Review Results

Comment

Risk score 1/5. The change only bumps the packaged upstream version and updates the corresponding Google-hosted .deb filename and checksum in .SRCINFO. There are no new sources, no build-script changes, no added install-time actions, and no signs of privilege escalation or persistence mechanisms in this diff. The main residual risk is the usual trust in an upstream binary .deb from Google, but this is unchanged in kind and the checksum was updated consistently for the new version.

@@ -1,6 +1,6 @@
 pkgbase = chrome-remote-desktop
 	pkgdesc = Access other computers or allow another user to access your computer securely over the Internet
-	pkgver = 154.0.8037.11
+	pkgver = 155.0.8059.19
 	pkgrel = 1
 	url = https://remotedesktop.google.com
 	install = chrome-remote-desktop.install

Comment

The change is a straightforward version bump in .SRCINFO for the Google-hosted chrome-remote-desktop .deb, with the corresponding SHA256 updated. The source remains HTTPS on the official dl.google.com domain, and there are no new sources, scripts, or packaging logic changes in this diff. No additional integrity or persistence red flags are introduced by this metadata-only update.

@@ -25,11 +25,11 @@ pkgbase = chrome-remote-desktop
 	depends = xorg-xrandr
 	options = !debug
 	options = !strip
-	source = chrome-remote-desktop-154.0.8037.11.deb::https://dl.google.com/linux/chrome-remote-desktop/deb/pool/main/c/chrome-remote-desktop/chrome-remote-desktop_154.0.8037.11_amd64.deb
+	source = chrome-remote-desktop-155.0.8059.19.deb::https://dl.google.com/linux/chrome-remote-desktop/deb/pool/main/c/chrome-remote-desktop/chrome-remote-desktop_155.0.8059.19_amd64.deb
 	source = pamrule
 	source = crd
 	source = xdg-base-directory.patch
-	sha256sums = 572dee08ca024f922a4c35b4b028abda348c9b54f12888eaaae53f6870dd5924
+	sha256sums = 39701c6951b3d9edff08143dccad919468e1866b9897c873141dc4f66baaff72
 	sha256sums = fcc38269eb1cc902abff9688eda9377a22367e39b9f111f87c0dd8e77adb82e2
 	sha256sums = e4105af96f029a80275986a0b19c7eaf563034230b20ee4d9158e1169d155e6d
 	sha256sums = 90bcfab85a87cfa6d038a55c556206f74b22eb03644ea51f46732cfb27679963

Comment

The change only bumps pkgver in PKGBUILD from 154.0.8037.11 to 155.0.8059.19. No build logic, source URLs, checksums, install scripts, permissions, or packaging behavior changed in the provided diff. On its face this is a routine version update with no security red flags visible in the reviewed hunk.

@@ -6,7 +6,7 @@
 # Contributor: Mateus Rodrigues Costa <charles [dot] costar [at] gmail [dot] com>
 
 pkgname=chrome-remote-desktop
-pkgver=154.0.8037.11
+pkgver=155.0.8059.19
 pkgrel=1
 pkgdesc="Access other computers or allow another user to access your computer securely over the Internet"
 arch=("x86_64")

Comment

The change is a straightforward version bump for the package source and an updated checksum for the corresponding upstream archive. No new sources, scripts, patches, or build logic were introduced, and the diff does not add any network fetches, privilege escalation, or packaging changes. Based on the provided hunk alone, this looks low risk.

@@ -21,7 +21,7 @@ source=(
   "crd"
   "xdg-base-directory.patch"
 )
-sha256sums=('572dee08ca024f922a4c35b4b028abda348c9b54f12888eaaae53f6870dd5924'
+sha256sums=('39701c6951b3d9edff08143dccad919468e1866b9897c873141dc4f66baaff72'
             'fcc38269eb1cc902abff9688eda9377a22367e39b9f111f87c0dd8e77adb82e2'
             'e4105af96f029a80275986a0b19c7eaf563034230b20ee4d9158e1169d155e6d'
             '90bcfab85a87cfa6d038a55c556206f74b22eb03644ea51f46732cfb27679963')