Review Results

Comment

The change only bumps pkgver in .SRCINFO from 6.4.2 to 6.4.3 and does not alter sources, checksums, build steps, install scripts, or package metadata in any security-relevant way. No new network fetches, scripts, privileges, or persistence mechanisms are introduced by this diff. Based on the provided hunk alone, this is low risk.

@@ -1,6 +1,6 @@
 pkgbase = pi-hole-core
 	pkgdesc = The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.
-	pkgver = 6.4.2
+	pkgver = 6.4.3
 	pkgrel = 3
 	url = https://github.com/pi-hole/pi-hole
 	install = pi-hole-core.install

Comment

This is a routine version bump in .SRCINFO from Pi-hole 6.4.2 to 6.4.3, with the source URL still using HTTPS and pointing to the official upstream GitHub release archive. The checksum entries were updated accordingly. No new sources, scripts, or packaging behavior are introduced by this diff, and there are no signs of privilege escalation or persistence changes in the metadata shown. Risk is low.

@@ -23,7 +23,7 @@ pkgbase = pi-hole-core
 	conflicts = pi-hole-server
 	backup = etc/pihole/pihole.toml
 	backup = etc/sudoers.d/pihole
-	source = pi-hole-core-6.4.2.tar.gz::https://github.com/pi-hole/pi-hole/archive/refs/tags/v6.4.2.tar.gz
+	source = pi-hole-core-6.4.3.tar.gz::https://github.com/pi-hole/pi-hole/archive/refs/tags/v6.4.3.tar.gz
 	source = arch-core.patch
 	source = pi-hole.tmpfile
 	source = pi-hole-gravity.service

Comment

The change only updates .SRCINFO metadata for a version bump from 6.4.2 to 6.4.3 and refreshes the corresponding source checksums. The source URL remains the official GitHub release tarball over HTTPS, and there are no new sources, scripts, or packaging directives introduced in this diff. No security issues are evident from this metadata-only change.

@@ -32,8 +32,8 @@ pkgbase = pi-hole-core
 	source = pi-hole-logtruncate.timer
 	source = mimic_basic-install.sh
 	source = piholeDebug.sh
-	sha256sums = 49a766408659ac98094e9ed30f2666f41738a6a12828b089f235bcf7b13a0662
-	sha256sums = 1e252691adef17a2d722217337745f29601f59d2957f51b6aa50507b01af96bf
+	sha256sums = defe72687f90af45c3e735aa9bfabc01d1d75a3b3d6197e92c6216971859e57e
+	sha256sums = b78499e9600e3f31790ec82e46eaf90a0c6136e40a60c6e6c800ee4ebd2afee4
 	sha256sums = d09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e
 	sha256sums = 9b72d7769036f8f4bb7121968d2ae4bdba427e4b16787ce340205a5f62b45c7c
 	sha256sums = 5228b4f923eab7784952a0fd6da895e7bff2f80a7f91c4a7c6350491dfdbb2e8

Comment

The change only bumps pkgver from 6.4.2 to 6.4.3 in PKGBUILD. No source URLs, checksums, build steps, install scripts, permissions, or dependency changes are introduced by this diff, so there is no new security-relevant behavior to assess from the provided hunk.

@@ -4,7 +4,7 @@
 
 pkgname=pi-hole-core
 _pkgname=pi-hole
-pkgver=6.4.2
+pkgver=6.4.3
 pkgrel=3
 pkgdesc='The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.'
 arch=('any')

Comment

The PKGBUILD change only updates the package version and refreshes the source checksums to match the new upstream tarball and accompanying local files. I did not see any new sources, build-time network fetches, privilege escalation, or packaging logic changes in this hunk. The broader diff for this package includes systemd/sudoers and script changes, but those are outside the single PKGBUILD checksum/version update shown here. Based on this hunk alone, risk is low.

@@ -28,8 +28,8 @@ source=($pkgname-$pkgver.tar.gz::https://github.com/$_pkgname/$_pkgname/archive/
 	    mimic_basic-install.sh
 	    piholeDebug.sh
 )
-sha256sums=('49a766408659ac98094e9ed30f2666f41738a6a12828b089f235bcf7b13a0662'
-            '1e252691adef17a2d722217337745f29601f59d2957f51b6aa50507b01af96bf'
+sha256sums=('defe72687f90af45c3e735aa9bfabc01d1d75a3b3d6197e92c6216971859e57e'
+            'b78499e9600e3f31790ec82e46eaf90a0c6136e40a60c6e6c800ee4ebd2afee4'
             'd09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e'
             '9b72d7769036f8f4bb7121968d2ae4bdba427e4b16787ce340205a5f62b45c7c'
             '5228b4f923eab7784952a0fd6da895e7bff2f80a7f91c4a7c6350491dfdbb2e8'

Comment

The patch changes logrotate targets from /var/log/pihole to /run/log/pihole and switches from copytruncate to create, which is a packaging/runtime behavior change but not inherently malicious. The added sudoers file grants the pihole user passwordless execution of /usr/bin/pihole as root, which is a significant privilege-escalation/persistence surface if the package installs that file or enables it automatically. However, in the provided diff hunk the sudoers file is only introduced as a template and there is no evidence here of automatic installation or additional commands beyond the expected pihole binary. Overall this is a moderate-risk change because it introduces a root-privilege mechanism that must be carefully justified and audited in surrounding packaging logic.

@@ -83,25 +83,25 @@ diff -uprN pi-hole-6.3/advanced/Templates/logrotate pi-hole-6.3.cust/advanced/Te
 +/run/log/pihole/pihole.log {
      # su #
      daily
-     copytruncate
-@@ -9,7 +9,7 @@
-     nomail
+     create 640 pihole pihole
+@@ -13,7 +13,7 @@
  }
- 
+
+ # FTL.log and webserver.log are opened and closed for each line, therefore no postrotate is needed
 -/var/log/pihole/FTL.log {
 +/run/log/pihole/FTL.log {
      # su #
      weekly
-     copytruncate
-@@ -20,7 +20,7 @@
+     create 640 pihole pihole
+@@ -24,7 +24,7 @@
      nomail
  }
- 
+
 -/var/log/pihole/webserver.log {
 +/run/log/pihole/webserver.log {
      # su #
      weekly
-     copytruncate
+     create 640 pihole pihole
 diff -uprN pi-hole-6.3/advanced/Templates/pihole.sudo pi-hole-6.3.cust/advanced/Templates/pihole.sudo
 --- pi-hole-6.3/advanced/Templates/pihole.sudo	1970-01-01 01:00:00.000000000 +0100
 +++ pi-hole-6.3.cust/advanced/Templates/pihole.sudo	2025-11-27 23:02:14.748944993 +0100