Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 575.0.0 to 576.0.0. No sources, checksums, build steps, install scripts, permissions, or dependency metadata changed in the provided diff, so there is no new security concern visible here. This looks like a routine upstream version update.

@@ -1,6 +1,6 @@
 pkgbase = google-cloud-cli
 	pkgdesc = A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
-	pkgver = 575.0.0
+	pkgver = 576.0.0
 	pkgrel = 1
 	url = https://cloud.google.com/cli/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the architecture-specific upstream tarballs from 575.0.0 to 576.0.0, with corresponding checksum updates. The sources remain HTTPS on the official Google download host, there are no new build-time execution paths, no added scripts, and no packaging-policy red flags visible in this diff. Based on the provided hunk alone, this appears low risk.

@@ -17,10 +17,10 @@ pkgbase = google-cloud-cli
 	source = google-cloud-cli.install
 	sha256sums = 6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8
 	sha256sums = 6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6
-	source_x86_64 = google-cloud-cli-575.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_575.0.0.orig_amd64.tar.gz
-	sha256sums_x86_64 = 8d27289a193f61db2f1aeed414e78abc35169c2becd1efde80a500d2c3f29faf
-	source_aarch64 = google-cloud-cli-575.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_575.0.0.orig_aarch64.tar.gz
-	sha256sums_aarch64 = 36b5dbce6a2c2343a191596ba004fcaeb638e16836d925f0d619724c06cc4ea7
+	source_x86_64 = google-cloud-cli-576.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_576.0.0.orig_amd64.tar.gz
+	sha256sums_x86_64 = 6df742218da79abb10551a883ae2ff0ab756681e2abbf71377236a55b8aaa94d
+	source_aarch64 = google-cloud-cli-576.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_576.0.0.orig_aarch64.tar.gz
+	sha256sums_aarch64 = dd60572ab45e8b0ae80b51fe6c6825319d6ca0c6617e2c196cd7a75c9e9f84f8
 
 pkgname = google-cloud-cli
 	install = google-cloud-cli.install

Comment

The change is a routine version bump from 575.0.0 to 576.0.0 with updated SHA-256 checksums for the upstream tarballs. The source URLs remain HTTPS on Google’s official download host, there are no new build steps, no added scripts, and no packaging behavior changes. Based on the provided diff, this does not introduce an obvious supply-chain or privilege-escalation risk.

@@ -64,7 +64,7 @@ pkgname=(
 #   'google-cloud-cli-component-kubectl'
 #   'google-cloud-cli-component-gsutil'
 # )
-pkgver=575.0.0
+pkgver=576.0.0
 pkgrel=1
 pkgdesc="A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages"
 url="https://cloud.google.com/cli/"

Comment

The change only bumps google-cloud-cli from 575.0.0 to 576.0.0 and updates the expected SHA-256 checksums for the architecture-specific upstream tarballs. The source URLs remain on HTTPS at dl.google.com, there are no new build-time downloads, scripts, patches, or packaging logic changes, and no new privilege/persistence concerns are introduced. Based on the diff shown, this is a routine version/checksum refresh with low security risk.

@@ -86,8 +86,8 @@ source_aarch64=("$pkgbase-$pkgver.orig_aarch64.tar.gz::https://dl.google.com/dl/
 
 sha256sums=('6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8'
             '6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6')
-sha256sums_x86_64=('8d27289a193f61db2f1aeed414e78abc35169c2becd1efde80a500d2c3f29faf')
-sha256sums_aarch64=('36b5dbce6a2c2343a191596ba004fcaeb638e16836d925f0d619724c06cc4ea7')
+sha256sums_x86_64=('6df742218da79abb10551a883ae2ff0ab756681e2abbf71377236a55b8aaa94d')
+sha256sums_aarch64=('dd60572ab45e8b0ae80b51fe6c6825319d6ca0c6617e2c196cd7a75c9e9f84f8')
 
 prepare() {
   cd "$_extracted_name"