Review Results

Comment

The change is a straightforward version bump in .SRCINFO for google-cloud-cli, updating the package version and the architecture-specific upstream tarball URLs/checksums from 580.0.0 to 581.0.0. The sources remain HTTPS on the official Google Cloud download domain, there are no new scripts, patches, binaries, or build/install logic changes in this diff, and no signs of privilege escalation or persistence mechanisms. Based on the provided hunk alone, this appears low risk.

@@ -1,6 +1,6 @@
 pkgbase = google-cloud-cli
 	pkgdesc = A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
-	pkgver = 580.0.0
+	pkgver = 581.0.0
 	pkgrel = 1
 	url = https://cloud.google.com/cli/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO from 580.0.0 to 581.0.0, updating the architecture-specific Google Cloud CLI tarball URLs and their SHA256 checksums. The sources remain HTTPS on the official dl.google.com domain, and there are no new scripts, build steps, or privilege-related changes in this diff. No security red flags are introduced by this metadata-only update.

@@ -17,10 +17,10 @@ pkgbase = google-cloud-cli
 	source = google-cloud-cli.install
 	sha256sums = 6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8
 	sha256sums = 6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6
-	source_x86_64 = google-cloud-cli-580.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_580.0.0.orig_amd64.tar.gz
-	sha256sums_x86_64 = 103beda984642dd6433bea7fab0d19f651e2aaaa742bce0c10e6b6f7767e7231
-	source_aarch64 = google-cloud-cli-580.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_580.0.0.orig_aarch64.tar.gz
-	sha256sums_aarch64 = 4e409a879754de01c9b0fbe24cfe079a530531750df06aceafadda79d4eeca35
+	source_x86_64 = google-cloud-cli-581.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_581.0.0.orig_amd64.tar.gz
+	sha256sums_x86_64 = 2d4031627b6a509f6e1c8b1c42bcaee0e9c4e32ea0b153e81e1dc85bc77afe54
+	source_aarch64 = google-cloud-cli-581.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_581.0.0.orig_aarch64.tar.gz
+	sha256sums_aarch64 = 3eb0012479ddd99ac55fb485cc1cc89bc68ac3e446b99b17faf83968a413e4a6
 
 pkgname = google-cloud-cli
 	install = google-cloud-cli.install

Comment

The change is a routine version bump for google-cloud-cli from 580.0.0 to 581.0.0, with corresponding updated SHA-256 checksums for the upstream release tarballs. The source URLs remain HTTPS and point to Google’s official download host, and there are no new build-time commands, install-script changes, privilege escalation, or other suspicious packaging behaviors in the reviewed diff hunk. No security issues are evident from this change alone.

@@ -64,7 +64,7 @@ pkgname=(
 #   'google-cloud-cli-component-kubectl'
 #   'google-cloud-cli-component-gsutil'
 # )
-pkgver=580.0.0
+pkgver=581.0.0
 pkgrel=1
 pkgdesc="A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages"
 url="https://cloud.google.com/cli/"

Comment

The change is a routine version bump from 580.0.0 to 581.0.0 with corresponding updated SHA-256 checksums for the upstream Google-hosted tarballs. No new sources, scripts, build steps, or packaging logic were introduced, and the download URLs remain HTTPS and pinned to release artifacts. I do not see any supply-chain or privilege-escalation concerns in this diff.

@@ -86,8 +86,8 @@ source_aarch64=("$pkgbase-$pkgver.orig_aarch64.tar.gz::https://dl.google.com/dl/
 
 sha256sums=('6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8'
             '6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6')
-sha256sums_x86_64=('103beda984642dd6433bea7fab0d19f651e2aaaa742bce0c10e6b6f7767e7231')
-sha256sums_aarch64=('4e409a879754de01c9b0fbe24cfe079a530531750df06aceafadda79d4eeca35')
+sha256sums_x86_64=('2d4031627b6a509f6e1c8b1c42bcaee0e9c4e32ea0b153e81e1dc85bc77afe54')
+sha256sums_aarch64=('3eb0012479ddd99ac55fb485cc1cc89bc68ac3e446b99b17faf83968a413e4a6')
 
 prepare() {
   cd "$_extracted_name"