Review Results

Comment

The change only bumps .SRCINFO pkgver from 160.0b5 to 160.0rc1. This is a metadata/version update with no evidence of added code execution, new sources, install scripts, or packaging behavior changes in the provided diff. On its face it does not introduce a security issue.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 160.0b5
+	pkgver = 160.0rc1
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is limited to .SRCINFO metadata and updates the Firefox beta-bin package to a new upstream release candidate. The source remains an HTTPS download from Mozilla infrastructure, with no added scripts, build steps, or nonstandard fetch locations. The checksum is updated accordingly, and there are no signs of privilege escalation, persistence, or other security-relevant behavior in this diff. Minor note: the source filename now uses a custom local name while pointing at a candidate tarball URL, but this is normal packaging metadata and not inherently risky.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=160.0b5
+	provides = firefox=160.0rc1
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/160.0b5/linux-x86_64/en-US/firefox-160.0b5.tar.xz
+	source = firefox-160.0rc1.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/160.0-candidates/build1/linux-x86_64/en-US/firefox-160.0.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = 717d5ef82c85bf4f7543b55081c6698bdd8387c6aedd013330a29c632568574a
+	sha256sums = fde774e9757c8878534c05ec210db592bf6a1b244c57941ffb2e364c04f35fcd
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a straightforward version bump from 160.0b5 to 160.0rc1 with the corresponding upstream archive checksum update. The source remains an HTTPS Mozilla archive URL, there are no new build-time commands, no added scripts, and no packaging/persistence changes. I did not find any security-relevant red flags in this diff.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=160.0b5
+pkgver=160.0rc1
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change only updates the pinned Firefox beta/RC version and its corresponding source checksum in PKGBUILD. I did not see any new build steps, network fetches outside source=(), privilege escalation, install-script changes, or other suspicious packaging behavior in the reviewed hunk. This is a routine version bump with integrity metadata refresh.

@@ -26,7 +26,7 @@ source=("https://archive.mozilla.org/pub/firefox/releases/160.0b5/linux-x86_64/e
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('717d5ef82c85bf4f7543b55081c6698bdd8387c6aedd013330a29c632568574a'
+sha256sums=('fde774e9757c8878534c05ec210db592bf6a1b244c57941ffb2e364c04f35fcd'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')