Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 155.0.8059.84 to 156.0.8078.47. No source URLs, checksums, build steps, install scripts, or package metadata affecting trust boundaries were modified in the provided diff. On its face this is a routine upstream version update with no visible security red flags in the reviewed hunk.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium-bin
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 155.0.8059.84
+	pkgver = 156.0.8078.47
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for a -bin package: it updates the provided Chromium/Chromedriver version and the upstream GitHub release URL plus checksum. The source remains HTTPS and points to the project’s release artifacts, with no new build logic, scripts, or privilege-related files introduced in this diff. I don’t see any supply-chain red flags in the reviewed hunk itself.

@@ -65,11 +65,11 @@ pkgbase = ungoogled-chromium-bin
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=155.0.8059.84
-	provides = chromedriver=155.0.8059.84
+	provides = chromium=156.0.8078.47
+	provides = chromedriver=156.0.8078.47
 	conflicts = chromium
 	conflicts = chromedriver
-	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/155.0.8059.84-1/ungoogled-chromium-155.0.8059.84-1-x86_64.pkg.tar.zst
-	sha256sums = a1e534e519916d6df1efbf6b897b9efa1f28080794c80676a019327ce08030a6
+	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/156.0.8078.47-1/ungoogled-chromium-156.0.8078.47-1-x86_64.pkg.tar.zst
+	sha256sums = f770a4826715a9939ced2d8667644038990619f84014aa724b64368436833107
 
 pkgname = ungoogled-chromium-bin

Comment

This change is a routine version bump for a -bin package: it updates pkgver and the corresponding SHA-256 for the upstream release artifact. The source remains an HTTPS GitHub release URL from the same project, with no new build steps, scripts, patches, or privilege-related changes. I did not find any security-relevant behavior introduced by this diff alone.

@@ -1,7 +1,7 @@
 # Maintainer: networkException <git@nwex.de>
 
 pkgname=ungoogled-chromium-bin
-pkgver=155.0.8059.84
+pkgver=156.0.8078.47
 pkgrel=1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')

Comment

The change only bumps the package version and updates the SHA-256 for a single HTTPS GitHub release artifact. There are no new sources, no build-script changes, no added execution paths, and no install/systemd/persistence logic in the diff. The main security property here is integrity of the downloaded binary package, and the checksum update is expected for a version bump. No obvious red flags in this hunk.

@@ -54,7 +54,7 @@ optdepends=('pipewire: WebRTC desktop sharing under Wayland'
 provides=("chromium=$pkgver" "chromedriver=$pkgver")
 conflicts=('chromium' 'chromedriver')
 source=(https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/$pkgver-$pkgrel/ungoogled-chromium-$pkgver-$pkgrel-x86_64.pkg.tar.zst)
-sha256sums=('a1e534e519916d6df1efbf6b897b9efa1f28080794c80676a019327ce08030a6')
+sha256sums=('f770a4826715a9939ced2d8667644038990619f84014aa724b64368436833107')
 
 declare -gA _system_libs=(
     [brotli]=brotli