Review Results

Comment

The only change in this diff is a pkgrel bump from 4 to 5 in .SRCINFO. This is metadata-only and does not alter sources, build steps, install scripts, dependencies, permissions, or any executable content. No security-relevant behavior is introduced by this change.

@@ -1,7 +1,7 @@
 pkgbase = pi-hole-core
 	pkgdesc = The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.
 	pkgver = 6.4.3
-	pkgrel = 4
+	pkgrel = 5
 	url = https://github.com/pi-hole/pi-hole
 	install = pi-hole-core.install
 	arch = any

Comment

The change only bumps pkgrel from 4 to 5 and updates the SHA256 checksum for one declared source file in .SRCINFO. There is no evidence here of new sources, network fetches, privilege changes, install-script behavior, or other execution-path changes. Since .SRCINFO is metadata only, this looks like a routine integrity metadata refresh rather than a security-relevant modification.

@@ -33,7 +33,7 @@ pkgbase = pi-hole-core
 	source = mimic_basic-install.sh
 	source = piholeDebug.sh
 	sha256sums = defe72687f90af45c3e735aa9bfabc01d1d75a3b3d6197e92c6216971859e57e
-	sha256sums = b78499e9600e3f31790ec82e46eaf90a0c6136e40a60c6e6c800ee4ebd2afee4
+	sha256sums = cc3b1864234eae8b5501cc4ef53645f44d3c6cb98c1e60f2e94ae173ab586fc2
 	sha256sums = d09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e
 	sha256sums = 9b72d7769036f8f4bb7121968d2ae4bdba427e4b16787ce340205a5f62b45c7c
 	sha256sums = 5228b4f923eab7784952a0fd6da895e7bff2f80a7f91c4a7c6350491dfdbb2e8

Comment

This change only bumps pkgrel from 4 to 5 in PKGBUILD and does not alter sources, build steps, dependencies, install scripts, or package contents. No security-relevant behavior is introduced by the diff shown.

@@ -5,7 +5,7 @@
 pkgname=pi-hole-core
 _pkgname=pi-hole
 pkgver=6.4.3
-pkgrel=4
+pkgrel=5
 pkgdesc='The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.'
 arch=('any')
 license=('EUPL-1.2')

Comment

The change only bumps pkgrel and updates the SHA256 checksum for one existing source file in PKGBUILD. No new sources, URLs, build steps, install scripts, permissions, or package metadata were introduced. Based on the diff alone, this appears to be a benign integrity checksum refresh rather than a security-relevant change.

@@ -29,7 +29,7 @@ source=($pkgname-$pkgver.tar.gz::https://github.com/$_pkgname/$_pkgname/archive/
 	    piholeDebug.sh
 )
 sha256sums=('defe72687f90af45c3e735aa9bfabc01d1d75a3b3d6197e92c6216971859e57e'
-            'b78499e9600e3f31790ec82e46eaf90a0c6136e40a60c6e6c800ee4ebd2afee4'
+            'cc3b1864234eae8b5501cc4ef53645f44d3c6cb98c1e60f2e94ae173ab586fc2'
             'd09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e'
             '9b72d7769036f8f4bb7121968d2ae4bdba427e4b16787ce340205a5f62b45c7c'
             '5228b4f923eab7784952a0fd6da895e7bff2f80a7f91c4a7c6350491dfdbb2e8'

Comment

The patch removes the remote-version/hash lookups from updatecheck.sh for Core, Web, and FTL and leaves only local/build-tarball values. This is a packaging-oriented change that reduces network dependence during version checks and does not introduce new execution paths, privilege changes, persistence, or integrity risks. I did not see any added downloads, shell injection, or suspicious install-time behavior in the reviewed hunk.

