Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 156.0.8078.47 to 156.0.8078.73. No sources, checksums, build steps, install scripts, or metadata affecting trust boundaries were modified in the reviewed diff. On its face this is a routine upstream version update with no security red flags in the provided change.

@@ -1,6 +1,6 @@
 pkgbase = google-chrome
 	pkgdesc = The popular web browser by Google (Stable Channel)
-	pkgver = 156.0.8078.47
+	pkgver = 156.0.8078.73
 	pkgrel = 1
 	url = https://www.google.com/chrome
 	install = google-chrome.install

Comment

The change only updates the pinned upstream Google Chrome .deb URLs and their SHA-512 checksums in .SRCINFO from version 156.0.8078.47-1 to 156.0.8078.73-1 for x86_64 and aarch64. The sources remain HTTPS on the official dl.google.com domain, and there is no evidence here of added build-time execution, new sources, or packaging behavior changes. This is a routine version/checksum refresh with low security risk.

@@ -25,9 +25,9 @@ pkgbase = google-chrome
 	source = google-chrome-stable.sh
 	sha512sums = a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396
 	sha512sums = de02b498a4b5b93e21622c8dba57befe795d733a04656be911cc38e28bfef0e20470450f44be523bbde8d4de28f79c10434846ca01fc2a2f4e67707b79332f94
-	source_x86_64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_156.0.8078.47-1_amd64.deb
-	sha512sums_x86_64 = ffd886eb17c3993aef9fe440a2ab56c7b82b95555c693eb81efe09eeb3cf308434a69293bec36b7e363f55d453925c1b2763c989b66d847df67e714ef237b3fc
-	source_aarch64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_156.0.8078.47-1_arm64.deb
-	sha512sums_aarch64 = 732099a8779c4389f7eb3605b2c624a3e659d3a0eeee8d225e80d48813d53468fdd8d5048f670b4d69eecb64e96c573f712f8eabd6d9e28386d4fa0ce0820486
+	source_x86_64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_156.0.8078.73-1_amd64.deb
+	sha512sums_x86_64 = eef6703a0187bc871f90167cc82cdedab109685d21a2a8a2a457e3918229cbdef7c9ab2891e337f6ceed3081c3ea163de61d4e62e72bd400156e347e9204e4de
+	source_aarch64 = https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_156.0.8078.73-1_arm64.deb
+	sha512sums_aarch64 = 03b499298b76acf1e163130cb1681776de308e7df46a58f906a50996bcaadbd905787763a611f4799b10dcef2ad7f2e298eb3c5c69a885610fcc669f9ed1ab3a
 
 pkgname = google-chrome

Comment

The change is a simple version bump in PKGBUILD from 156.0.8078.47 to 156.0.8078.73 with no other logic changes shown. There are no new sources, build steps, install scripts, permissions changes, or packaging behavior changes in the provided diff hunk. Based on this hunk alone, I see no security-relevant regression.

@@ -7,7 +7,7 @@
 # or use: $ curl -sSf https://dl.google.com/linux/chrome/deb/dists/stable/main/binary-amd64/Packages | grep -A1 "Package: google-chrome-stable" | awk '/Version/{print $2}' | cut -d '-' -f1
 
 pkgname=google-chrome
-pkgver=156.0.8078.47
+pkgver=156.0.8078.73
 pkgrel=1
 pkgdesc="The popular web browser by Google (Stable Channel)"
 arch=(

Comment

The change only updates pkgver and the expected SHA-512 checksums for the architecture-specific Google Chrome .deb downloads. The source URLs remain HTTPS and pinned to an explicit versioned release artifact on dl.google.com, with no new build steps, scripts, or privilege-related changes. I do not see any added supply-chain or persistence risk in this diff beyond the normal trust already inherent in repackaging a vendor binary.

@@ -39,8 +39,8 @@ source=('eula_text.html'
         "google-chrome-$_channel.sh")
 sha512sums=('a225555c06b7c32f9f2657004558e3f996c981481dbb0d3cd79b1d59fa3f05d591af88399422d3ab29d9446c103e98d567aeafe061d9550817ab6e7eb0498396'
             'de02b498a4b5b93e21622c8dba57befe795d733a04656be911cc38e28bfef0e20470450f44be523bbde8d4de28f79c10434846ca01fc2a2f4e67707b79332f94')
-sha512sums_x86_64=('ffd886eb17c3993aef9fe440a2ab56c7b82b95555c693eb81efe09eeb3cf308434a69293bec36b7e363f55d453925c1b2763c989b66d847df67e714ef237b3fc')
-sha512sums_aarch64=('732099a8779c4389f7eb3605b2c624a3e659d3a0eeee8d225e80d48813d53468fdd8d5048f670b4d69eecb64e96c573f712f8eabd6d9e28386d4fa0ce0820486')
+sha512sums_x86_64=('eef6703a0187bc871f90167cc82cdedab109685d21a2a8a2a457e3918229cbdef7c9ab2891e337f6ceed3081c3ea163de61d4e62e72bd400156e347e9204e4de')
+sha512sums_aarch64=('03b499298b76acf1e163130cb1681776de308e7df46a58f906a50996bcaadbd905787763a611f4799b10dcef2ad7f2e298eb3c5c69a885610fcc669f9ed1ab3a')
 
 source_x86_64=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_amd64.deb")
 source_aarch64=("https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-${_channel}/google-chrome-${_channel}_${pkgver}-1_arm64.deb")