Review Results

Comment

The only change in this .SRCINFO diff is a pkgver bump from 150.0.7871.128 to 150.0.7871.181. No sources, checksums, install scripts, build commands, or package metadata affecting execution/persistence were changed in the provided hunk. On its face this is a routine version update with no security red flags visible in the diff reviewed.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium-bin
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 150.0.7871.128
+	pkgver = 150.0.7871.181
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

This change is a straightforward version bump in .SRCINFO for a binary package: pkgver/provides/source/sha256sums are updated to match a newer upstream GitHub release artifact. The source remains on the official upstream GitHub release page over HTTPS, there are no new build-time commands, no install scripts, and no added persistence/privilege mechanisms. I don’t see any supply-chain red flags in the diff itself beyond the inherent trust in the prebuilt upstream binary, which is unchanged by this metadata-only update.

@@ -62,11 +62,11 @@ pkgbase = ungoogled-chromium-bin
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=150.0.7871.128
-	provides = chromedriver=150.0.7871.128
+	provides = chromium=150.0.7871.181
+	provides = chromedriver=150.0.7871.181
 	conflicts = chromium
 	conflicts = chromedriver
-	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/150.0.7871.128-1/ungoogled-chromium-150.0.7871.128-1-x86_64.pkg.tar.zst
-	sha256sums = 1d5d02c177eec2fb253d90a5c96bb2f4b581f5a6a93a36cb2365982d43c75b3a
+	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/150.0.7871.181-1/ungoogled-chromium-150.0.7871.181-1-x86_64.pkg.tar.zst
+	sha256sums = 3c922e1227f33750a97568b5bacad8e545665d94ae0d84e64c1af3e0f6cb3d6b
 
 pkgname = ungoogled-chromium-bin

Comment

The change is a straightforward version bump for a prebuilt binary package, with the source URL still pinned to an HTTPS GitHub release asset and the checksum updated accordingly. No new build steps, scripts, patches, privilege changes, or additional sources were introduced in this diff. The main residual risk is the inherent trust in a binary release package, but this specific change does not add new security concerns beyond that baseline.

@@ -1,7 +1,7 @@
 # Maintainer: networkException <git@nwex.de>
 
 pkgname=ungoogled-chromium-bin
-pkgver=150.0.7871.128
+pkgver=150.0.7871.181
 pkgrel=1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')

Comment

Low risk change. The PKGBUILD only updates pkgver and the checksum for a prebuilt release artifact fetched over HTTPS from the project’s GitHub releases page. There are no new build steps, scripts, patches, or privilege-related changes, and the source remains pinned to a specific release asset rather than a floating branch. The main security property here is integrity of the downloaded binary package, which is preserved by the updated sha256sum.

@@ -54,7 +54,7 @@ optdepends=('pipewire: WebRTC desktop sharing under Wayland'
 provides=("chromium=$pkgver" "chromedriver=$pkgver")
 conflicts=('chromium' 'chromedriver')
 source=(https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/$pkgver-$pkgrel/ungoogled-chromium-$pkgver-$pkgrel-x86_64.pkg.tar.zst)
-sha256sums=('1d5d02c177eec2fb253d90a5c96bb2f4b581f5a6a93a36cb2365982d43c75b3a')
+sha256sums=('3c922e1227f33750a97568b5bacad8e545665d94ae0d84e64c1af3e0f6cb3d6b')
 
 declare -gA _system_libs=(
     [brotli]=brotli