Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 156.0.8078.73 to 156.0.8078.79. No sources, checksums, install scripts, build logic, or metadata affecting trust boundaries were changed in the provided hunk. On its face this is a routine upstream version update with no security red flags visible in the diff reviewed.

@@ -1,6 +1,6 @@
 pkgbase = ungoogled-chromium-bin
 	pkgdesc = A lightweight approach to removing Google web service dependency
-	pkgver = 156.0.8078.73
+	pkgver = 156.0.8078.79
 	pkgrel = 1
 	url = https://github.com/ungoogled-software/ungoogled-chromium
 	arch = x86_64

Comment

The change is a straightforward version bump in .SRCINFO: it updates the provided chromium/chromedriver version and the GitHub release asset URL plus checksum to match the new upstream binary release. The source remains HTTPS on the official upstream release repository, and there are no new build steps, scripts, or privilege-related changes in this diff. No obvious supply-chain or persistence risk is introduced by this metadata-only update.

@@ -65,11 +65,11 @@ pkgbase = ungoogled-chromium-bin
 	optdepends = qt6-base: Qt support
 	optdepends = org.freedesktop.secrets: password storage backend on GNOME, KDE and Xfce
 	optdepends = upower: Battery Status API support
-	provides = chromium=156.0.8078.73
-	provides = chromedriver=156.0.8078.73
+	provides = chromium=156.0.8078.79
+	provides = chromedriver=156.0.8078.79
 	conflicts = chromium
 	conflicts = chromedriver
-	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/156.0.8078.73-1/ungoogled-chromium-156.0.8078.73-1-x86_64.pkg.tar.zst
-	sha256sums = 95fb56c2e7d1bc3eea3a247f1e0dddd8ca562f0b4bd45da99b667e223f1f3eb2
+	source = https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/156.0.8078.79-1/ungoogled-chromium-156.0.8078.79-1-x86_64.pkg.tar.zst
+	sha256sums = 8870088b286430c23920c66d0c64ddc55a4e8a9e7e4e961a11e6af7816bb02fc
 
 pkgname = ungoogled-chromium-bin

Comment

The change is a simple version bump in PKGBUILD from 156.0.8078.73 to 156.0.8078.79 with no other modifications shown. On its face this does not introduce new build logic, network fetches, privilege changes, or packaging behavior. I did not see any suspicious indicators in the provided hunk itself.

@@ -1,7 +1,7 @@
 # Maintainer: networkException <git@nwex.de>
 
 pkgname=ungoogled-chromium-bin
-pkgver=156.0.8078.73
+pkgver=156.0.8078.79
 pkgrel=1
 pkgdesc="A lightweight approach to removing Google web service dependency"
 arch=('x86_64')

Comment

The change is a straightforward version bump of a prebuilt binary package plus an updated SHA-256 checksum for the new release artifact. The source remains an HTTPS GitHub release URL, there are no new build steps, no added scripts, no network fetches beyond the declared source, and no changes to install-time behavior or package metadata that would suggest persistence or privilege escalation. Risk is low because trust is still entirely in the upstream binary release, but this diff itself does not introduce additional security red flags.

@@ -54,7 +54,7 @@ optdepends=('pipewire: WebRTC desktop sharing under Wayland'
 provides=("chromium=$pkgver" "chromedriver=$pkgver")
 conflicts=('chromium' 'chromedriver')
 source=(https://github.com/ungoogled-software/ungoogled-chromium-archlinux/releases/download/$pkgver-$pkgrel/ungoogled-chromium-$pkgver-$pkgrel-x86_64.pkg.tar.zst)
-sha256sums=('95fb56c2e7d1bc3eea3a247f1e0dddd8ca562f0b4bd45da99b667e223f1f3eb2')
+sha256sums=('8870088b286430c23920c66d0c64ddc55a4e8a9e7e4e961a11e6af7816bb02fc')
 
 declare -gA _system_libs=(
     [brotli]=brotli