Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 158.0.8106.0 to 158.0.8117.2. No source URLs, checksums, build steps, install scripts, permissions, or packaging metadata were altered in the reviewed diff, so there is no new security concern visible here. This is a routine upstream version update in the metadata only.

@@ -1,6 +1,6 @@
 pkgbase = google-chrome-dev
 	pkgdesc = The popular web browser by Google (Dev Channel)
-	pkgver = 158.0.8106.0
+	pkgver = 158.0.8117.2
 	pkgrel = 1
 	url = https://www.google.com/chrome
 	install = google-chrome-dev.install

Comment

The change only updates the pinned upstream Google Chrome Dev .deb URLs and their corresponding SHA-512 checksums to a newer version. The sources remain HTTPS on the official dl.google.com domain, and there are no new build-time commands, scripts, or packaging logic introduced in this .SRCINFO-only diff. No obvious supply-chain or persistence risk is present in the reviewed hunk.

@@ -26,9 +26,9 @@ pkgbase = google-chrome-dev
 	source = google-chrome-unstable.sh
 	sha512sums = a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396
 	sha512sums = 445eb36a588f49af018ded3d852b63e0523ffac20c25be721f3ef4663591256849432bebb3d9f352e4f53cbe1fb77fa67cf8911c9161f826490a21adbdcc81f4
-	source_x86_64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-unstable/google-chrome-unstable_158.0.8106.0-1_amd64.deb
-	sha512sums_x86_64 = 3c556358bcc307388b25e0f666d221d379554dc39d024dda254383d58385cbc6cd20f03233d43189485ec183d494623d6005793c2f3541ecf3eccb1d97236313
-	source_aarch64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-unstable/google-chrome-unstable_158.0.8106.0-1_arm64.deb
-	sha512sums_aarch64 = 374b852f2f59c3afe032d67058e70da9e2e9e0962db0d22b8940b219b43f8614c3fb0562e9df27378071bb8773ffe792a6ddc134fb85dabb2c826db8c7dfeff9
+	source_x86_64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-unstable/google-chrome-unstable_158.0.8117.2-1_amd64.deb
+	sha512sums_x86_64 = 909c2635114167539a38544239535e9ae5309cd2a107442f2697b372e8cc7d23af0ca7febb9fb434f203c5b7c3b5dcf9513f279f1f17980fa31fda2b1cffedc8
+	source_aarch64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-unstable/google-chrome-unstable_158.0.8117.2-1_arm64.deb
+	sha512sums_aarch64 = da36ed49804fa06e59929589242bc20a22b0e0bc4d1b5b39652e309801eb9ada11259dea162a0adf44747b5f1f0631d85e14e64ddf9ead361fc9a7887171f4ec
 
 pkgname = google-chrome-dev

Comment

The change only bumps google-chrome-dev to a newer upstream release and updates the corresponding SHA-512 checksums for the official HTTPS dl.google.com .deb sources. There are no new build steps, no added scripts, no network access beyond the existing source downloads, and no changes to package install logic or permissions. Based on the diff provided, this is a routine version/checksum update with no evident security regression.

@@ -7,7 +7,7 @@
 # or use: $ curl -sSf https://dl.google.com/linux/chrome/deb/dists/stable/main/binary-amd64/Packages | grep -A1 "Package: google-chrome-unstable" | awk '/Version/{print $2}' | cut -d '-' -f1
 
 pkgname=google-chrome-dev
-pkgver=158.0.8106.0
+pkgver=158.0.8117.2
 pkgrel=1
 pkgdesc="The popular web browser by Google (Dev Channel)"
 arch=(

Comment

The change only updates the expected SHA-512 checksums for the architecture-specific Google Chrome .deb artifacts. The source URLs remain HTTPS and point to the official Google download host, with no new build steps, scripts, or packaging logic introduced. I do not see any added supply-chain, persistence, or privilege-escalation risk in this diff alone; the security impact is limited to trusting a different upstream binary checksum, which is expected for a versioned package update.

@@ -42,8 +42,8 @@ source=(
 )
 sha512sums=('a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396'
             '445eb36a588f49af018ded3d852b63e0523ffac20c25be721f3ef4663591256849432bebb3d9f352e4f53cbe1fb77fa67cf8911c9161f826490a21adbdcc81f4')
-sha512sums_x86_64=('3c556358bcc307388b25e0f666d221d379554dc39d024dda254383d58385cbc6cd20f03233d43189485ec183d494623d6005793c2f3541ecf3eccb1d97236313')
-sha512sums_aarch64=('374b852f2f59c3afe032d67058e70da9e2e9e0962db0d22b8940b219b43f8614c3fb0562e9df27378071bb8773ffe792a6ddc134fb85dabb2c826db8c7dfeff9')
+sha512sums_x86_64=('909c2635114167539a38544239535e9ae5309cd2a107442f2697b372e8cc7d23af0ca7febb9fb434f203c5b7c3b5dcf9513f279f1f17980fa31fda2b1cffedc8')
+sha512sums_aarch64=('da36ed49804fa06e59929589242bc20a22b0e0bc4d1b5b39652e309801eb9ada11259dea162a0adf44747b5f1f0631d85e14e64ddf9ead361fc9a7887171f4ec')
 
 source_x86_64=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_amd64.deb")
 source_aarch64=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_arm64.deb")