Review Results

Comment

The change only bumps google-chrome from 150.0.7871.128 to 150.0.7871.181 and updates the corresponding upstream .deb URL and SHA-512 checksum in .SRCINFO. This is a routine version refresh with no new sources, no build-script changes, no install-script changes, and no added execution or persistence mechanisms. Risk is low because the package still fetches from the official Google Chrome download host over HTTPS and the integrity hash was updated accordingly.

@@ -1,6 +1,6 @@
 pkgbase = google-chrome
 	pkgdesc = The popular web browser by Google (Stable Channel)
-	pkgver = 150.0.7871.128
+	pkgver = 150.0.7871.181
 	pkgrel = 1
 	url = https://www.google.com/chrome
 	install = google-chrome.install

Comment

The change is a routine upstream version bump for the Chrome .deb source and its corresponding SHA-512 checksum update. The source remains the official Google HTTPS download URL, with no new build-time code, scripts, or packaging logic introduced in this .SRCINFO-only diff. No integrity or persistence red flags are present in the reviewed hunk.

@@ -20,10 +20,10 @@ pkgbase = google-chrome
 	optdepends = kwallet: for storing passwords in KWallet
 	options = !emptydirs
 	options = !strip
-	source = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_150.0.7871.128-1_amd64.deb
+	source = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_150.0.7871.181-1_amd64.deb
 	source = eula_text.html
 	source = google-chrome-stable.sh
-	sha512sums = 523895aa6c20303d31079367c317ecaff1c7ce075bd36983fca694823125de3ee01f02f98880acbbff25f540b468d1130502aa0e6f80a293bb453890a1c46893
+	sha512sums = 2b42f58b1501bf6e8226fd6098a5e06587f9a388fb89cd936980368ef50294ea18f9a61cd19c04796d71c308e4be46eaddcec1b67332f45eac75fdaf8d81d7cc
 	sha512sums = a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396
 	sha512sums = de02b498a4b5b93e21622c8dba57befe795d733a04656be911cc38e28bfef0e20470450f44be523bbde8d4de28f79c10434846ca01fc2a2f4e67707b79332f94
 

Comment

The change is a straightforward version bump in PKGBUILD from 150.0.7871.128 to 150.0.7871.181 with no accompanying changes to sources, build logic, install scripts, or package metadata. Based on the provided diff, there are no new supply-chain, persistence, privilege, or integrity concerns introduced by this update.

@@ -7,7 +7,7 @@
 # or use: $ curl -sSf https://dl.google.com/linux/chrome/deb/dists/stable/main/binary-amd64/Packages | grep -A1 "Package: google-chrome-stable" | awk '/Version/{print $2}' | cut -d '-' -f1
 
 pkgname=google-chrome
-pkgver=150.0.7871.128
+pkgver=150.0.7871.181
 pkgrel=1
 pkgdesc="The popular web browser by Google (Stable Channel)"
 arch=('x86_64')

Comment

The change only updates the SHA-512 checksum for the upstream Google Chrome .deb source package. The source URL remains HTTPS and points to the official dl.google.com location, and no build/install logic, scripts, or permissions are changed. This is a supply-chain integrity update rather than a behavior change. I don’t see evidence of added network fetches, privilege escalation, persistence, or other malicious packaging behavior in this diff hunk.

@@ -35,7 +35,7 @@ _channel=stable
 source=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_amd64.deb"
 	'eula_text.html'
 	"google-chrome-$_channel.sh")
-sha512sums=('523895aa6c20303d31079367c317ecaff1c7ce075bd36983fca694823125de3ee01f02f98880acbbff25f540b468d1130502aa0e6f80a293bb453890a1c46893'
+sha512sums=('2b42f58b1501bf6e8226fd6098a5e06587f9a388fb89cd936980368ef50294ea18f9a61cd19c04796d71c308e4be46eaddcec1b67332f45eac75fdaf8d81d7cc'
             'a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396'
             'de02b498a4b5b93e21622c8dba57befe795d733a04656be911cc38e28bfef0e20470450f44be523bbde8d4de28f79c10434846ca01fc2a2f4e67707b79332f94')