Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 577.0.0 to 578.0.0. No sources, checksums, install scripts, build commands, permissions, or dependency metadata changed here, so there is no new security signal in the diff itself. This appears to be a routine package update with no evident risk from the provided change.

@@ -1,6 +1,6 @@
 pkgbase = google-cloud-cli
 	pkgdesc = A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
-	pkgver = 577.0.0
+	pkgver = 578.0.0
 	pkgrel = 1
 	url = https://cloud.google.com/cli/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the Google Cloud CLI package, updating the x86_64 and aarch64 upstream tarball URLs and their SHA256 checksums. The sources remain on HTTPS from the official Google download domain, and there are no new build steps, scripts, or privilege-related changes in this diff. No security concerns are evident from this metadata-only update.

@@ -17,10 +17,10 @@ pkgbase = google-cloud-cli
 	source = google-cloud-cli.install
 	sha256sums = 6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8
 	sha256sums = 6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6
-	source_x86_64 = google-cloud-cli-577.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_577.0.0.orig_amd64.tar.gz
-	sha256sums_x86_64 = 5900ae2261409554e680157077b3097667d2fe0098981c2c98d011924678281d
-	source_aarch64 = google-cloud-cli-577.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_577.0.0.orig_aarch64.tar.gz
-	sha256sums_aarch64 = 6c37f4268a1ae495bfcce39e1637869271d914224a0084e4246da66f24d14d1c
+	source_x86_64 = google-cloud-cli-578.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_578.0.0.orig_amd64.tar.gz
+	sha256sums_x86_64 = 9c77820f528b7d1538d19e316f46a50476bf8b98e9e0fd1513189c6ce1b03e75
+	source_aarch64 = google-cloud-cli-578.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_578.0.0.orig_aarch64.tar.gz
+	sha256sums_aarch64 = a25ea024d71d981e993db301ca73f8a6aa7abbdc4a4b93148da24deaded91bea
 
 pkgname = google-cloud-cli
 	install = google-cloud-cli.install

Comment

The change is a routine version bump from 577.0.0 to 578.0.0 with corresponding checksum updates for the upstream tarballs. The source URLs remain HTTPS and point to Google’s official release host, and there are no new build steps, scripts, or packaging logic changes that would introduce code execution, persistence, or integrity risks. Based on the provided diff, this looks like a normal upstream update with no security red flags.

@@ -64,7 +64,7 @@ pkgname=(
 #   'google-cloud-cli-component-kubectl'
 #   'google-cloud-cli-component-gsutil'
 # )
-pkgver=577.0.0
+pkgver=578.0.0
 pkgrel=1
 pkgdesc="A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages"
 url="https://cloud.google.com/cli/"

Comment

Risk is low. The change only updates pkgver and the expected SHA-256 checksums for the upstream tarballs; there are no new sources, no build logic changes, no added scripts, and no privilege/network/persistence behavior introduced. The package still fetches from the official Google download host over HTTPS, and the modified hashes simply track the new release artifacts.

@@ -86,8 +86,8 @@ source_aarch64=("$pkgbase-$pkgver.orig_aarch64.tar.gz::https://dl.google.com/dl/
 
 sha256sums=('6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8'
             '6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6')
-sha256sums_x86_64=('5900ae2261409554e680157077b3097667d2fe0098981c2c98d011924678281d')
-sha256sums_aarch64=('6c37f4268a1ae495bfcce39e1637869271d914224a0084e4246da66f24d14d1c')
+sha256sums_x86_64=('9c77820f528b7d1538d19e316f46a50476bf8b98e9e0fd1513189c6ce1b03e75')
+sha256sums_aarch64=('a25ea024d71d981e993db301ca73f8a6aa7abbdc4a4b93148da24deaded91bea')
 
 prepare() {
   cd "$_extracted_name"