Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 160.0b4 to 160.0b5. This is a routine metadata update with no evidence of altered sources, build logic, install scripts, permissions, or other security-relevant behavior. Based on the provided diff alone, there are no red flags.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 160.0b4
+	pkgver = 160.0b5
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

Low risk. The change is a routine version bump in .SRCINFO from Firefox beta 160.0b4 to 160.0b5, updating the upstream archive URL, checksum, and provided virtual package version accordingly. The source remains the official Mozilla archive over HTTPS, with no new build-time code, scripts, or privilege-related artifacts introduced by this diff.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=160.0b4
+	provides = firefox=160.0b5
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/160.0b4/linux-x86_64/en-US/firefox-160.0b4.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/160.0b5/linux-x86_64/en-US/firefox-160.0b5.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 902ee5a6e80c44e11fb130e7bba82773ba2e47a5d4eae3b3642603b40d2f3a08
+	sha256sums = 717d5ef82c85bf4f7543b55081c6698bdd8387c6aedd013330a29c632568574a
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a simple version bump in PKGBUILD from firefox-beta 160.0b4 to 160.0b5 with no other modifications to sources, build steps, install scripts, or package metadata. There are no new integrity, execution, or persistence concerns introduced by this diff alone.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=160.0b4
+pkgver=160.0b5
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward upstream version bump for the Firefox beta binary package: it updates the official Mozilla HTTPS tarball URL from 160.0b4 to 160.0b5 and refreshes the corresponding SHA-256 checksum. No new sources, scripts, build steps, or privilege-related packaging logic were introduced in this hunk. I do not see any supply-chain or persistence red flags in the diff provided.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/160.0b4/linux-x86_64/en-US/firefox-160.0b4.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/160.0b5/linux-x86_64/en-US/firefox-160.0b5.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('902ee5a6e80c44e11fb130e7bba82773ba2e47a5d4eae3b3642603b40d2f3a08'
+sha256sums=('717d5ef82c85bf4f7543b55081c6698bdd8387c6aedd013330a29c632568574a'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')