Review Results

Comment

The change only bumps pkgver in .SRCINFO from 150.0.7871.19 to 151.0.7922.13. No source URLs, checksums, install scripts, build commands, or packaging logic are changed in the provided hunk, so there is no direct security signal here. The risk is low because .SRCINFO is metadata only; however, I cannot verify the corresponding PKGBUILD/source integrity from this diff alone.

@@ -1,6 +1,6 @@
 pkgbase = chrome-remote-desktop
 	pkgdesc = Access other computers or allow another user to access your computer securely over the Internet
-	pkgver = 150.0.7871.19
+	pkgver = 151.0.7922.13
 	pkgrel = 1
 	url = https://remotedesktop.google.com
 	install = chrome-remote-desktop.install

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Google-hosted chrome-remote-desktop .deb, with the corresponding checksum updated. The source remains HTTPS on the official dl.google.com domain, and there are no new sources, scripts, or packaging behaviors introduced in this diff hunk. Based on this hunk alone, I do not see a supply-chain or privilege-escalation concern.

@@ -25,11 +25,11 @@ pkgbase = chrome-remote-desktop
 	depends = xorg-xrandr
 	options = !debug
 	options = !strip
-	source = chrome-remote-desktop-150.0.7871.19.deb::https://dl.google.com/linux/chrome-remote-desktop/deb/pool/main/c/chrome-remote-desktop/chrome-remote-desktop_150.0.7871.19_amd64.deb
+	source = chrome-remote-desktop-151.0.7922.13.deb::https://dl.google.com/linux/chrome-remote-desktop/deb/pool/main/c/chrome-remote-desktop/chrome-remote-desktop_151.0.7922.13_amd64.deb
 	source = pamrule
 	source = crd
 	source = xdg-base-directory.patch
-	sha256sums = eb8ef7af8e6bf37688ced8d2527574fb243a45c85f8ecea31b6a5cb7a7c34fed
+	sha256sums = 94e8f7ca4e754d9179a396a8b5d1188252aad70b7a645635b913209b58539a33
 	sha256sums = fcc38269eb1cc902abff9688eda9377a22367e39b9f111f87c0dd8e77adb82e2
 	sha256sums = e4105af96f029a80275986a0b19c7eaf563034230b20ee4d9158e1169d155e6d
 	sha256sums = 90bcfab85a87cfa6d038a55c556206f74b22eb03644ea51f46732cfb27679963

Comment

The only change in this diff is a pkgver bump from 150.0.7871.19 to 151.0.7922.13. No build logic, sources, checksums, install script, or packaging behavior changed in the reviewed hunk. On its face this is a routine version update with no direct security impact in the PKGBUILD diff itself. I did note the package already fetches a prebuilt .deb from Google and uses !debug/!strip, but those concerns pre-exist this change and are outside the provided hunk.

@@ -6,7 +6,7 @@
 # Contributor: Mateus Rodrigues Costa <charles [dot] costar [at] gmail [dot] com>
 
 pkgname=chrome-remote-desktop
-pkgver=150.0.7871.19
+pkgver=151.0.7922.13
 pkgrel=1
 pkgdesc="Access other computers or allow another user to access your computer securely over the Internet"
 arch=("x86_64")

Comment

The only change in this hunk is an updated SHA-256 checksum for the upstream .deb source. That is a normal integrity update and does not introduce new code execution, network behavior, privilege changes, or packaging logic. I did not see any evidence in this diff of a malicious source swap or other supply-chain red flag; the source URL remains the official Google dl.google.com endpoint and the package still pins a specific versioned .deb. Risk is therefore minimal for this change alone.

@@ -21,7 +21,7 @@ source=(
   "crd"
   "xdg-base-directory.patch"
 )
-sha256sums=('eb8ef7af8e6bf37688ced8d2527574fb243a45c85f8ecea31b6a5cb7a7c34fed'
+sha256sums=('94e8f7ca4e754d9179a396a8b5d1188252aad70b7a645635b913209b58539a33'
             'fcc38269eb1cc902abff9688eda9377a22367e39b9f111f87c0dd8e77adb82e2'
             'e4105af96f029a80275986a0b19c7eaf563034230b20ee4d9158e1169d155e6d'
             '90bcfab85a87cfa6d038a55c556206f74b22eb03644ea51f46732cfb27679963')