the problem is for :

_sha1_naclsdk_linux="$(curl -sL "http://gsdview.appspot.com/nativeclient-archive2/toolchain/${_toolchains_rev}/naclsdk_linux_x86.tgz.sha1hash")"
_sha1_toolchain_linux="$(curl -sL "http://gsdview.appspot.com/nativeclient-archive2/x86_toolchain/r${_toolchains_rev}/toolchain_linux_x86.tar.bz2.sha1hash")"
_sha1_naclsdk_pnacl_linux="$(curl -sL "http://gsdview.appspot.com/nativeclient-archive2/toolchain/${_toolchains_rev}/naclsdk_pnacl_linux_x86.tgz.sha1hash")"

sha1sums+=("${_naclsdk_nacl_sha1sum}"
# "${_naclsdk_pnacl_sha1sum}"
"${_naclsdk_toolchain_sha1sum}")

namcap not execute code, and search 40 digit (betheen 0-9 and a-f)

the comment out has nothing to do

This is not something we should even try to fix. Namcap doesn't execute the bash code in pkgbuilds, but this package takes insanity to the next level by downloading checksums using curl. How can you be sure that the source and checksum is what the maintainer of the package initially checked in?

i'am the maintainer of this package

https://aur.archlinux.org/packages/chromium-dev/
https://aur.archlinux.org/packages/ch/chromium-dev/PKGBUILD

get sha1sums directly from google servers

have use this method in this package since version 14 (+/-) (before with wget and cat lol). never failed

Your method defeats the purpose of checksums. If someone replaces the files on the server by something else, your PKGBUILD can build a completely different package without anyone noticing. If someone manages to hack a server and insert a trojan there, then your PKGBUILD will silently fetch the new checksum and start building an infected version of chromium.

then, for example, RPM distros have the same hole, because the checksums stored in the metadata file upload in the respective repository

like http://dl.google.com/linux/chrome/rpm/stable/x86_64/repodata/filelists.xml.gz

i belive if the google ship the sha1sums file in the download server is for something (my english is bad, sorry for this)

we must also take very fat balls to hack google....

Checksums have two purposes: validating that your download was correct, and validating that your download is the same as the last time you downloaded it. Your method is only good enough to validate that your download isn't corrupt, but your method doesn't warn you in any way that something has changed since the last download.

Anyways, this is not something that should get fixed in namcap. Nice for you that it works because makepkg sources your PKGBUILD and executes your variable code, but checksum validation is not designed this way.

in ths case, this method working like expected. dowload exactly version need and check exactly checksum of this targzs

sorry for the offtopic

on ontopic, yes, the "problem" is the pkgbuild, not the namcap