Review Results

Comment

The change is a routine version bump in .SRCINFO from 585.0.0 to 586.0.0, updating the upstream Google-hosted tarball URLs and their SHA256 checksums for both x86_64 and aarch64. The sources remain HTTPS on the official dl.google.com domain, there are no new build steps, scripts, patches, or packaging changes, and no signs of privilege escalation or persistence mechanisms. Based on the diff provided, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = google-cloud-cli
 	pkgdesc = A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
-	pkgver = 585.0.0
+	pkgver = 586.0.0
 	pkgrel = 1
 	url = https://cloud.google.com/cli/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the packaged upstream tarballs from 585.0.0 to 586.0.0, with updated SHA-256 checksums and no new sources, scripts, patches, or packaging logic. The sources remain HTTPS from Google's official dl.google.com release location, and there are no signs of added build-time execution or persistence mechanisms in this diff. Based on the provided hunk alone, this appears low risk.

@@ -17,10 +17,10 @@ pkgbase = google-cloud-cli
 	source = google-cloud-cli.install
 	sha256sums = 6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8
 	sha256sums = 6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6
-	source_x86_64 = google-cloud-cli-585.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_585.0.0.orig_amd64.tar.gz
-	sha256sums_x86_64 = 61a66a74e0a8fed7be88cd27b948459ec2a961a03d6a566ec72012c7eb3310e9
-	source_aarch64 = google-cloud-cli-585.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_585.0.0.orig_aarch64.tar.gz
-	sha256sums_aarch64 = e154284b903f08405d8cc6f95cc2f3c0e6b8c9f98e583227d727851c70b43d0d
+	source_x86_64 = google-cloud-cli-586.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_586.0.0.orig_amd64.tar.gz
+	sha256sums_x86_64 = d10dc8cea359fe98c58f56abbc0f9822c9ddb9d8a8a40462a968c32d20ae99f5
+	source_aarch64 = google-cloud-cli-586.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_586.0.0.orig_aarch64.tar.gz
+	sha256sums_aarch64 = be00d428159e4c3ee3a83e9462920805424b11db9ec34cb65b377c93c7b2f41b
 
 pkgname = google-cloud-cli
 	install = google-cloud-cli.install

Comment

The change is a routine version bump in PKGBUILD: pkgver and the corresponding source checksums were updated to the new upstream release. I did not find any new sources, build-time network fetches, shell execution, privilege escalation, or packaging logic changes in the reviewed hunk. The .install script and surrounding PKGBUILD context remain unchanged and benign. Risk is therefore minimal.

@@ -64,7 +64,7 @@ pkgname=(
 #   'google-cloud-cli-component-kubectl'
 #   'google-cloud-cli-component-gsutil'
 # )
-pkgver=585.0.0
+pkgver=586.0.0
 pkgrel=1
 pkgdesc="A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages"
 url="https://cloud.google.com/cli/"

Comment

The change is a routine version bump from 585.0.0 to 586.0.0 with updated SHA-256 checksums for the architecture-specific source tarballs. The source URLs remain HTTPS on the official Google download domain, there are no new build steps, no added scripts, and no packaging/persistence changes. I do not see any security-relevant red flags in this diff alone.

@@ -86,8 +86,8 @@ source_aarch64=("$pkgbase-$pkgver.orig_aarch64.tar.gz::https://dl.google.com/dl/
 
 sha256sums=('6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8'
             '6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6')
-sha256sums_x86_64=('61a66a74e0a8fed7be88cd27b948459ec2a961a03d6a566ec72012c7eb3310e9')
-sha256sums_aarch64=('e154284b903f08405d8cc6f95cc2f3c0e6b8c9f98e583227d727851c70b43d0d')
+sha256sums_x86_64=('d10dc8cea359fe98c58f56abbc0f9822c9ddb9d8a8a40462a968c32d20ae99f5')
+sha256sums_aarch64=('be00d428159e4c3ee3a83e9462920805424b11db9ec34cb65b377c93c7b2f41b')
 
 prepare() {
   cd "$_extracted_name"