Review Results

Comment

The change is a routine version bump in .SRCINFO for google-cloud-cli, updating the package version and the corresponding upstream release tarball URLs and checksums for x86_64 and aarch64. The sources remain HTTPS on the official Google download domain, and there are no new scripts, patches, build steps, or privilege-related artifacts introduced by this diff. Based on the provided hunk, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = google-cloud-cli
 	pkgdesc = A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
-	pkgver = 583.0.0
+	pkgver = 584.0.0
 	pkgrel = 1
 	url = https://cloud.google.com/cli/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Google Cloud CLI tarballs, with updated checksums and no new sources, scripts, or packaging logic. The source URLs remain HTTPS and point to the same official Google download host. No evidence of added execution, persistence, privilege escalation, or integrity regression in this diff hunk.

@@ -17,10 +17,10 @@ pkgbase = google-cloud-cli
 	source = google-cloud-cli.install
 	sha256sums = 6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8
 	sha256sums = 6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6
-	source_x86_64 = google-cloud-cli-583.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_583.0.0.orig_amd64.tar.gz
-	sha256sums_x86_64 = d34c5a3d2bd31e1259b5d8f7f15091ee9e59ae1b3ec9323ad41dcd0a5021bdc4
-	source_aarch64 = google-cloud-cli-583.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_583.0.0.orig_aarch64.tar.gz
-	sha256sums_aarch64 = a00eb3c87ebffdf19816932e885495f6eb856ef6736225617b6780bb73e1c980
+	source_x86_64 = google-cloud-cli-584.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_584.0.0.orig_amd64.tar.gz
+	sha256sums_x86_64 = da12ffa5b3221b92faea66131c8f3979cd7893eab5a3a665dfdc2d26af44716a
+	source_aarch64 = google-cloud-cli-584.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_584.0.0.orig_aarch64.tar.gz
+	sha256sums_aarch64 = e074ab9d2eb50b862b328df4b89935d47ca6efcf55839e81ea216db6a32ec46a
 
 pkgname = google-cloud-cli
 	install = google-cloud-cli.install

Comment

The change is a routine version bump for a Google-hosted release tarball plus updated SHA-256 checksums. The source URLs remain HTTPS and point to the vendor’s release host, with no new build logic, no added scripts, and no packaging behavior changes. I don’t see any supply-chain red flags in this diff alone.

@@ -64,7 +64,7 @@ pkgname=(
 #   'google-cloud-cli-component-kubectl'
 #   'google-cloud-cli-component-gsutil'
 # )
-pkgver=583.0.0
+pkgver=584.0.0
 pkgrel=1
 pkgdesc="A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages"
 url="https://cloud.google.com/cli/"

Comment

The change only bumps pkgver from 583.0.0 to 584.0.0 and updates the corresponding SHA-256 checksums for the upstream release tarballs. No new sources, scripts, install hooks, privilege changes, or build-time network behavior were introduced in the reviewed hunk. This appears to be a routine version/hash refresh with low security risk.

@@ -86,8 +86,8 @@ source_aarch64=("$pkgbase-$pkgver.orig_aarch64.tar.gz::https://dl.google.com/dl/
 
 sha256sums=('6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8'
             '6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6')
-sha256sums_x86_64=('d34c5a3d2bd31e1259b5d8f7f15091ee9e59ae1b3ec9323ad41dcd0a5021bdc4')
-sha256sums_aarch64=('a00eb3c87ebffdf19816932e885495f6eb856ef6736225617b6780bb73e1c980')
+sha256sums_x86_64=('da12ffa5b3221b92faea66131c8f3979cd7893eab5a3a665dfdc2d26af44716a')
+sha256sums_aarch64=('e074ab9d2eb50b862b328df4b89935d47ca6efcf55839e81ea216db6a32ec46a')
 
 prepare() {
   cd "$_extracted_name"