Review Results

Comment

The only change in this .SRCINFO hunk is a version bump from 590.0.1 to 591.0.0. No sources, checksums, build commands, install scripts, or packaging metadata were altered in the reviewed diff, so there is no new security-relevant behavior to assess here. Based on this hunk alone, the change is low risk.

@@ -1,6 +1,6 @@
 pkgbase = google-cloud-cli
 	pkgdesc = A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages
-	pkgver = 590.0.1
+	pkgver = 591.0.0
 	pkgrel = 1
 	url = https://cloud.google.com/cli/
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO for the architecture-specific upstream tarballs and their checksums. The source URLs remain HTTPS and point to Google’s official cloud SDK download host, with no new sources, scripts, or build logic introduced. Since this diff only updates metadata to match a new release and does not alter package behavior, install scripts, or integrity controls, I see no security issue in the reviewed hunk.

@@ -17,10 +17,10 @@ pkgbase = google-cloud-cli
 	source = google-cloud-cli.install
 	sha256sums = 6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8
 	sha256sums = 6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6
-	source_x86_64 = google-cloud-cli-590.0.1.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_590.0.1.orig_amd64.tar.gz
-	sha256sums_x86_64 = 480e9e2048c37490512cd7809e60048f0241a739a25d933196484770db7fc7b3
-	source_aarch64 = google-cloud-cli-590.0.1.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_590.0.1.orig_aarch64.tar.gz
-	sha256sums_aarch64 = 54ff0ee4d487dd6fc750aaf32695be0200bfea5fb5977439f00e413e6259a8d9
+	source_x86_64 = google-cloud-cli-591.0.0.orig_x86_64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_591.0.0.orig_amd64.tar.gz
+	sha256sums_x86_64 = 23e67d8de3a5b4dd4e92028648f7d51c0b6a7c65b71d4c5765316c998c95b506
+	source_aarch64 = google-cloud-cli-591.0.0.orig_aarch64.tar.gz::https://dl.google.com/dl/cloudsdk/release/downloads/for_packagers/linux/google-cloud-cli_591.0.0.orig_aarch64.tar.gz
+	sha256sums_aarch64 = f59f6d9fededa7349c900039a78389b7939dfe0558f742a46433469a6751d429
 
 pkgname = google-cloud-cli
 	install = google-cloud-cli.install

Comment

The change is a routine version bump in PKGBUILD from 590.0.1 to 591.0.0 with corresponding checksum updates for the upstream tarballs. The source URLs remain HTTPS and point to Google’s official download host, there are no new build-time network fetches, no added scripts/patches, and no packaging logic changes that would introduce privilege escalation or persistence. Based on the provided diff, this looks low risk.

@@ -64,7 +64,7 @@ pkgname=(
 #   'google-cloud-cli-component-kubectl'
 #   'google-cloud-cli-component-gsutil'
 # )
-pkgver=590.0.1
+pkgver=591.0.0
 pkgrel=1
 pkgdesc="A core set of command-line tools for the Google Cloud Platform. Includes only gcloud core (with beta and alpha commands), gcloud-crc32c and man pages"
 url="https://cloud.google.com/cli/"

Comment

The change is a routine version bump for google-cloud-cli from 590.0.1 to 591.0.0 with corresponding checksum updates for the upstream tarballs. No new sources, scripts, build steps, permissions changes, or install-time actions were introduced. The package still fetches from the official Google download host over HTTPS, and the diff does not add any suspicious execution or persistence mechanisms.

@@ -86,8 +86,8 @@ source_aarch64=("$pkgbase-$pkgver.orig_aarch64.tar.gz::https://dl.google.com/dl/
 
 sha256sums=('6e88b535c020b0f28c986fdb66918f8c07e4d337e813b77ec2068068f03457f8'
             '6ac95bcc5afa06e9c1e3bd402ecbe1a2092b963d70a8f314215dd4be27e16fc6')
-sha256sums_x86_64=('480e9e2048c37490512cd7809e60048f0241a739a25d933196484770db7fc7b3')
-sha256sums_aarch64=('54ff0ee4d487dd6fc750aaf32695be0200bfea5fb5977439f00e413e6259a8d9')
+sha256sums_x86_64=('23e67d8de3a5b4dd4e92028648f7d51c0b6a7c65b71d4c5765316c998c95b506')
+sha256sums_aarch64=('f59f6d9fededa7349c900039a78389b7939dfe0558f742a46433469a6751d429')
 
 prepare() {
   cd "$_extracted_name"