Review Results

Comment

The change only bumps pkgver in .SRCINFO from 152.0.4_1 to 152.0.5_1. No build logic, sources, checksums, install scripts, or permissions are affected by this diff hunk. On its face this is a routine version update with no security red flags in the provided change.

@@ -1,6 +1,6 @@
 pkgbase = librewolf
 	pkgdesc = Community-maintained fork of Firefox, focused on privacy, security and freedom.
-	pkgver = 152.0.4_1
+	pkgver = 152.0.5_1
 	pkgrel = 1
 	epoch = 1
 	url = https://librewolf.net/

Comment

The change only bumps the upstream LibreWolf source tarball from 152.0.4-1 to 152.0.5-1 and updates the corresponding SHA-256 checksum in .SRCINFO. The source remains on the official Codeberg package endpoint over HTTPS, and the existing PGP verification key is unchanged. No new sources, scripts, build steps, or packaging behavior are introduced by this diff hunk. Based on the provided change alone, this is low risk.

@@ -73,12 +73,12 @@ pkgbase = librewolf
 	options = !makeflags
 	backup = usr/lib/librewolf/librewolf.cfg
 	backup = usr/lib/librewolf/distribution/policies.json
-	source = https://codeberg.org/api/packages/librewolf/generic/librewolf-source/152.0.4-1/librewolf-152.0.4-1.source.tar.gz
-	source = https://codeberg.org/api/packages/librewolf/generic/librewolf-source/152.0.4-1/librewolf-152.0.4-1.source.tar.gz.sig
+	source = https://codeberg.org/api/packages/librewolf/generic/librewolf-source/152.0.5-1/librewolf-152.0.5-1.source.tar.gz
+	source = https://codeberg.org/api/packages/librewolf/generic/librewolf-source/152.0.5-1/librewolf-152.0.5-1.source.tar.gz.sig
 	source = librewolf.desktop
 	source = default192x192.png
 	validpgpkeys = 662E3CDD6FE329002D0CA5BB40339DD82B12EF16
-	sha256sums = fa21c6183109971401eea879b706281064228c9d72dddcbb8103d8da756862bd
+	sha256sums = ad6f5fabd4279e5d52dd77e0e2ee5d36c0346b260db6001486cea9e4d565da01
 	sha256sums = SKIP
 	sha256sums = 3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae
 	sha256sums = 959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1

Comment

The change is a simple version bump in PKGBUILD from 152.0.4_1 to 152.0.5_1. No build logic, sources, checksums, install scripts, permissions, or package metadata beyond the version string were altered in the provided hunk. Based on this diff alone, there is no evidence of supply-chain risk or malicious behavior.

@@ -7,7 +7,7 @@
 pkgname=librewolf
 _pkgname=LibreWolf
 epoch=1
-pkgver=152.0.4_1
+pkgver=152.0.5_1
 _fixedfirefoxver="${pkgver%_*}" # Version of Firefox this LibreWolf version is based on, but the Firefox patch number is always included
 _librewolfver="${pkgver#*_}"
 _firefoxver="${_fixedfirefoxver%.0}" # Removes ".0" from the end. For "136.0.0" this will result in "136.0" but for "136.0.1" won't do anything.

Comment

The only change in this hunk is an updated SHA-256 checksum for an existing declared source file. There is no evidence here of new code execution, network access, privilege escalation, or packaging behavior changes. Since the review is limited to this checksum update and the surrounding PKGBUILD context is unchanged, I do not see a security issue in this diff alone.

@@ -111,7 +111,7 @@ source=(
   "default192x192.png"
 )
 
-sha256sums=('fa21c6183109971401eea879b706281064228c9d72dddcbb8103d8da756862bd'
+sha256sums=('ad6f5fabd4279e5d52dd77e0e2ee5d36c0346b260db6001486cea9e4d565da01'
             'SKIP'
             '3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae'
             '959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1')