Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 156.0.8063.3 to 156.0.8072.0. No build logic, sources, checksums, install scripts, or packaging metadata affecting execution/persistence were changed. On its face this is a routine upstream version update with no security-relevant red flags in the provided diff.

@@ -1,6 +1,6 @@
 pkgbase = google-chrome-dev
 	pkgdesc = The popular web browser by Google (Dev Channel)
-	pkgver = 156.0.8063.3
+	pkgver = 156.0.8072.0
 	pkgrel = 1
 	url = https://www.google.com/chrome
 	install = google-chrome-dev.install

Comment

The change only updates the pinned upstream Google Chrome Dev .deb URLs and their SHA-512 checksums to a newer version. The sources remain HTTPS on the official dl.google.com domain, and there are no new build-time commands, scripts, or packaging behaviors introduced by this .SRCINFO-only edit. No obvious integrity or persistence risk is evident from the diff alone.

@@ -26,9 +26,9 @@ pkgbase = google-chrome-dev
 	source = google-chrome-unstable.sh
 	sha512sums = a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396
 	sha512sums = 445eb36a588f49af018ded3d852b63e0523ffac20c25be721f3ef4663591256849432bebb3d9f352e4f53cbe1fb77fa67cf8911c9161f826490a21adbdcc81f4
-	source_x86_64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-unstable/google-chrome-unstable_156.0.8063.3-1_amd64.deb
-	sha512sums_x86_64 = ad57ea1064036ccea7a3087a1ef4898913a13f3a88f7651e2cde5e6f9b85e63e00e92c71c14ebbb93e5bbcb0d6255c98df6e31ef540e7965326808bd0769a2a9
-	source_aarch64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-unstable/google-chrome-unstable_156.0.8063.3-1_arm64.deb
-	sha512sums_aarch64 = 42d5cb16a9638090ab23bf51678618527f06262327320fa3e1eabd96a94c8708962e8a85a9c30b7a2bd1e1adc10ed1227a62faed6d82b6129db8cfd2edc1adfb
+	source_x86_64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-unstable/google-chrome-unstable_156.0.8072.0-1_amd64.deb
+	sha512sums_x86_64 = 8114d6c511e6cafb2d38747e3bdb56e208eb8ebd12bc36bf7f0d54bf930cc4ddfce78bfbcac52502c0dc93c14a407b41dafde1c10861d89c72bcc575ca66211d
+	source_aarch64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-unstable/google-chrome-unstable_156.0.8072.0-1_arm64.deb
+	sha512sums_aarch64 = cbe08929f18d7461bd868075bedddbaef84d18283ccf5e671cffb5b38cd6e096398053bded512498b51fe08ef3f955f14edd7276e4091d0ba8ef229b0c4ea1ff
 
 pkgname = google-chrome-dev

Comment

The change is a straightforward version bump in PKGBUILD from 156.0.8063.3 to 156.0.8072.0 with no accompanying logic changes. There are no new sources, build steps, install scripts, permissions changes, or other supply-chain red flags in the provided diff hunk. Based on this diff alone, the update appears low risk.

@@ -7,7 +7,7 @@
 # or use: $ curl -sSf https://dl.google.com/linux/chrome/deb/dists/stable/main/binary-amd64/Packages | grep -A1 "Package: google-chrome-unstable" | awk '/Version/{print $2}' | cut -d '-' -f1
 
 pkgname=google-chrome-dev
-pkgver=156.0.8063.3
+pkgver=156.0.8072.0
 pkgrel=1
 pkgdesc="The popular web browser by Google (Dev Channel)"
 arch=(

Comment

The change only updates the SHA-512 checksums for the architecture-specific Google Chrome .deb sources. The source URLs remain HTTPS and point to the official Google download host, with no new build steps, scripts, or packaging logic introduced. This is a routine integrity-update change and does not add execution, persistence, or privilege-escalation risk on its face.

@@ -42,8 +42,8 @@ source=(
 )
 sha512sums=('a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396'
             '445eb36a588f49af018ded3d852b63e0523ffac20c25be721f3ef4663591256849432bebb3d9f352e4f53cbe1fb77fa67cf8911c9161f826490a21adbdcc81f4')
-sha512sums_x86_64=('ad57ea1064036ccea7a3087a1ef4898913a13f3a88f7651e2cde5e6f9b85e63e00e92c71c14ebbb93e5bbcb0d6255c98df6e31ef540e7965326808bd0769a2a9')
-sha512sums_aarch64=('42d5cb16a9638090ab23bf51678618527f06262327320fa3e1eabd96a94c8708962e8a85a9c30b7a2bd1e1adc10ed1227a62faed6d82b6129db8cfd2edc1adfb')
+sha512sums_x86_64=('8114d6c511e6cafb2d38747e3bdb56e208eb8ebd12bc36bf7f0d54bf930cc4ddfce78bfbcac52502c0dc93c14a407b41dafde1c10861d89c72bcc575ca66211d')
+sha512sums_aarch64=('cbe08929f18d7461bd868075bedddbaef84d18283ccf5e671cffb5b38cd6e096398053bded512498b51fe08ef3f955f14edd7276e4091d0ba8ef229b0c4ea1ff')
 
 source_x86_64=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_amd64.deb")
 source_aarch64=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_arm64.deb")