For the record, in the latest update to Firefox_getLatest.tcz I added "browser" to the tags as requested.
Inspired by
this thread (as apparantly nobody else was), I added support in the
firefox_getLatest.sh script for verifying the OpenPGP signature of the Firefox download to make sure that it was the file released by Mozilla and not one substituted by someone who has hacked into a CDN server or the internet connection.
To do this, you first have to manually save the latest key published on the
Mozilla Blog to "/tmp/mozkey", then run:
gpg --no-default-keyring --keyring ~/DOTgnupg/trustedkeys.kbx --import /tmp/mozkey
(replace "DOT" with a ".", the forum gave me server errors)
The "gpg" command is in the gnupg.tcz extension on x86_64. Just to confuse things, on x86 it's installed by gnupg.tcz as "gpg2", so use that instead of "gpg".
Now the "-g" option to firefox_getLatest.sh should check the signature and show an error if it doesn't match the downloaded file before it's installed.
The key is changed every two years, after which you have to add the new one.