Review Results

Comment

The change only adds `aarch64` to `.SRCINFO` for an existing `google-chrome-dev` package. This is a metadata-only update and does not alter sources, build steps, install scripts, permissions, or runtime behavior. I see no security-relevant red flags in this diff hunk by itself.

@@ -5,6 +5,7 @@ pkgbase = google-chrome-dev
 	url = https://www.google.com/chrome
 	install = google-chrome-dev.install
 	arch = x86_64
+	arch = aarch64
 	license = custom:chrome
 	depends = alsa-lib
 	depends = gtk3

Comment

The change only updates .SRCINFO to split the Chrome .deb source and checksum by architecture (x86_64 and aarch64) while keeping the same official HTTPS dl.google.com source. There are no new build steps, scripts, privilege changes, or suspicious external hosts introduced in this diff. This looks like a metadata-only packaging update with low security risk.

@@ -21,11 +22,13 @@ pkgbase = google-chrome-dev
 	provides = google-chrome
 	options = !emptydirs
 	options = !strip
-	source = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-unstable/google-chrome-unstable_152.0.7967.2-1_amd64.deb
 	source = eula_text.html
 	source = google-chrome-unstable.sh
-	sha512sums = 7db4f8ca8614dde9cd7bf13f81f4eb3f0241a3ffa6463de97c7150f2ccaed7541bea1872ec374cdd59d17dfe86e8827c7a80812ec7a435739f660754c8f45251
 	sha512sums = a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396
 	sha512sums = 445eb36a588f49af018ded3d852b63e0523ffac20c25be721f3ef4663591256849432bebb3d9f352e4f53cbe1fb77fa67cf8911c9161f826490a21adbdcc81f4
+	source_x86_64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-unstable/google-chrome-unstable_152.0.7967.2-1_amd64.deb
+	sha512sums_x86_64 = 7db4f8ca8614dde9cd7bf13f81f4eb3f0241a3ffa6463de97c7150f2ccaed7541bea1872ec374cdd59d17dfe86e8827c7a80812ec7a435739f660754c8f45251
+	source_aarch64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-unstable/google-chrome-unstable_152.0.7967.2-1_arm64.deb
+	sha512sums_aarch64 = 9549ba1e9bf5b61d22bb8bbe972ca4d9a891a95bc182c28f0374ccb27cb663c9d652c24df6a2144f65b455e17103e3a52431be4b4735a0db2020b5b50d6d326f
 
 pkgname = google-chrome-dev

Comment

The change only expands the package architecture list from x86_64 to aarch64 in PKGBUILD. This is a metadata-only change with no impact on build commands, sources, checksums, install scripts, or runtime behavior. I did not see any new integrity, persistence, privilege, or network-related risk introduced by this diff hunk.

@@ -10,7 +10,10 @@ pkgname=google-chrome-dev
 pkgver=152.0.7967.2
 pkgrel=1
 pkgdesc="The popular web browser by Google (Dev Channel)"
-arch=('x86_64')
+arch=(
+    'x86_64'
+    'aarch64'
+)
 url="https://www.google.com/chrome"
 license=('custom:chrome')
 depends=(

Comment

The change is low risk. It only adds aarch64 support by introducing an additional Google-hosted .deb source and corresponding checksum, while keeping HTTPS and pinned versioned URLs. The existing x86_64 source remains integrity-checked via sha512, and no build-time code execution, install-script changes, privilege escalation, or suspicious extra sources were introduced in this hunk. The only notable concern is that the package still relies on a prebuilt upstream binary, but that was already true before this change and is not worsened here.

@@ -33,12 +36,17 @@ provides=('google-chrome')
 options=('!emptydirs' '!strip')
 install=$pkgname.install
 _channel=unstable
-source=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_amd64.deb"
-	'eula_text.html'
-	"google-chrome-$_channel.sh")
-sha512sums=('7db4f8ca8614dde9cd7bf13f81f4eb3f0241a3ffa6463de97c7150f2ccaed7541bea1872ec374cdd59d17dfe86e8827c7a80812ec7a435739f660754c8f45251'
-            'a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396'
+source=(
+    'eula_text.html'
+    "google-chrome-$_channel.sh"
+)
+sha512sums=('a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396'
             '445eb36a588f49af018ded3d852b63e0523ffac20c25be721f3ef4663591256849432bebb3d9f352e4f53cbe1fb77fa67cf8911c9161f826490a21adbdcc81f4')
+sha512sums_x86_64=('7db4f8ca8614dde9cd7bf13f81f4eb3f0241a3ffa6463de97c7150f2ccaed7541bea1872ec374cdd59d17dfe86e8827c7a80812ec7a435739f660754c8f45251')
+sha512sums_aarch64=('9549ba1e9bf5b61d22bb8bbe972ca4d9a891a95bc182c28f0374ccb27cb663c9d652c24df6a2144f65b455e17103e3a52431be4b4735a0db2020b5b50d6d326f')
+
+source_x86_64=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_amd64.deb")
+source_aarch64=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_arm64.deb")
 
 package() {
 	bsdtar -xf data.tar.xz -C "$pkgdir/"