Review Results

Comment

The change is a routine version bump in .SRCINFO for google-cloud-cli, updating the package version and the corresponding upstream tarball URLs/checksums for x86_64 and aarch64. The sources remain HTTPS on the official Google download domain, there are no new build-time commands, no install-script changes, and no signs of typosquatting, floating VCS refs, or added persistence mechanisms. Based on the provided diff, this looks like a normal upstream release metadata update with no security red flags.

@@ -1,6 +1,6 @@
 pkgbase = google-cloud-cli
 	pkgdesc = A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
-	pkgver = 584.0.0
+	pkgver = 585.0.0
 	pkgrel = 1
 	url = https://cloud.google.com/cli/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the prebuilt Google Cloud CLI tarballs, with updated filenames, HTTPS download URLs on the official dl.google.com domain, and matching per-arch SHA256 sums. No new sources, scripts, build steps, or packaging behavior are introduced by this diff, and nothing suggests privilege escalation or persistence. Risk is minimal and limited to the usual trust in upstream release artifacts already present in the package.

@@ -17,10 +17,10 @@ pkgbase = google-cloud-cli
 	source = google-cloud-cli.install
 	sha256sums = 6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8
 	sha256sums = 6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6
-	source_x86_64 = google-cloud-cli-584.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_584.0.0.orig_amd64.tar.gz
-	sha256sums_x86_64 = da12ffa5b3221b92faea66131c8f3979cd7893eab5a3a665dfdc2d26af44716a
-	source_aarch64 = google-cloud-cli-584.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_584.0.0.orig_aarch64.tar.gz
-	sha256sums_aarch64 = e074ab9d2eb50b862b328df4b89935d47ca6efcf55839e81ea216db6a32ec46a
+	source_x86_64 = google-cloud-cli-585.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_585.0.0.orig_amd64.tar.gz
+	sha256sums_x86_64 = 61a66a74e0a8fed7be88cd27b948459ec2a961a03d6a566ec72012c7eb3310e9
+	source_aarch64 = google-cloud-cli-585.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_585.0.0.orig_aarch64.tar.gz
+	sha256sums_aarch64 = e154284b903f08405d8cc6f95cc2f3c0e6b8c9f98e583227d727851c70b43d0d
 
 pkgname = google-cloud-cli
 	install = google-cloud-cli.install

Comment

The change is a routine version bump for google-cloud-cli from 584.0.0 to 585.0.0, with corresponding checksum updates for the official Google-hosted tarballs. The source URLs remain HTTPS and point to the expected upstream release location, and there are no new build steps, scripts, patches, or packaging changes that would introduce code execution or persistence risks. No suspicious metadata changes are present in this diff.

@@ -64,7 +64,7 @@ pkgname=(
 #   'google-cloud-cli-component-kubectl'
 #   'google-cloud-cli-component-gsutil'
 # )
-pkgver=584.0.0
+pkgver=585.0.0
 pkgrel=1
 pkgdesc="A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages"
 url="https://cloud.google.com/cli/"

Comment

The change only bumps pkgver from 584.0.0 to 585.0.0 and updates the corresponding SHA-256 checksums for the upstream tarballs. No build logic, install scripts, permissions, dependencies, or source URLs changed. Based on the diff shown, there are no new supply-chain or execution red flags.

@@ -86,8 +86,8 @@ source_aarch64=("$pkgbase-$pkgver.orig_aarch64.tar.gz::https://dl.google.com/dl/
 
 sha256sums=('6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8'
             '6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6')
-sha256sums_x86_64=('da12ffa5b3221b92faea66131c8f3979cd7893eab5a3a665dfdc2d26af44716a')
-sha256sums_aarch64=('e074ab9d2eb50b862b328df4b89935d47ca6efcf55839e81ea216db6a32ec46a')
+sha256sums_x86_64=('61a66a74e0a8fed7be88cd27b948459ec2a961a03d6a566ec72012c7eb3310e9')
+sha256sums_aarch64=('e154284b903f08405d8cc6f95cc2f3c0e6b8c9f98e583227d727851c70b43d0d')
 
 prepare() {
   cd "$_extracted_name"