Review Results

Comment

The change is a routine version bump in .SRCINFO from 578.0.0 to 579.0.0, updating the per-architecture source tarball URLs and their SHA256 checksums. The sources are HTTPS from Google's official dl.google.com endpoint, and there are no new scripts, patches, build commands, or packaging changes introduced in this diff. No integrity or persistence red flags are present in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = google-cloud-cli
 	pkgdesc = A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
-	pkgver = 578.0.0
+	pkgver = 579.0.0
 	pkgrel = 1
 	url = https://cloud.google.com/cli/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the Google Cloud CLI package, updating the x86_64 and aarch64 upstream tarball URLs and their checksums from 578.0.0 to 579.0.0. The sources remain HTTPS on the official dl.google.com domain, there are no new build-time commands, no added scripts, and no packaging/persistence red flags in this diff. Based on the provided hunk alone, this appears low risk.

@@ -17,10 +17,10 @@ pkgbase = google-cloud-cli
 	source = google-cloud-cli.install
 	sha256sums = 6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8
 	sha256sums = 6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6
-	source_x86_64 = google-cloud-cli-578.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_578.0.0.orig_amd64.tar.gz
-	sha256sums_x86_64 = 9c77820f528b7d1538d19e316f46a50476bf8b98e9e0fd1513189c6ce1b03e75
-	source_aarch64 = google-cloud-cli-578.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_578.0.0.orig_aarch64.tar.gz
-	sha256sums_aarch64 = a25ea024d71d981e993db301ca73f8a6aa7abbdc4a4b93148da24deaded91bea
+	source_x86_64 = google-cloud-cli-579.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_579.0.0.orig_amd64.tar.gz
+	sha256sums_x86_64 = 241431a50402476139f156e4a315f3e3d4b3c5f5de813c3922838796989b28a9
+	source_aarch64 = google-cloud-cli-579.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_579.0.0.orig_aarch64.tar.gz
+	sha256sums_aarch64 = fc04b7a17b7f7acf31426e73430dacc85284a5dc11d800212a46639bf8025157
 
 pkgname = google-cloud-cli
 	install = google-cloud-cli.install

Comment

The change only bumps google-cloud-cli from 578.0.0 to 579.0.0 and updates the corresponding SHA-256 checksums for the upstream release tarballs. The source URLs remain HTTPS and point to Google’s official cloud SDK release host, with no new build-time code execution, no added scripts, and no packaging logic changes. I don’t see any integrity or persistence red flags in this diff alone.

@@ -64,7 +64,7 @@ pkgname=(
 #   'google-cloud-cli-component-kubectl'
 #   'google-cloud-cli-component-gsutil'
 # )
-pkgver=578.0.0
+pkgver=579.0.0
 pkgrel=1
 pkgdesc="A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages"
 url="https://cloud.google.com/cli/"

Comment

The change only bumps pkgver from 578.0.0 to 579.0.0 and updates the corresponding SHA-256 checksums for the x86_64 and aarch64 source tarballs. No build logic, install scripts, permissions, network behavior, or package metadata beyond version/checksum pinning changed. This is a routine upstream version update with no evident security red flags in the provided diff.

@@ -86,8 +86,8 @@ source_aarch64=("$pkgbase-$pkgver.orig_aarch64.tar.gz::https://dl.google.com/dl/
 
 sha256sums=('6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8'
             '6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6')
-sha256sums_x86_64=('9c77820f528b7d1538d19e316f46a50476bf8b98e9e0fd1513189c6ce1b03e75')
-sha256sums_aarch64=('a25ea024d71d981e993db301ca73f8a6aa7abbdc4a4b93148da24deaded91bea')
+sha256sums_x86_64=('241431a50402476139f156e4a315f3e3d4b3c5f5de813c3922838796989b28a9')
+sha256sums_aarch64=('fc04b7a17b7f7acf31426e73430dacc85284a5dc11d800212a46639bf8025157')
 
 prepare() {
   cd "$_extracted_name"