Review Results

Comment

The only change in this hunk is a version bump in .SRCINFO from 150.0.7871.46 to 150.0.7871.100. The source remains an HTTPS GitHub release asset from the project’s own repository, with matching provides entries and no new build logic, scripts, or packaging behavior introduced by this diff. I do not see any supply-chain, persistence, privilege, or integrity red flags in the reviewed change itself.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium-bin
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 150.0.7871.46
+	pkgver = 150.0.7871.100
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO: it updates the provided chromium/chromedriver versions and switches the prebuilt package source URL and checksum to the newer upstream GitHub release artifact. The source remains HTTPS and points to the project’s official release repository, with a pinned release filename and matching sha256 checksum. No new build-time execution, install-script behavior, privilege changes, or additional sources are introduced in this diff hunk. Based on the provided change alone, I don’t see a security issue beyond the normal trust inherent in consuming a prebuilt binary package.

@@ -62,11 +62,11 @@ pkgbase = ungoogled-chromium-bin
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=150.0.7871.46
-	provides = chromedriver=150.0.7871.46
+	provides = chromium=150.0.7871.100
+	provides = chromedriver=150.0.7871.100
 	conflicts = chromium
 	conflicts = chromedriver
-	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/150.0.7871.46-1/ungoogled-chromium-150.0.7871.46-1-x86_64.pkg.tar.zst
-	sha256sums = 350e632f7ef9bade38bd90a7901e39862a3ae512e3203edf0c39759de153ff0a
+	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/150.0.7871.100-1/ungoogled-chromium-150.0.7871.100-1-x86_64.pkg.tar.zst
+	sha256sums = 63c21b2661d42df4a817a5d91c78cbf4b850c6076e3fcd2d4ce0bd55903ca4fd
 
 pkgname = ungoogled-chromium-bin

Comment

The only change in this hunk is a pkgver bump from 150.0.7871.46 to 150.0.7871.100. No build logic, sources, checksums, install scripts, or packaging behavior changed. The package still pulls a prebuilt upstream release from HTTPS with a pinned checksum, and there are no new red flags introduced by this version-only update. Risk is therefore minimal.

@@ -1,7 +1,7 @@
 # Maintainer: networkException <git@nwex.de>
 
 pkgname=ungoogled-chromium-bin
-pkgver=150.0.7871.46
+pkgver=150.0.7871.100
 pkgrel=1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')

Comment

The change only updates the SHA-256 checksum for the single upstream release artifact referenced by the PKGBUILD. The source URL remains HTTPS and points to the project’s GitHub release asset, with no new build-time downloads, scripts, or packaging logic changes. I did not find any indication of a supply-chain or privilege-escalation issue in this hunk alone. The main risk is integrity-related only insofar as the new checksum must match the intended upstream binary, but that is expected for a versioned release update.

@@ -54,7 +54,7 @@ optdepends=('pipewire: WebRTC desktop sharing under Wayland'
 provides=("chromium=$pkgver" "chromedriver=$pkgver")
 conflicts=('chromium' 'chromedriver')
 source=(https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/$pkgver-$pkgrel/ungoogled-chromium-$pkgver-$pkgrel-x86_64.pkg.tar.zst)
-sha256sums=('350e632f7ef9bade38bd90a7901e39862a3ae512e3203edf0c39759de153ff0a')
+sha256sums=('63c21b2661d42df4a817a5d91c78cbf4b850c6076e3fcd2d4ce0bd55903ca4fd')
 
 declare -gA _system_libs=(
     [brotli]=brotli