Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 151.0.7922.13 to 152.0.7977.9. No sources, checksums, install scripts, dependencies, or build logic are modified here, so there is no direct security signal in the diff itself. Based on this hunk alone, the change appears low risk.

@@ -1,6 +1,6 @@
 pkgbase = chrome-remote-desktop
 	pkgdesc = Access other computers or allow another user to access your computer securely over the Internet
-	pkgver = 151.0.7922.13
+	pkgver = 152.0.7977.9
 	pkgrel = 1
 	url = https://remotedesktop.google.com
 	install = chrome-remote-desktop.install

Comment

The change only bumps the pinned upstream Chrome Remote Desktop .deb from 151.0.7922.13 to 152.0.7977.9 and updates the corresponding SHA-256. The source remains the official Google dl.google.com HTTPS endpoint, with no new sources, scripts, or packaging logic changes. I don’t see any added build-time execution, persistence, privilege escalation, or integrity red flags in this .SRCINFO-only update.

@@ -25,11 +25,11 @@ pkgbase = chrome-remote-desktop
 	depends = xorg-xrandr
 	options = !debug
 	options = !strip
-	source = chrome-remote-desktop-151.0.7922.13.deb::https://dl.google.com/linux/chrome-remote-desktop/deb/pool/main/c/chrome-remote-desktop/chrome-remote-desktop_151.0.7922.13_amd64.deb
+	source = chrome-remote-desktop-152.0.7977.9.deb::https://dl.google.com/linux/chrome-remote-desktop/deb/pool/main/c/chrome-remote-desktop/chrome-remote-desktop_152.0.7977.9_amd64.deb
 	source = pamrule
 	source = crd
 	source = xdg-base-directory.patch
-	sha256sums = 94e8f7ca4e754d9179a396a8b5d1188252aad70b7a645635b913209b58539a33
+	sha256sums = fc6e10808f589a0475ce20a0038c902701e9e59cfb0ac810a45116f8c057f9e7
 	sha256sums = fcc38269eb1cc902abff9688eda9377a22367e39b9f111f87c0dd8e77adb82e2
 	sha256sums = e4105af96f029a80275986a0b19c7eaf563034230b20ee4d9158e1169d155e6d
 	sha256sums = 90bcfab85a87cfa6d038a55c556206f74b22eb03644ea51f46732cfb27679963

Comment

The change is a routine version bump in PKGBUILD with a corresponding source checksum update. No new sources, build steps, install scripts, privileges, or packaging behaviors were introduced in the diff. Based on the provided hunk alone, there are no security red flags beyond the usual need to trust the upstream release artifact already referenced by the package.

@@ -6,7 +6,7 @@
 # Contributor: Mateus Rodrigues Costa <charles [dot] costar [at] gmail [dot] com>
 
 pkgname=chrome-remote-desktop
-pkgver=151.0.7922.13
+pkgver=152.0.7977.9
 pkgrel=1
 pkgdesc="Access other computers or allow another user to access your computer securely over the Internet"
 arch=("x86_64")

Comment

The change only updates the PKGBUILD to a new upstream version and refreshes the SHA256 for the downloaded Google .deb. No new sources, scripts, or build logic were introduced, and the package still fetches the same official HTTPS upstream artifact from dl.google.com. I do not see any added persistence, privilege escalation, or build-time network behavior beyond the existing latestver() helper. Risk is low because the review scope is just a checksum/version bump, though the package remains a binary-from-upstream package by design.

@@ -21,7 +21,7 @@ source=(
   "crd"
   "xdg-base-directory.patch"
 )
-sha256sums=('94e8f7ca4e754d9179a396a8b5d1188252aad70b7a645635b913209b58539a33'
+sha256sums=('fc6e10808f589a0475ce20a0038c902701e9e59cfb0ac810a45116f8c057f9e7'
             'fcc38269eb1cc902abff9688eda9377a22367e39b9f111f87c0dd8e77adb82e2'
             'e4105af96f029a80275986a0b19c7eaf563034230b20ee4d9158e1169d155e6d'
             '90bcfab85a87cfa6d038a55c556206f74b22eb03644ea51f46732cfb27679963')