Review Results

Comment

The change is a routine version bump in .SRCINFO for google-cloud-cli, updating the package version and the corresponding upstream tarball URLs/checksums for x86_64 and aarch64. The sources remain HTTPS on the official Google download domain, there are no new build-time commands, no install-script changes, and no added persistence or privilege-related artifacts. Based on the provided diff, this is low risk and appears to be a normal package update.

@@ -1,6 +1,6 @@
 pkgbase = google-cloud-cli
 	pkgdesc = A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
-	pkgver = 582.0.0
+	pkgver = 583.0.0
 	pkgrel = 1
 	url = https://cloud.google.com/cli/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the Google Cloud CLI package, updating the x86_64 and aarch64 source tarball URLs and their corresponding SHA256 checksums from 582.0.0 to 583.0.0. The sources remain on the official dl.google.com domain over HTTPS, and there are no new scripts, build steps, or privilege-related artifacts introduced in this diff. Based on the provided hunk alone, this does not add any obvious supply-chain or persistence risk.

@@ -17,10 +17,10 @@ pkgbase = google-cloud-cli
 	source = google-cloud-cli.install
 	sha256sums = 6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8
 	sha256sums = 6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6
-	source_x86_64 = google-cloud-cli-582.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_582.0.0.orig_amd64.tar.gz
-	sha256sums_x86_64 = 728630fdcfeb9da4a1998e6ec97a89bb2a3623c0a47761d0ea47b8afe338dfd0
-	source_aarch64 = google-cloud-cli-582.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_582.0.0.orig_aarch64.tar.gz
-	sha256sums_aarch64 = 7b086147ea6ef34046dac4e066e1e3fced29838a7eeba626e0e38831b4b5d58b
+	source_x86_64 = google-cloud-cli-583.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_583.0.0.orig_amd64.tar.gz
+	sha256sums_x86_64 = d34c5a3d2bd31e1259b5d8f7f15091ee9e59ae1b3ec9323ad41dcd0a5021bdc4
+	source_aarch64 = google-cloud-cli-583.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_583.0.0.orig_aarch64.tar.gz
+	sha256sums_aarch64 = a00eb3c87ebffdf19816932e885495f6eb856ef6736225617b6780bb73e1c980
 
 pkgname = google-cloud-cli
 	install = google-cloud-cli.install

Comment

The change is a routine version bump for a Google-hosted release tarball, with corresponding checksum updates for x86_64 and aarch64. The source URLs remain HTTPS and point to the official Google Cloud SDK release location, and there are no new build-time commands, scripts, or packaging logic changes that would introduce execution or persistence risks. No suspicious dependencies, privilege escalation, or install-script changes are present in this diff.

@@ -64,7 +64,7 @@ pkgname=(
 #   'google-cloud-cli-component-kubectl'
 #   'google-cloud-cli-component-gsutil'
 # )
-pkgver=582.0.0
+pkgver=583.0.0
 pkgrel=1
 pkgdesc="A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages"
 url="https://cloud.google.com/cli/"

Comment

The change is a routine version bump from 582.0.0 to 583.0.0 with corresponding SHA-256 updates for the upstream Google-hosted tarballs. The source URLs remain HTTPS and point to the official dl.google.com location, and there are no new build-time downloads, scripts, patches, privilege changes, or packaging behavior changes in the diff. Based on the provided hunk, this does not introduce an obvious security issue.

@@ -86,8 +86,8 @@ source_aarch64=("$pkgbase-$pkgver.orig_aarch64.tar.gz::https://dl.google.com/dl/
 
 sha256sums=('6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8'
             '6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6')
-sha256sums_x86_64=('728630fdcfeb9da4a1998e6ec97a89bb2a3623c0a47761d0ea47b8afe338dfd0')
-sha256sums_aarch64=('7b086147ea6ef34046dac4e066e1e3fced29838a7eeba626e0e38831b4b5d58b')
+sha256sums_x86_64=('d34c5a3d2bd31e1259b5d8f7f15091ee9e59ae1b3ec9323ad41dcd0a5021bdc4')
+sha256sums_aarch64=('a00eb3c87ebffdf19816932e885495f6eb856ef6736225617b6780bb73e1c980')
 
 prepare() {
   cd "$_extracted_name"