Review Results

Comment

The change is a straightforward version bump in .SRCINFO for the Widevine binary component, with the source URL still using HTTPS on Google's official release host and the checksum updated accordingly. No new build steps, scripts, privileges, or additional sources were introduced in this diff. The only notable change is the upstream artifact path/version, which is expected for a package update and does not by itself indicate tampering.

@@ -1,14 +1,14 @@
 pkgbase = chromium-widevine
 	pkgdesc = A browser plugin designed for the viewing of premium video content
-	pkgver = 4.10.3050.0
+	pkgver = 4.10.3112.0
 	pkgrel = 1
 	epoch = 1
 	url = https://www.widevine.com/
 	arch = x86_64
 	license = custom
 	options = !strip
-	source = https://www.google.com/dl/release2/chrome_component/bywu6vkyg6gmcthxdaetzfkptm_4.10.3050.0/oimompecagnajdejgnnjijobebaeigek_4.10.3050.0_linux_aduyhcxcs7a2znuo6ss5tffn5jpa.crx3
-	sha256sums = b70d887771d663018f46b1072b14320bd8b9a763641ef0317bd979cbad443e88
+	source = https://www.google.com/dl/release2/chrome_component/acqexsh26ysyu3zxeotqtsp63idq_4.10.3112.0/oimompecagnajdejgnnjijobebaeigek_4.10.3112.0_linux64_ad7kyx4q7wx7xknykmkbonbbmnwq.crx3
+	sha256sums = 1bf1f200dcccd461b2d029d000d0fcf800f0571c932db31467b9d5d301e0a98f
 
 pkgname = chromium-widevine
 	depends = gcc-libs

Comment

The change is a routine upstream version bump for the Widevine CDM package, with the source URL still using HTTPS on Google’s release host and the checksum updated accordingly. The only substantive change is switching the downloaded artifact from a generic `_linux_` CRX3 to a `_linux64_` CRX3, which is consistent with the package’s x86_64-only architecture and does not introduce new build-time execution, extra sources, or install-script behavior. No signs of privilege escalation, persistence, or integrity bypass are present in the reviewed hunk.

@@ -6,17 +6,17 @@
 
 pkgname=chromium-widevine
 pkgdesc='A browser plugin designed for the viewing of premium video content'
-pkgver=4.10.3050.0
-_release_id=bywu6vkyg6gmcthxdaetzfkptm
-_file_id=aduyhcxcs7a2znuo6ss5tffn5jpa
+pkgver=4.10.3112.0
+_release_id=acqexsh26ysyu3zxeotqtsp63idq
+_file_id=ad7kyx4q7wx7xknykmkbonbbmnwq
 pkgrel=1
 epoch=1
 arch=('x86_64')
 url='https://www.widevine.com/'
 license=('custom')
 options=('!strip')
-source=("https://www.google.com/dl/release2/chrome_component/${_release_id}_${pkgver}/oimompecagnajdejgnnjijobebaeigek_${pkgver}_linux_${_file_id}.crx3")
-sha256sums=('b70d887771d663018f46b1072b14320bd8b9a763641ef0317bd979cbad443e88')
+source=("https://www.google.com/dl/release2/chrome_component/${_release_id}_${pkgver}/oimompecagnajdejgnnjijobebaeigek_${pkgver}_linux64_${_file_id}.crx3")
+sha256sums=('1bf1f200dcccd461b2d029d000d0fcf800f0571c932db31467b9d5d301e0a98f')
 
 package() {
   depends=('gcc-libs' 'glib2' 'glibc' 'nspr' 'nss')