Review Results

Comment

The change only adds `aarch64` to `.SRCINFO` for the existing `google-chrome` package metadata. This is a packaging metadata update, not an executable change, and the diff does not introduce new sources, scripts, install actions, or privilege/network behavior. I did not see any security-relevant red flags in this hunk alone.

@@ -5,6 +5,7 @@ pkgbase = google-chrome
 	url = https://www.google.com/chrome
 	install = google-chrome.install
 	arch = x86_64
+	arch = aarch64
 	license = custom:chrome
 	depends = alsa-lib
 	depends = gtk3

Comment

The change is limited to .SRCINFO metadata and does not alter build logic or introduce new execution paths. It moves the Google Chrome .deb source and checksum from the generic source array into architecture-specific entries for x86_64 and aarch64, which is a normal packaging adjustment for a prebuilt upstream binary. The source remains the official Google HTTPS download host, and the checksums are pinned. No suspicious scripts, install hooks, privilege changes, or network-fetching behavior are introduced by this metadata-only change.

@@ -20,11 +21,13 @@ pkgbase = google-chrome
 	optdepends = kwallet: for storing passwords in KWallet
 	options = !emptydirs
 	options = !strip
-	source = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_150.0.7871.186-1_amd64.deb
 	source = eula_text.html
 	source = google-chrome-stable.sh
-	sha512sums = e9305be5b833860d03af4429856974369ba74a9ee18dabefd27a892ecbb454c725f4ef83b2b14330334599143a1098d9e29d18fa89583cfb5b3e49bd0eb737e0
 	sha512sums = a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396
 	sha512sums = de02b498a4b5b93e21622c8dba57befe795d733a04656be911cc38e28bfef0e20470450f44be523bbde8d4de28f79c10434846ca01fc2a2f4e67707b79332f94
+	source_x86_64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_150.0.7871.186-1_amd64.deb
+	sha512sums_x86_64 = e9305be5b833860d03af4429856974369ba74a9ee18dabefd27a892ecbb454c725f4ef83b2b14330334599143a1098d9e29d18fa89583cfb5b3e49bd0eb737e0
+	source_aarch64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_150.0.7871.186-1_arm64.deb
+	sha512sums_aarch64 = d92ecfdbf251c5f490868267e02ab6ce442e5aee261dc05ad29da0a1347eb21fdd59ac52e84e129f22440275b0b3d5271d8ab7fa4f1dd4b7284a4b48f71df3ab
 
 pkgname = google-chrome

Comment

The change only expands the declared architecture list from x86_64 to include aarch64. In the provided hunk there are no source, build, install, or privilege-related changes, and no new network or execution paths are introduced. This is a metadata-only change with low security impact. I did not see evidence in the diff itself of a malicious payload or packaging abuse.

@@ -10,7 +10,10 @@ pkgname=google-chrome
 pkgver=150.0.7871.186
 pkgrel=1
 pkgdesc="The popular web browser by Google (Stable Channel)"
-arch=('x86_64')
+arch=(
+    'x86_64'
+    'aarch64'
+)
 url="https://www.google.com/chrome"
 license=('custom:chrome')
 depends=(

Comment

The change expands the package to aarch64 and moves the Chrome .deb into architecture-specific source arrays. The download URL remains the official Google HTTPS endpoint, and the new arm64 checksum is pinned, so there is no obvious integrity regression or new build-time code execution. The only notable risk is that the package now ships a prebuilt upstream binary for another architecture, but that is expected for a browser package and is still checksum-verified. No suspicious scripts, install-time actions, or privilege changes are introduced in this diff.

@@ -32,13 +35,16 @@ optdepends=(
 options=('!emptydirs' '!strip')
 install=$pkgname.install
 _channel=stable
-source=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_amd64.deb"
-	'eula_text.html'
-	"google-chrome-$_channel.sh")
-sha512sums=('e9305be5b833860d03af4429856974369ba74a9ee18dabefd27a892ecbb454c725f4ef83b2b14330334599143a1098d9e29d18fa89583cfb5b3e49bd0eb737e0'
-            'a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396'
+source=('eula_text.html'
+        "google-chrome-$_channel.sh")
+sha512sums=('a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396'
             'de02b498a4b5b93e21622c8dba57befe795d733a04656be911cc38e28bfef0e20470450f44be523bbde8d4de28f79c10434846ca01fc2a2f4e67707b79332f94')
 
+source_x86_64=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_amd64.deb")
+source_aarch64=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_arm64.deb")
+sha512sums_x86_64=('e9305be5b833860d03af4429856974369ba74a9ee18dabefd27a892ecbb454c725f4ef83b2b14330334599143a1098d9e29d18fa89583cfb5b3e49bd0eb737e0')
+sha512sums_aarch64=('d92ecfdbf251c5f490868267e02ab6ce442e5aee261dc05ad29da0a1347eb21fdd59ac52e84e129f22440275b0b3d5271d8ab7fa4f1dd4b7284a4b48f71df3ab')
+
 package() {
 	bsdtar -xf data.tar.xz -C "$pkgdir/"