Review Results

Comment

The change only bumps pkgver in .SRCINFO from 152.0.7928.2 to 152.0.7939.5. No build logic, sources, checksums, install scripts, or packaging metadata beyond the version number changed. On its own this does not introduce a security concern; it simply tracks a newer upstream Chrome Dev release.

@@ -1,6 +1,6 @@
 pkgbase = google-chrome-dev
 	pkgdesc = The popular web browser by Google (Dev Channel)
-	pkgver = 152.0.7928.2
+	pkgver = 152.0.7939.5
 	pkgrel = 1
 	url = https://www.google.com/chrome
 	install = google-chrome-dev.install

Comment

The change only updates the pinned upstream Chrome .deb version in .SRCINFO and refreshes its sha512 checksum. The source remains the official Google HTTPS download URL, with no new build steps, scripts, or packaging logic introduced. I don’t see any added supply-chain, persistence, or privilege-escalation risk in this diff alone.

@@ -21,10 +21,10 @@ pkgbase = google-chrome-dev
 	provides = google-chrome
 	options = !emptydirs
 	options = !strip
-	source = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-unstable/google-chrome-unstable_152.0.7928.2-1_amd64.deb
+	source = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-unstable/google-chrome-unstable_152.0.7939.5-1_amd64.deb
 	source = eula_text.html
 	source = google-chrome-unstable.sh
-	sha512sums = 3b6e102119d99cc91670d4a749ba1c902bca724cc92087ad8c6900282f5b844918f8d4cbad244cf7dbb9cd48d81612ba2189d32caa49ba4ee86460439b0859f3
+	sha512sums = 7d5703d247d8428090af1117a4b1a03665c8ab6c9b8c30510ffe9c7fe224fc731ea1599c7f6922d049e358284ce5c15dbd4568a1bc2857e18f7ad606b4813032
 	sha512sums = a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396
 	sha512sums = 445eb36a588f49af018ded3d852b63e0523ffac20c25be721f3ef4663591256849432bebb3d9f352e4f53cbe1fb77fa67cf8911c9161f826490a21adbdcc81f4
 

Comment

This change is a routine version bump for the Google Chrome Dev AUR package, plus the corresponding SHA-512 checksum update for the upstream .deb. The source remains the official Google download URL over HTTPS, there are no new build steps, no added scripts, and no packaging/persistence changes. I don’t see any security-relevant behavior introduced by this diff.

@@ -7,7 +7,7 @@
 # or use: $ curl -sSf https://dl.google.com/linux/chrome/deb/dists/stable/main/binary-amd64/Packages | grep -A1 "Package: google-chrome-unstable" | awk '/Version/{print $2}' | cut -d '-' -f1
 
 pkgname=google-chrome-dev
-pkgver=152.0.7928.2
+pkgver=152.0.7939.5
 pkgrel=1
 pkgdesc="The popular web browser by Google (Dev Channel)"
 arch=('x86_64')

Comment

Risk is low. The change only bumps pkgver and updates the SHA-512 checksum for the upstream Google Chrome .deb source. The source URL remains HTTPS and still points to the official Google download host, with no new build steps, scripts, privileges, or additional sources introduced. I do not see any supply-chain red flags in this diff alone.

@@ -36,7 +36,7 @@ _channel=unstable
 source=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_amd64.deb"
 	'eula_text.html'
 	"google-chrome-$_channel.sh")
-sha512sums=('3b6e102119d99cc91670d4a749ba1c902bca724cc92087ad8c6900282f5b844918f8d4cbad244cf7dbb9cd48d81612ba2189d32caa49ba4ee86460439b0859f3'
+sha512sums=('7d5703d247d8428090af1117a4b1a03665c8ab6c9b8c30510ffe9c7fe224fc731ea1599c7f6922d049e358284ce5c15dbd4568a1bc2857e18f7ad606b4813032'
             'a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396'
             '445eb36a588f49af018ded3d852b63e0523ffac20c25be721f3ef4663591256849432bebb3d9f352e4f53cbe1fb77fa67cf8911c9161f826490a21adbdcc81f4')