Review Results

Comment

The only change in this diff is a version bump in .SRCINFO, updating the packaged Google Chrome release and its corresponding upstream .deb URLs/checksums. I do not see any new sources, build logic, install-script changes, or other behavior changes that would introduce supply-chain or privilege risks. The package still fetches from the official Google dl.google.com endpoint over HTTPS and remains pinned by checksum.

@@ -1,6 +1,6 @@
 pkgbase = google-chrome
 	pkgdesc = The popular web browser by Google (Stable Channel)
-	pkgver = 154.0.8037.97
+	pkgver = 155.0.8059.39
 	pkgrel = 1
 	url = https://www.google.com/chrome
 	install = google-chrome.install

Comment

The change only updates the pinned upstream Google Chrome .deb URLs and their SHA-512 checksums in .SRCINFO for x86_64 and aarch64. The sources remain HTTPS on the official dl.google.com domain, and there are no new build-time commands, scripts, or privilege-related changes in this diff. This is a routine version bump with integrity metadata updated accordingly, so I see no security issue in the reviewed hunk.

@@ -25,9 +25,9 @@ pkgbase = google-chrome
 	source = google-chrome-stable.sh
 	sha512sums = a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396
 	sha512sums = de02b498a4b5b93e21622c8dba57befe795d733a04656be911cc38e28bfef0e20470450f44be523bbde8d4de28f79c10434846ca01fc2a2f4e67707b79332f94
-	source_x86_64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_154.0.8037.97-1_amd64.deb
-	sha512sums_x86_64 = 990f133f1091d0aea48cc0bfbcc8f303fee80d128a93f02f7910c0e0bb46c45ee96971879037cde100bb35899284fff4fe5b172ace9b9d5e6465d45f311d1ae0
-	source_aarch64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_154.0.8037.97-1_arm64.deb
-	sha512sums_aarch64 = 7955d74192d8364ba22b25cf1de1c7a7b58428a04a04ac095b773f838224b506dc4c74dca340d1a80b54f012a339c01fcba752b5c63a55a4ea6a9886fa36fd8e
+	source_x86_64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_155.0.8059.39-1_amd64.deb
+	sha512sums_x86_64 = 42b4ec9ec61fee532a848fdf35973d3aba6c083028ee45c98572f1bbd9e51e865cbd5bf9fbbe695b6c9a76936472aaccd58f860ecb8bcce380afa6fd57bcb472
+	source_aarch64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_155.0.8059.39-1_arm64.deb
+	sha512sums_aarch64 = bcb58757677389245952e4fba354c71c586228abe1e91cf7563895dda3702dcddd031838dbde8e246525e1b15fbfdf6b13c59ed7fc1f4cb52c088d499857adb7
 
 pkgname = google-chrome

Comment

The change only bumps pkgver in PKGBUILD from 154.0.8037.97 to 155.0.8059.39. No sources, checksums, build logic, install scripts, or packaging behavior changed in the provided hunk. Based on this diff alone there are no new security red flags to assess.

@@ -7,7 +7,7 @@
 # or use: $ curl -sSf https://dl.google.com/linux/chrome/deb/dists/stable/main/binary-amd64/Packages | grep -A1 "Package: google-chrome-stable" | awk '/Version/{print $2}' | cut -d '-' -f1
 
 pkgname=google-chrome
-pkgver=154.0.8037.97
+pkgver=155.0.8059.39
 pkgrel=1
 pkgdesc="The popular web browser by Google (Stable Channel)"
 arch=(

Comment

The change only updates the SHA-512 checksums for the architecture-specific Google Chrome .deb sources. The source URLs remain HTTPS and point to Google's official download host, and there are no new build-time commands, scripts, or packaging logic changes. This is a low-risk integrity metadata update, assuming the new checksums correspond to the intended upstream release artifacts.

@@ -39,8 +39,8 @@ source=('eula_text.html'
         "google-chrome-$_channel.sh")
 sha512sums=('a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396'
             'de02b498a4b5b93e21622c8dba57befe795d733a04656be911cc38e28bfef0e20470450f44be523bbde8d4de28f79c10434846ca01fc2a2f4e67707b79332f94')
-sha512sums_x86_64=('990f133f1091d0aea48cc0bfbcc8f303fee80d128a93f02f7910c0e0bb46c45ee96971879037cde100bb35899284fff4fe5b172ace9b9d5e6465d45f311d1ae0')
-sha512sums_aarch64=('7955d74192d8364ba22b25cf1de1c7a7b58428a04a04ac095b773f838224b506dc4c74dca340d1a80b54f012a339c01fcba752b5c63a55a4ea6a9886fa36fd8e')
+sha512sums_x86_64=('42b4ec9ec61fee532a848fdf35973d3aba6c083028ee45c98572f1bbd9e51e865cbd5bf9fbbe695b6c9a76936472aaccd58f860ecb8bcce380afa6fd57bcb472')
+sha512sums_aarch64=('bcb58757677389245952e4fba354c71c586228abe1e91cf7563895dda3702dcddd031838dbde8e246525e1b15fbfdf6b13c59ed7fc1f4cb52c088d499857adb7')
 
 source_x86_64=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_amd64.deb")
 source_aarch64=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_arm64.deb")