Review Results

Comment

The change is a straightforward version bump in .SRCINFO, updating the package version and the corresponding Google-hosted release tarball URLs and checksums for x86_64/aarch64. The sources remain HTTPS on the official Google Cloud SDK download domain, and there are no new build steps, scripts, or packaging behaviors introduced by this diff. No security issues are evident from the provided hunk alone.

@@ -1,6 +1,6 @@
 pkgbase = google-cloud-cli
 	pkgdesc = A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
-	pkgver = 590.0.0
+	pkgver = 590.0.1
 	pkgrel = 1
 	url = https://cloud.google.com/cli/
 	arch = x86_64

Comment

The change only bumps the packaged upstream release tarballs from 590.0.0 to 590.0.1 and updates the corresponding SHA-256 checksums in .SRCINFO. The sources remain HTTPS-hosted on dl.google.com, there are no new build-time commands, no added scripts, and no packaging metadata changes beyond versioned source hashes. Based on this diff alone, I don't see a security issue.

@@ -17,10 +17,10 @@ pkgbase = google-cloud-cli
 	source = google-cloud-cli.install
 	sha256sums = 6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8
 	sha256sums = 6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6
-	source_x86_64 = google-cloud-cli-590.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_590.0.0.orig_amd64.tar.gz
-	sha256sums_x86_64 = 4b556891bbd53cba5e21c90d33172d60c20959e2b0fccda3fd47291ba3be499b
-	source_aarch64 = google-cloud-cli-590.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_590.0.0.orig_aarch64.tar.gz
-	sha256sums_aarch64 = 75014e323e12cb92545ccc42edad075cd6b23a19d75715ae589d28f4f2038427
+	source_x86_64 = google-cloud-cli-590.0.1.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_590.0.1.orig_amd64.tar.gz
+	sha256sums_x86_64 = 480e9e2048c37490512cd7809e60048f0241a739a25d933196484770db7fc7b3
+	source_aarch64 = google-cloud-cli-590.0.1.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_590.0.1.orig_aarch64.tar.gz
+	sha256sums_aarch64 = 54ff0ee4d487dd6fc750aaf32695be0200bfea5fb5977439f00e413e6259a8d9
 
 pkgname = google-cloud-cli
 	install = google-cloud-cli.install

Comment

The change only bumps pkgver from 590.0.0 to 590.0.1 and updates the corresponding SHA-256 checksums for the upstream release tarballs. The source URLs remain HTTPS and point to Google’s official cloud SDK release host, with no new build steps, scripts, patches, or privilege/persistence mechanisms introduced. I did not find any security-relevant behavior change in this diff.

@@ -64,7 +64,7 @@ pkgname=(
 #   'google-cloud-cli-component-kubectl'
 #   'google-cloud-cli-component-gsutil'
 # )
-pkgver=590.0.0
+pkgver=590.0.1
 pkgrel=1
 pkgdesc="A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages"
 url="https://cloud.google.com/cli/"

Comment

The change only bumps pkgver from 590.0.0 to 590.0.1 and updates the x86_64/aarch64 source checksums accordingly. No build logic, install scripts, permissions, or source URLs changed, and the sources still point to the official Google download host over HTTPS. Based on the provided diff, there are no new security red flags or supply-chain concerns introduced by this patch.

@@ -86,8 +86,8 @@ source_aarch64=("$pkgbase-$pkgver.orig_aarch64.tar.gz::https://dl.google.com/dl/
 
 sha256sums=('6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8'
             '6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6')
-sha256sums_x86_64=('4b556891bbd53cba5e21c90d33172d60c20959e2b0fccda3fd47291ba3be499b')
-sha256sums_aarch64=('75014e323e12cb92545ccc42edad075cd6b23a19d75715ae589d28f4f2038427')
+sha256sums_x86_64=('480e9e2048c37490512cd7809e60048f0241a739a25d933196484770db7fc7b3')
+sha256sums_aarch64=('54ff0ee4d487dd6fc750aaf32695be0200bfea5fb5977439f00e413e6259a8d9')
 
 prepare() {
   cd "$_extracted_name"