Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 152.0.4_1 to 152.0.5_1 with no accompanying changes to sources, checksums, install scripts, or packaging logic in the provided diff hunk. By itself this does not introduce any new attack surface or integrity concern. I did not see evidence in the reviewed hunk of suspicious URLs, build-time downloads, privilege escalation, or persistence mechanisms.

@@ -1,6 +1,6 @@
 pkgbase = librewolf-bin
 	pkgdesc = Community-maintained fork of Firefox, focused on privacy, security and freedom.
-	pkgver = 152.0.4_1
+	pkgver = 152.0.5_1
 	pkgrel = 1
 	epoch = 1
 	url = https://librewolf.net/

Comment

This is a routine version bump in .SRCINFO from 152.0.4-1 to 152.0.5-1, with corresponding source URLs and checksums updated. The sources remain HTTPS and pinned to a tag, and there are no new build-time commands, install scripts, or packaging policy changes in the diff hunk. No obvious supply-chain or privilege-escalation risk is introduced by this metadata-only update.

@@ -52,20 +52,20 @@ pkgbase = librewolf-bin
 	options = !emptydirs
 	backup = usr/lib/librewolf/librewolf.cfg
 	backup = usr/lib/librewolf/distribution/policies.json
-	source = git+https://codeberg.org/librewolf/source.git#tag=152.0.4-1
+	source = git+https://codeberg.org/librewolf/source.git#tag=152.0.5-1
 	source = default192x192.png
 	source = librewolf.desktop
 	validpgpkeys = 662E3CDD6FE329002D0CA5BB40339DD82B12EF16
-	sha256sums = 681fdcc942bcd73f3590980e5685b6943d3cbcac879ce2dbc9928890ce0b79f4
+	sha256sums = 2f66d548e7ea777b69ce1bccd95247f82fc41ce41ed49fd61d63b428c5049c5d
 	sha256sums = 959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1
 	sha256sums = 3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae
-	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.4-1/librewolf-152.0.4-1-linux-x86_64-package.tar.xz
-	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.4-1/librewolf-152.0.4-1-linux-x86_64-package.tar.xz.sig
-	sha256sums_x86_64 = e2f9acbfddc436db5e135f2e18917664485a440de718983ffd66187414442228
+	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.5-1/librewolf-152.0.5-1-linux-x86_64-package.tar.xz
+	source_x86_64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.5-1/librewolf-152.0.5-1-linux-x86_64-package.tar.xz.sig
+	sha256sums_x86_64 = f58d27dd41d12bd5a02a128520c07708b9a1d46a79687a0888ac6528d29ee607
 	sha256sums_x86_64 = SKIP
-	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.4-1/librewolf-152.0.4-1-linux-arm64-package.tar.xz
-	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.4-1/librewolf-152.0.4-1-linux-arm64-package.tar.xz.sig
-	sha256sums_aarch64 = 435bd3ffda8eb36022311b0b7287c5ec5d98fb9409265a08fd049567003d802f
+	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.5-1/librewolf-152.0.5-1-linux-arm64-package.tar.xz
+	source_aarch64 = https://codeberg.org/api/packages/librewolf/generic/librewolf/152.0.5-1/librewolf-152.0.5-1-linux-arm64-package.tar.xz.sig
+	sha256sums_aarch64 = c7dbd45da12d8e763afa638b6cb897981af973b66611845324af5f0c8a5f815b
 	sha256sums_aarch64 = SKIP
 
 pkgname = librewolf-bin

Comment

The change is a straightforward version bump in PKGBUILD from 152.0.4_1 to 152.0.5_1. No new sources, build steps, install scripts, permissions, or packaging behavior are introduced by this hunk. Based on the provided diff alone, there are no security-relevant red flags.

@@ -4,7 +4,7 @@ pkgname=librewolf-bin
 provides=(${pkgname//-bin/""})
 conflicts=(${pkgname//-bin/""})
 epoch=1
-pkgver=152.0.4_1
+pkgver=152.0.5_1
 _fixedfirefoxver="${pkgver%_*}" # Version of Firefox this LibreWolf version is based on, but the Firefox patch number is always included
 _librewolfver="${pkgver#*_}"
 _firefoxver="${_fixedfirefoxver%.0}" # Removes ".0" from the end. For "136.0.0" this will result in "136.0" but for "136.0.1" won't do anything.

Comment

The change only updates SHA-256 checksums for the existing source artifacts in PKGBUILD. No new sources, URLs, build steps, install scripts, or packaging logic are introduced by this hunk. On its face this is a routine integrity hash refresh, with no direct security red flags in the diff itself. The only residual concern is that the actual referenced artifacts are not visible in this hunk, but based on the provided change alone there is no evidence of malicious behavior.

@@ -76,12 +76,12 @@ source=(
 )
 source_aarch64=("${_uploadpath_aarch64}" "${_uploadpath_sig_aarch64}")
 source_x86_64=("${_uploadpath_x86_64}" "${_uploadpath_sig_x86_64}")
-sha256sums=('681fdcc942bcd73f3590980e5685b6943d3cbcac879ce2dbc9928890ce0b79f4'
+sha256sums=('2f66d548e7ea777b69ce1bccd95247f82fc41ce41ed49fd61d63b428c5049c5d'
             '959c94c68cab8d5a8cff185ddf4dca92e84c18dccc6dc7c8fe11c78549cdc2f1'
             '3d6ac59ae9d5ba4c9fe15f95c1338fa68214dec6119f8432336403e3be50f8ae')
-sha256sums_x86_64=('e2f9acbfddc436db5e135f2e18917664485a440de718983ffd66187414442228'
+sha256sums_x86_64=('f58d27dd41d12bd5a02a128520c07708b9a1d46a79687a0888ac6528d29ee607'
                    'SKIP')
-sha256sums_aarch64=('435bd3ffda8eb36022311b0b7287c5ec5d98fb9409265a08fd049567003d802f'
+sha256sums_aarch64=('c7dbd45da12d8e763afa638b6cb897981af973b66611845324af5f0c8a5f815b'
                     'SKIP')
 
 package() {