Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 160.0rc1 to 161.0b2. No sources, checksums, build steps, install scripts, permissions, or package metadata affecting trust boundaries were modified in the reviewed diff. On its face this is a routine upstream version update with no security red flags in the provided change.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 160.0rc1
+	pkgver = 161.0b2
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a routine version/source update in .SRCINFO: it moves firefox-beta-bin from 160.0rc1 to 161.0b2, switches the upstream tarball URL from ftp.mozilla.org candidate build to archive.mozilla.org release tarball, and updates the corresponding checksum. The source remains HTTPS, points to Mozilla’s official archive, and there are no new scripts, build steps, or packaging behaviors introduced by this diff. No security red flags are evident in the provided hunk.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=160.0rc1
+	provides = firefox=161.0b2
 	conflicts = firefox-beta
-	source = firefox-160.0rc1.tar.xz::https://ftp.mozilla.org/pub/firefox/candidates/160.0-candidates/build1/linux-x86_64/en-US/firefox-160.0.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/161.0b2/linux-x86_64/en-US/firefox-161.0b2.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = fde774e9757c8878534c05ec210db592bf6a1b244c57941ffb2e364c04f35fcd
+	sha256sums = ae69185f332ba4edf1c44974c8fb241d32f29a9b58d4fcda4937638f007e17dd
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change is a straightforward version bump in PKGBUILD from Firefox beta 160.0rc1/160.0b5 to 161.0b2, with the source URL and checksum updated accordingly. The source remains an HTTPS Mozilla archive tarball, there are no new build-time network fetches, scripts, or privilege-related changes, and no packaging logic was altered beyond the versioned download. No security red flags are introduced by this diff alone.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=160.0rc1
+pkgver=161.0b2
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a routine upstream version bump for the Firefox beta binary tarball, with the source remaining on Mozilla’s official HTTPS archive and the checksum updated accordingly. No new build-time code, scripts, patches, or packaging logic were introduced, and the existing auxiliary files are unchanged by this diff. I don’t see any integrity or execution red flags in this hunk alone.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/160.0b5/linux-x86_64/en-US/firefox-160.0b5.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/161.0b2/linux-x86_64/en-US/firefox-161.0b2.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('fde774e9757c8878534c05ec210db592bf6a1b244c57941ffb2e364c04f35fcd'
+sha256sums=('ae69185f332ba4edf1c44974c8fb241d32f29a9b58d4fcda4937638f007e17dd'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')