Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 152.0.7977.75 to 152.0.7977.82. No source URLs, checksums, build steps, install scripts, permissions, or package metadata were altered, so there is no new security concern visible in this diff. This appears to be a routine upstream version update with no evidence of malicious behavior in the reviewed change.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 152.0.7977.75
+	pkgver = 152.0.7977.82
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The .SRCINFO change is low risk. It updates the package version from 152.0.7977.75 to 152.0.7977.82, switches the Chromium source to the package’s existing fetch helper (`fetch-chromium-release`) instead of a direct Google tarball URL, and adds build-time dependencies that are consistent with that helper and the Chromium build process (`python-httplib2`, `python-pyparsing`, `python-six`, `npm`, `rsync`). I did not see any new suspicious source locations, privilege escalation, install-script changes, or runtime persistence mechanisms in this diff. The only notable change is the source-fetch mechanism, but it is backed by the corresponding PKGBUILD logic and checksum update, so there is no clear integrity regression in the reviewed hunk.

@@ -20,6 +20,11 @@ pkgbase = ungoogled-chromium
 	makedepends = qt6-base
 	makedepends = rust-bindgen
 	makedepends = rust
+	makedepends = python-httplib2
+	makedepends = python-pyparsing
+	makedepends = python-six
+	makedepends = npm
+	makedepends = rsync
 	depends = alsa-lib
 	depends = at-spi2-core
 	depends = cairo

Comment

Low risk change. The diff only updates the package version metadata, swaps the Chromium upstream source from a direct Google tarball to a named fetch helper, and refreshes the corresponding checksum and provides versions. The new GitHub source URL is HTTPS and points to the upstream ungoogled-chromium release archive, not a suspicious mirror. I do note that .SRCINFO now lists additional makedepends (python-httplib2, python-pyparsing, python-six, npm, rsync), but this is metadata-only and there is no evidence in the reviewed hunk of network-fetching or privilege-escalation behavior. No install scripts, patches, or systemd units are changed here.

@@ -77,13 +82,13 @@ pkgbase = ungoogled-chromium
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=152.0.7977.75
-	provides = chromedriver=152.0.7977.75
+	provides = chromium=152.0.7977.82
+	provides = chromedriver=152.0.7977.82
 	conflicts = chromium
 	conflicts = chromedriver
 	options = !lto
-	source = https://commondatastorage.googleapis.com/chromium-browser-official/chromium-152.0.7977.75-lite.tar.xz
-	source = ungoogled-chromium-152.0.7977.75-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/152.0.7977.75-1.tar.gz
+	source = fetch-chromium-release
+	source = ungoogled-chromium-152.0.7977.82-1.tar.gz::https://github.com/ungoogled-software/ungoogled-chromium/archive/152.0.7977.82-1.tar.gz
 	source = https://github.com/foutrelis/chromium-launcher/archive/v8/chromium-launcher-8.tar.gz
 	source = chromium-138-nodejs-version-check.patch
 	source = chromium-145-fix-SYS_SECCOMP.patch

Comment

The change updates .SRCINFO for a Chromium version bump and adds the new fetch-chromium-release helper as a makedependency/source. Based on the PKGBUILD context, this is a normal packaging update: sources remain HTTPS and pinned to a specific release tarball, the new helper script fetches upstream Chromium from official Google-hosted repositories, and the added build dependencies are consistent with that helper's use (python modules, npm, rsync). No suspicious install scripts, privilege escalation, or unexpected persistence mechanisms are introduced by this metadata-only change. The only notable risk is that .SRCINFO now reflects a build-time network fetch helper, but that behavior already exists in the PKGBUILD and points to official upstream infrastructure rather than an untrusted source.

@@ -102,7 +107,7 @@ pkgbase = ungoogled-chromium
 	source = enable-widevine-arm64.patch
 	source = use-oauth2-client-switches-as-default.patch
 	source = glibc-2.42-baud-rate-fix.patch
-	sha256sums = 12379ddd4cdce9c318787c32f438dcf386df59b72ba508eb9f9ece54be44eb66
+	sha256sums = 2e2f36e3cd1ebc4ad57fd310774a5e5e9db77883d5f9374fedeaabd3c103b819
 	sha256sums = 0754581d607ab3806cb5dbb319f28d0bb0cddfe6c64015b59dff7d40c859cddb
 	sha256sums = 213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a
 	sha256sums = 11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e

Comment

The change is a routine version bump plus a switch from an explicit Chromium tarball download to the package's manual-clone path (_manual_clone=1), which causes the build to fetch Chromium via the package-provided fetch-chromium-release helper instead of the direct commondatastorage URL. I do not see evidence in the diff of added persistence, privilege escalation, shell injection, or new untrusted sources beyond the existing upstream GitHub/Chromium release inputs. The only security-relevant change is that the source acquisition mechanism changes, but it remains pinned to the exact pkgver/_uc_ver and still uses checksummed sources in the PKGBUILD. Based on the provided hunk alone, this looks low risk.

@@ -11,14 +11,14 @@
 # Contributor: Daniel J Griffiths <ghost1227@archlinux.us>
 
 pkgname=ungoogled-chromium
-pkgver=152.0.7977.75
+pkgver=152.0.7977.82
 pkgrel=1
 _launcher_ver=8
-_manual_clone=0
+_manual_clone=1
 _system_clang=1
 # ungoogled chromium variables
 _uc_usr=ungoogled-software
-_uc_ver=152.0.7977.75-1
+_uc_ver=152.0.7977.82-1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')
 url="https://github.com/ungoogled-software/ungoogled-chromium"

Comment

The only substantive change in this hunk is updating the Chromium release tarball checksum to match the new upstream version (152.0.7977.82) and bumping the package version metadata accordingly. The diff does not introduce new sources, network fetches, scripts, privilege changes, or packaging behavior changes. The switch of _manual_clone from 0 to 1 is visible in the full PKGBUILD, but it is outside the provided hunk and not part of the change under review here. Based on the reviewed hunk alone, this is a routine integrity update with no security red flags.

@@ -107,7 +107,7 @@ source=(https://commondatastorage.googleapis.com/chromium-browser-official/chrom
         enable-widevine-arm64.patch
         use-oauth2-client-switches-as-default.patch
         glibc-2.42-baud-rate-fix.patch)
-sha256sums=('12379ddd4cdce9c318787c32f438dcf386df59b72ba508eb9f9ece54be44eb66'
+sha256sums=('a672d1a84b0a7744e2bb6c9d038a2aace269db51bcf99e76895fb169a7e0c218'
             '0754581d607ab3806cb5dbb319f28d0bb0cddfe6c64015b59dff7d40c859cddb'
             '213e50f48b67feb4441078d50b0fd431df34323be15be97c55302d3fdac4483a'
             '11a96ffa21448ec4c63dd5c8d6795a1998d8e5cd5a689d91aea4d2bdd13fb06e'