Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 161.0b2 to 161.0b3. No sources, checksums, install scripts, dependencies, or build logic changed, so there is no new security-relevant behavior introduced by this diff alone. This appears to be a routine package version update.

@@ -1,6 +1,6 @@
 pkgbase = firefox-beta-bin
 	pkgdesc = Standalone web browser from mozilla.org - Beta
-	pkgver = 161.0b2
+	pkgver = 161.0b3
 	pkgrel = 1
 	url = https://www.mozilla.org/en-US/firefox/channel/#beta
 	install = firefox-beta-bin.install

Comment

The change is a straightforward version bump in .SRCINFO from Firefox beta 161.0b2 to 161.0b3, updating the upstream archive URL, provided virtual version, and matching SHA256 for the tarball. No new sources, scripts, install hooks, or build-time execution paths are introduced, and the source remains the official Mozilla archive over HTTPS. Based on the diff shown, this does not add any security-relevant risk beyond the normal trust in the upstream release artifact.

@@ -21,13 +21,13 @@ pkgbase = firefox-beta-bin
 	optdepends = networkmanager: Location detection via available WiFi networks
 	optdepends = pulseaudio: Sound
 	optdepends = upower: Battery API
-	provides = firefox=161.0b2
+	provides = firefox=161.0b3
 	conflicts = firefox-beta
-	source = https://archive.mozilla.org/pub/firefox/releases/161.0b2/linux-x86_64/en-US/firefox-161.0b2.tar.xz
+	source = https://archive.mozilla.org/pub/firefox/releases/161.0b3/linux-x86_64/en-US/firefox-161.0b3.tar.xz
 	source = firefox-beta.sh
 	source = firefox-beta-bin.desktop
 	source = policies.json
-	sha256sums = ae69185f332ba4edf1c44974c8fb241d32f29a9b58d4fcda4937638f007e17dd
+	sha256sums = e33dd300b4134bdcd304f1cc5cce08ce86c65d29f8a2dc29bd54279cbbfd6fe4
 	sha256sums = 4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b
 	sha256sums = 210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761
 	sha256sums = e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c

Comment

The change only bumps pkgver from 161.0b2 to 161.0b3 in PKGBUILD. No build logic, sources, checksums, install scripts, permissions, or package metadata beyond the version string changed. This is a routine upstream version update with no security-relevant behavior introduced in the provided diff.

@@ -3,7 +3,7 @@
 
 pkgname=firefox-beta-bin
 _pkgname=firefox-beta
-pkgver=161.0b2
+pkgver=161.0b3
 _major=${pkgver/rc*}
 _build=${pkgver/*rc}
 pkgrel=1

Comment

The change is a straightforward upstream version bump for the Firefox beta binary package: it updates the Mozilla HTTPS tarball URL from 161.0b2 to 161.0b3 and refreshes the corresponding SHA-256 checksum. No new sources, scripts, build steps, or privilege-related files are introduced, and the package still pulls from the official Mozilla archive over HTTPS. I did not find any security-relevant red flags in this diff hunk.

@@ -22,11 +22,11 @@ optdepends=('ffmpeg: H264/AAC/MP3 decoding'
 provides=("firefox=$pkgver")
 conflicts=('firefox-beta')
 install=$pkgname.install
-source=("https://archive.mozilla.org/pub/firefox/releases/161.0b2/linux-x86_64/en-US/firefox-161.0b2.tar.xz"
+source=("https://archive.mozilla.org/pub/firefox/releases/161.0b3/linux-x86_64/en-US/firefox-161.0b3.tar.xz"
         "$_pkgname.sh"
         "$pkgname.desktop"
         "policies.json")
-sha256sums=('ae69185f332ba4edf1c44974c8fb241d32f29a9b58d4fcda4937638f007e17dd'
+sha256sums=('e33dd300b4134bdcd304f1cc5cce08ce86c65d29f8a2dc29bd54279cbbfd6fe4'
             '4bec62032e49c28ff27750abddbdbdbb1a4b5cba719c39498968fe53adee790b'
             '210f13ea47c4b96387f26ee7fc4dfc5c192cfb169aef2a13303fbd1ee58b3761'
             'e977c3d690224dd727d8761d2c0a66ba41bfd02ae0fd7850c4545d06b5a8e63c')