Review Results

Comment

The change only bumps google-cloud-cli from 586.0.0 to 587.0.0 in .SRCINFO and updates the corresponding upstream release tarball URLs and SHA256 checksums for x86_64 and aarch64. The sources remain HTTPS from Google's official cloudsdk release location, there are no new build steps, scripts, or packaging behavior changes, and no signs of typosquatting, floating VCS refs, or added execution/persistence mechanisms. This is a routine version refresh with no evident security impact.

@@ -1,6 +1,6 @@
 pkgbase = google-cloud-cli
 	pkgdesc = A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
-	pkgver = 586.0.0
+	pkgver = 587.0.0
 	pkgrel = 1
 	url = https://cloud.google.com/cli/
 	arch = x86_64

Comment

The change only bumps the packaged upstream release tarballs from 586.0.0 to 587.0.0 for x86_64 and aarch64, with corresponding updated SHA-256 checksums. The sources remain HTTPS on Google’s official download host, there are no new build-time fetches, scripts, patches, or packaging logic changes, and no integrity or persistence red flags are introduced by this .SRCINFO-only update.

@@ -17,10 +17,10 @@ pkgbase = google-cloud-cli
 	source = google-cloud-cli.install
 	sha256sums = 6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8
 	sha256sums = 6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6
-	source_x86_64 = google-cloud-cli-586.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_586.0.0.orig_amd64.tar.gz
-	sha256sums_x86_64 = d10dc8cea359fe98c58f56abbc0f9822c9ddb9d8a8a40462a968c32d20ae99f5
-	source_aarch64 = google-cloud-cli-586.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_586.0.0.orig_aarch64.tar.gz
-	sha256sums_aarch64 = be00d428159e4c3ee3a83e9462920805424b11db9ec34cb65b377c93c7b2f41b
+	source_x86_64 = google-cloud-cli-587.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_587.0.0.orig_amd64.tar.gz
+	sha256sums_x86_64 = 6b566621ce59a900d520a30d505b9cef1c2bdd72826103175727ac6db1702101
+	source_aarch64 = google-cloud-cli-587.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_587.0.0.orig_aarch64.tar.gz
+	sha256sums_aarch64 = c7808b357c1781ed1f0fa0876316ebb901aa86727fb17e2ede229de8b94d95b0
 
 pkgname = google-cloud-cli
 	install = google-cloud-cli.install

Comment

The change is a routine version bump for google-cloud-cli from 586.0.0 to 587.0.0, with corresponding updated SHA-256 checksums for the upstream release tarballs. The source URLs remain HTTPS and point to Google’s official release host, and there are no new build-time commands, install-script changes, or packaging logic changes in this diff. No additional integrity or persistence red flags are introduced by this hunk alone.

@@ -64,7 +64,7 @@ pkgname=(
 #   'google-cloud-cli-component-kubectl'
 #   'google-cloud-cli-component-gsutil'
 # )
-pkgver=586.0.0
+pkgver=587.0.0
 pkgrel=1
 pkgdesc="A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages"
 url="https://cloud.google.com/cli/"

Comment

The change is a routine version bump from 586.0.0 to 587.0.0 with corresponding checksum updates for the upstream tarballs. The source URLs remain HTTPS on the official Google download domain, there are no new build-time commands, no added scripts, and no packaging or privilege-related changes in the diff. Based on the provided hunk, I see no security red flags beyond the normal trust in upstream release artifacts.

@@ -86,8 +86,8 @@ source_aarch64=("$pkgbase-$pkgver.orig_aarch64.tar.gz::https://dl.google.com/dl/
 
 sha256sums=('6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8'
             '6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6')
-sha256sums_x86_64=('d10dc8cea359fe98c58f56abbc0f9822c9ddb9d8a8a40462a968c32d20ae99f5')
-sha256sums_aarch64=('be00d428159e4c3ee3a83e9462920805424b11db9ec34cb65b377c93c7b2f41b')
+sha256sums_x86_64=('6b566621ce59a900d520a30d505b9cef1c2bdd72826103175727ac6db1702101')
+sha256sums_aarch64=('c7808b357c1781ed1f0fa0876316ebb901aa86727fb17e2ede229de8b94d95b0')
 
 prepare() {
   cd "$_extracted_name"