-${_tag_x86_64}-${pkgver}.tar.xz")
+noextract=("${_appname}-${_tag_x86_64}-${pkgver}.tar.xz"
+           "${_appname}-${_tag_aarch64}-${pkgver}.tar.xz")
 
 package() {