Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 155.0.8059.19 to 157.0.8103.19. .SRCINFO is metadata only and does not introduce executable behavior, new sources, or packaging policy changes by itself. Based on the provided diff, there are no security red flags to assess in this change alone.

@@ -1,6 +1,6 @@
 pkgbase = chrome-remote-desktop
 	pkgdesc = Access other computers or allow another user to access your computer securely over the Internet
-	pkgver = 155.0.8059.19
+	pkgver = 157.0.8103.19
 	pkgrel = 1
 	url = https://remotedesktop.google.com
 	install = chrome-remote-desktop.install

Comment

The change is low risk. It only bumps the packaged upstream .deb version and swaps the accompanying patch from xdg-base-directory.patch to xorg-binary-path.patch, with matching checksum updates. I inspected the new patch: it merely changes the Xorg binary probe from /usr/lib/xorg/Xorg to /usr/lib/Xorg, then falls back to PATH. That is a functional compatibility fix for Arch’s Xorg layout, not an obvious persistence, privilege-escalation, or network-related change. No new install-script, systemd, sudoers, or build-time execution behavior is introduced by this .SRCINFO-only update.

@@ -25,13 +25,13 @@ pkgbase = chrome-remote-desktop
 	depends = xorg-xrandr
 	options = !debug
 	options = !strip
-	source = chrome-remote-desktop-155.0.8059.19.deb::https://dl.google.com/linux/chrome-remote-desktop/deb/pool/main/c/chrome-remote-desktop/chrome-remote-desktop_155.0.8059.19_amd64.deb
+	source = chrome-remote-desktop-157.0.8103.19.deb::https://dl.google.com/linux/chrome-remote-desktop/deb/pool/main/c/chrome-remote-desktop/chrome-remote-desktop_157.0.8103.19_amd64.deb
 	source = pamrule
 	source = crd
-	source = xdg-base-directory.patch
-	sha256sums = 39701c6951b3d9edff08143dccad919468e1866b9897c873141dc4f66baaff72
+	source = xorg-binary-path.patch
+	sha256sums = cb3883ec7fbef455a5a1f75303f9f84face53fe8c10464fb102218833ed3db61
 	sha256sums = fcc38269eb1cc902abff9688eda9377a22367e39b9f111f87c0dd8e77adb82e2
 	sha256sums = e4105af96f029a80275986a0b19c7eaf563034230b20ee4d9158e1169d155e6d
-	sha256sums = 90bcfab85a87cfa6d038a55c556206f74b22eb03644ea51f46732cfb27679963
+	sha256sums = f59f98202c6d2693db8a6e32559178c9fffb198bfce0df69718f078e38cbc45b
 
 pkgname = chrome-remote-desktop

Comment

The change only bumps pkgver in PKGBUILD from 155.0.8059.19 to 157.0.8103.19. No build logic, sources, checksums, install scripts, or packaging behavior changed in the provided diff, so there is no new security concern introduced by this patch itself. The review is limited to the shown hunk, and it appears benign.

@@ -6,7 +6,7 @@
 # Contributor: Mateus Rodrigues Costa <charles [dot] costar [at] gmail [dot] com>
 
 pkgname=chrome-remote-desktop
-pkgver=155.0.8059.19
+pkgver=157.0.8103.19
 pkgrel=1
 pkgdesc="Access other computers or allow another user to access your computer securely over the Internet"
 arch=("x86_64")

Comment

The change only updates two SHA-256 checksums in PKGBUILD for existing source artifacts. There is no evidence of new sources, network behavior, build logic, privilege escalation, or packaging changes beyond integrity metadata. Based on the provided diff alone, this appears to be a routine checksum refresh and does not introduce a security issue.

@@ -21,10 +21,10 @@ source=(
   "crd"
   "xorg-binary-path.patch"
 )
-sha256sums=('39701c6951b3d9edff08143dccad919468e1866b9897c873141dc4f66baaff72'
+sha256sums=('cb3883ec7fbef455a5a1f75303f9f84face53fe8c10464fb102218833ed3db61'
             'fcc38269eb1cc902abff9688eda9377a22367e39b9f111f87c0dd8e77adb82e2'
             'e4105af96f029a80275986a0b19c7eaf563034230b20ee4d9158e1169d155e6d'
-            '90bcfab85a87cfa6d038a55c556206f74b22eb03644ea51f46732cfb27679963')
+            'f59f98202c6d2693db8a6e32559178c9fffb198bfce0df69718f078e38cbc45b')
 
 latestver() {
   curl -qs https://dl.google.com/linux/chrome-remote-desktop/deb/dists/stable/main/binary-amd64/Packages | awk '/^Version:/{print $2}' | sort -V | tail -1