Review Results

Comment

The change only bumps pkgver in .SRCINFO from 151.0.7922.137 to 151.0.7922.169. No sources, checksums, build steps, install scripts, or packaging metadata affecting execution/persistence were modified in the provided diff. On its face this is a routine version update with no security red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 151.0.7922.137
+	pkgver = 151.0.7922.169
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The .SRCINFO change only adds build-time makedepends: python-httplib2, python-pyparsing, python-six, npm, and rsync. By itself this does not introduce runtime code, persistence, privilege escalation, or any direct execution path. Since .SRCINFO is metadata only, the main security question would be whether these new build dependencies enable networked or unpinned fetching in the actual PKGBUILD, but that is not evidenced in the provided diff. No immediate red flags are visible in this change alone.

@@ -20,6 +20,11 @@ pkgbase = ungoogled-chromium
 	makedepends = qt6-base
 	makedepends = rust-bindgen
 	makedepends = rust
+	makedepends = python-httplib2
+	makedepends = python-pyparsing
+	makedepends = python-six
+	makedepends = npm
+	makedepends = rsync
 	depends = alsa-lib
 	depends = at-spi2-core
 	depends = cairo

Comment

The change only updates the package metadata to a newer Chromium/ungoogled-chromium release and replaces a direct Chromium tarball URL with the existing fetch-chromium-release helper. I do not see any new executable code, install-script changes, or suspicious external sources introduced by this .SRCINFO update. The GitHub source remains HTTPS and pinned to a specific release tag/archive. This looks like a routine version bump with no added security red flags in the provided hunk.

@@ -77,13 +82,13 @@ pkgbase = ungoogled-chromium
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=151.0.7922.137
-	provides = chromedriver=151.0.7922.137
+	provides = chromium=151.0.7922.169
+	provides = chromedriver=151.0.7922.169
 	conflicts = chromium
 	conflicts = chromedriver
 	options = !lto
-	source = https://commondatastorage.googleapis.com/chromium-browser-official/chromium-151.0.7922.137-lite.tar.xz
-	source = ungoogled-chromium-151.0.7922.137-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/151.0.7922.137-1.tar.gz
+	source = fetch-chromium-release
+	source = ungoogled-chromium-151.0.7922.169-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/151.0.7922.169-1.tar.gz
 	source = https://github.com/foutrelis/chromium-launcher/archive/v8/chromium-launcher-8.tar.gz
 	source = chromium-138-nodejs-version-check.patch
 	source = chromium-145-fix-SYS_SECCOMP.patch

Comment

The .SRCINFO change is a routine version bump for ungoogled-chromium from 151.0.7922.137 to 151.0.7922.169, with the expected corresponding checksum updates and a new helper source entry (fetch-chromium-release) plus added build-time makedepends needed by the package’s existing PKGBUILD logic. I checked the PKGBUILD context: the new source is not an arbitrary external binary, but a local helper script already referenced by the package’s prepare() flow, and the added dependencies are standard build tools. No signs of suspicious URLs, privilege escalation, persistence, or hidden execution were introduced by this metadata-only change.

@@ -99,8 +104,8 @@ pkgbase = ungoogled-chromium
 	source = enable-widevine-arm64.patch
 	source = use-oauth2-client-switches-as-default.patch
 	source = glibc-2.42-baud-rate-fix.patch
-	sha256sums = 3fa13440c0c99145f6628b2cd62438da05c989469c7113b19d11425f9853f645
-	sha256sums = f0e6c97580911fd8a0ecd562d743455ee9acb626a54b84682e26549d8ea1fa58
+	sha256sums = 2e2f36e3cd1ebc4ad57fd310774a5e5e9db77883d5f9374fedeaabd3c103b819
+	sha256sums = c770dc1a486f2ff0d2f3873496265609a287758147c882e96f2c96733c58a741
 	sha256sums = 213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a
 	sha256sums = 11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e
 	sha256sums = 4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e

Comment

The change is low risk. It only bumps Chromium/ungoogled-chromium version numbers and updates the checksum for the upstream tarball, plus flips _manual_clone from 0 to 1 so the build uses the package's fetch-chromium-release helper instead of the direct source tarball. I did not find any new network destinations, shell execution, privilege escalation, or persistence mechanisms introduced by this diff. The helper script is already part of the package and the rest of the PKGBUILD still sources the same upstream GitHub release and patch set. Main impact is build-path behavior and reproducibility, not a security regression.

@@ -11,14 +11,14 @@
 # Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
 
 pkgname=ungoogled-chromium
-pkgver=151.0.7922.137
+pkgver=151.0.7922.169
 pkgrel=1
 _launcher_ver=8
-_manual_clone=0
+_manual_clone=1
 _system_clang=1
 # ungoogled chromium variables
 _uc_usr=ungoogled-software
-_uc_ver=151.0.7922.137-1
+_uc_ver=151.0.7922.169-1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')
 url="https://github.com/ungoogled-software/ungoogled-chromium"

Comment

The only change in this hunk is an updated SHA-256 checksum for an existing source tarball after bumping the package version from 151.0.7922.137 to 151.0.7922.169 and switching to manual clone mode. This does not introduce new code execution, new sources, privilege changes, or packaging behavior; it only updates integrity metadata for an already-declared upstream GitHub archive. No suspicious URLs or build-time downloads are added by this diff. Risk is therefore minimal.

@@ -105,7 +105,7 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         use-oauth2-client-switches-as-default.patch
         glibc-2.42-baud-rate-fix.patch)
 sha256sums=('3fa13440c0c99145f6628b2cd62438da05c989469c7113b19d11425f9853f645'
-            'f0e6c97580911fd8a0ecd562d743455ee9acb626a54b84682e26549d8ea1fa58'
+            'c770dc1a486f2ff0d2f3873496265609a287758147c882e96f2c96733c58a741'
             '213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'
             '4fc040a0656a0a524dd8ad090cd129fc5b6cb21adcc66be82080165789e8c13e'