Review Results

Comment

The change only bumps pkgver in .SRCINFO from 579.0.0 to 580.0.0. No source URLs, checksums, build commands, install scripts, or packaging logic are altered in this diff hunk, so there is no direct security impact visible here. This appears to be a routine metadata update.

@@ -1,6 +1,6 @@
 pkgbase = google-cloud-cli
 	pkgdesc = A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
-	pkgver = 579.0.0
+	pkgver = 580.0.0
 	pkgrel = 1
 	url = https://cloud.google.com/cli/
 	arch = x86_64

Comment

The change is a routine version bump in .SRCINFO from google-cloud-cli 579.0.0 to 580.0.0, updating the architecture-specific source tarball URLs and their SHA256 checksums. The sources remain HTTPS on dl.google.com, there are no new build-time commands, no added scripts, and no packaging metadata changes that suggest privilege escalation or persistence. Based on the provided diff alone, this appears low risk.

@@ -17,10 +17,10 @@ pkgbase = google-cloud-cli
 	source = google-cloud-cli.install
 	sha256sums = 6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8
 	sha256sums = 6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6
-	source_x86_64 = google-cloud-cli-579.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_579.0.0.orig_amd64.tar.gz
-	sha256sums_x86_64 = 241431a50402476139f156e4a315f3e3d4b3c5f5de813c3922838796989b28a9
-	source_aarch64 = google-cloud-cli-579.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_579.0.0.orig_aarch64.tar.gz
-	sha256sums_aarch64 = fc04b7a17b7f7acf31426e73430dacc85284a5dc11d800212a46639bf8025157
+	source_x86_64 = google-cloud-cli-580.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_580.0.0.orig_amd64.tar.gz
+	sha256sums_x86_64 = 103beda984642dd6433bea7fab0d19f651e2aaaa742bce0c10e6b6f7767e7231
+	source_aarch64 = google-cloud-cli-580.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_580.0.0.orig_aarch64.tar.gz
+	sha256sums_aarch64 = 4e409a879754de01c9b0fbe24cfe079a530531750df06aceafadda79d4eeca35
 
 pkgname = google-cloud-cli
 	install = google-cloud-cli.install

Comment

This change only bumps pkgver from 579.0.0 to 580.0.0 and updates the corresponding SHA-256 checksums for the upstream release tarballs. The source URLs remain HTTPS and point to Google’s official Cloud SDK download host, with no new build-time commands, scripts, or packaging logic introduced. No additional integrity, persistence, or privilege-escalation concerns are visible in this diff hunk.

@@ -64,7 +64,7 @@ pkgname=(
 #   'google-cloud-cli-component-kubectl'
 #   'google-cloud-cli-component-gsutil'
 # )
-pkgver=579.0.0
+pkgver=580.0.0
 pkgrel=1
 pkgdesc="A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages"
 url="https://cloud.google.com/cli/"

Comment

The change only bumps google-cloud-cli from 579.0.0 to 580.0.0 and updates the expected SHA256 checksums for the architecture-specific upstream tarballs. The source URLs remain HTTPS on dl.google.com, there are no new build-time downloads, scripts, patches, or packaging behavior changes, and no persistence/privilege-related artifacts are introduced. This is a routine version/checksum refresh with no evident security impact.

@@ -86,8 +86,8 @@ source_aarch64=("$pkgbase-$pkgver.orig_aarch64.tar.gz::https://dl.google.com/dl/
 
 sha256sums=('6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8'
             '6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6')
-sha256sums_x86_64=('241431a50402476139f156e4a315f3e3d4b3c5f5de813c3922838796989b28a9')
-sha256sums_aarch64=('fc04b7a17b7f7acf31426e73430dacc85284a5dc11d800212a46639bf8025157')
+sha256sums_x86_64=('103beda984642dd6433bea7fab0d19f651e2aaaa742bce0c10e6b6f7767e7231')
+sha256sums_aarch64=('4e409a879754de01c9b0fbe24cfe079a530531750df06aceafadda79d4eeca35')
 
 prepare() {
   cd "$_extracted_name"