Review Results

Comment

The only change in .SRCINFO is a version bump from 152.0.7977.9 to 154.0.8037.11. No source URLs, checksums, build commands, install scripts, or package metadata affecting trust boundaries were changed in this diff. By itself this is a routine upstream version update with no visible security red flags in the provided hunk.

@@ -1,6 +1,6 @@
 pkgbase = chrome-remote-desktop
 	pkgdesc = Access other computers or allow another user to access your computer securely over the Internet
-	pkgver = 152.0.7977.9
+	pkgver = 154.0.8037.11
 	pkgrel = 1
 	url = https://remotedesktop.google.com
 	install = chrome-remote-desktop.install

Comment

The change only updates the pinned upstream Chrome Remote Desktop .deb version and its corresponding SHA-256 in .SRCINFO. The source remains the official Google dl.google.com HTTPS URL, there are no new sources, no build-script changes, and no added execution or persistence mechanisms. This looks like a routine version bump with integrity metadata updated accordingly.

@@ -25,11 +25,11 @@ pkgbase = chrome-remote-desktop
 	depends = xorg-xrandr
 	options = !debug
 	options = !strip
-	source = chrome-remote-desktop-152.0.7977.9.deb::https://dl.google.com/linux/chrome-remote-desktop/deb/pool/main/c/chrome-remote-desktop/chrome-remote-desktop_152.0.7977.9_amd64.deb
+	source = chrome-remote-desktop-154.0.8037.11.deb::https://dl.google.com/linux/chrome-remote-desktop/deb/pool/main/c/chrome-remote-desktop/chrome-remote-desktop_154.0.8037.11_amd64.deb
 	source = pamrule
 	source = crd
 	source = xdg-base-directory.patch
-	sha256sums = fc6e10808f589a0475ce20a0038c902701e9e59cfb0ac810a45116f8c057f9e7
+	sha256sums = 572dee08ca024f922a4c35b4b028abda348c9b54f12888eaaae53f6870dd5924
 	sha256sums = fcc38269eb1cc902abff9688eda9377a22367e39b9f111f87c0dd8e77adb82e2
 	sha256sums = e4105af96f029a80275986a0b19c7eaf563034230b20ee4d9158e1169d155e6d
 	sha256sums = 90bcfab85a87cfa6d038a55c556206f74b22eb03644ea51f46732cfb27679963

Comment

The change only bumps pkgver and the corresponding source checksum for the Google-hosted .deb. No new sources, scripts, patches, or packaging logic were introduced, and the existing PKGBUILD already fetches from HTTPS and unpacks a vendor .deb. Based on the provided diff alone, there are no new security red flags in this change.

@@ -6,7 +6,7 @@
 # Contributor: Mateus Rodrigues Costa <charles [dot] costar [at] gmail [dot] com>
 
 pkgname=chrome-remote-desktop
-pkgver=152.0.7977.9
+pkgver=154.0.8037.11
 pkgrel=1
 pkgdesc="Access other computers or allow another user to access your computer securely over the Internet"
 arch=("x86_64")

Comment

The change only updates the packaged upstream version and the corresponding source checksum in PKGBUILD. The source remains an HTTPS download from Google’s official chrome-remote-desktop repository, with no new build logic, scripts, or privilege-related changes introduced by this diff. I do note the package still fetches a prebuilt .deb at build time and executes an install script, but those behaviors pre-exist this change and are not modified here. No new security issue is introduced by this version bump alone.

@@ -21,7 +21,7 @@ source=(
   "crd"
   "xdg-base-directory.patch"
 )
-sha256sums=('fc6e10808f589a0475ce20a0038c902701e9e59cfb0ac810a45116f8c057f9e7'
+sha256sums=('572dee08ca024f922a4c35b4b028abda348c9b54f12888eaaae53f6870dd5924'
             'fcc38269eb1cc902abff9688eda9377a22367e39b9f111f87c0dd8e77adb82e2'
             'e4105af96f029a80275986a0b19c7eaf563034230b20ee4d9158e1169d155e6d'
             '90bcfab85a87cfa6d038a55c556206f74b22eb03644ea51f46732cfb27679963')