@@ -38,10 +38,9 @@ diff -uprN pi-hole-6.3/advanced/Scripts/piholeLogFlush.sh pi-hole-6.3.cust/advan
      if [[ "$*" != *"quiet"* ]]; then
          echo -e "${OVER}  ${TICK} Deleted ${deleted} queries from long-term query database"
      fi
-diff -uprN pi-hole-6.3/advanced/Scripts/updatecheck.sh pi-hole-6.3.cust/advanced/Scripts/updatecheck.sh
---- pi-hole-6.3/advanced/Scripts/updatecheck.sh	2025-11-27 19:10:51.000000000 +0100
-+++ pi-hole-6.3.cust/advanced/Scripts/updatecheck.sh	2025-11-27 23:02:14.694012168 +0100
-@@ -71,13 +71,13 @@ fi
+--- pi-hole-6.3/advanced/Scripts/updatecheck.sh	2026-09-17 21:24:04.695634438 +0200
++++ pi-hole-6.3.cust/advanced/Scripts/updatecheck.sh	2026-09-17 21:24:23.221678486 +0200
+@@ -74,38 +74,26 @@ fi
  
  # get Core versions
  

Comment

The reviewed hunk removes the upstream remote-version/hash lookups from updatecheck.sh. That change is security-positive or neutral: it eliminates network-based metadata fetching during the update check path and replaces it with locally derived package versions already present on the system. I do not see any new execution, privilege, persistence, or integrity risks introduced by this hunk. The only effect is reduced update metadata reporting, not a security regression.

@@ -57,9 +56,12 @@ diff -uprN pi-hole-6.3/advanced/Scripts/updatecheck.sh pi-hole-6.3.cust/advanced
 +CORE_HASH="builtfromreleasetarball"
  addOrEditKeyValPair "${VERSION_FILE}" "CORE_HASH" "${CORE_HASH}"
  
- GITHUB_CORE_VERSION="$(get_remote_version pi-hole "${CORE_BRANCH}")"
-@@ -88,13 +88,13 @@ addOrEditKeyValPair "${VERSION_FILE}" "G
- 
+-GITHUB_CORE_VERSION="$(get_remote_version pi-hole "${CORE_BRANCH}")"
+-addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_CORE_VERSION" "${GITHUB_CORE_VERSION}"
+-
+-GITHUB_CORE_HASH="$(get_remote_hash pi-hole "${CORE_BRANCH}")"
+-addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_CORE_HASH" "${GITHUB_CORE_HASH}"
+-
  # get Web versions
  
 -WEB_VERSION="$(get_local_version "${ADMIN_INTERFACE_DIR}")"

Comment

The patch removes several `get_remote_version`/`get_remote_hash` calls from `advanced/Scripts/updatecheck.sh`, so the package no longer records upstream GitHub version/hash metadata for the web and FTL components. This is a packaging/telemetry change, not an obvious security backdoor: it does not add network access, privilege escalation, persistence, or code execution. The remaining logic still uses locally installed component versions/hashes, and the diff shown does not introduce suspicious sources or install-time behavior. Risk is low.

@@ -74,7 +76,28 @@ diff -uprN pi-hole-6.3/advanced/Scripts/updatecheck.sh pi-hole-6.3.cust/advanced
 +WEB_HASH="builtfromreleasetarball"
  addOrEditKeyValPair "${VERSION_FILE}" "WEB_HASH" "${WEB_HASH}"
  
- GITHUB_WEB_VERSION="$(get_remote_version web "${WEB_BRANCH}")"
+-GITHUB_WEB_VERSION="$(get_remote_version web "${WEB_BRANCH}")"
+-addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_WEB_VERSION" "${GITHUB_WEB_VERSION}"
+-
+-GITHUB_WEB_HASH="$(get_remote_hash web "${WEB_BRANCH}")"
+-addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_WEB_HASH" "${GITHUB_WEB_HASH}"
+-
+ # get FTL versions
+ 
+ FTL_VERSION="$(pihole-FTL version)"
+@@ -117,12 +105,6 @@ addOrEditKeyValPair "${VERSION_FILE}" "F
+ FTL_HASH="$(pihole-FTL --hash)"
+ addOrEditKeyValPair "${VERSION_FILE}" "FTL_HASH" "${FTL_HASH}"
+ 
+-GITHUB_FTL_VERSION="$(get_remote_version FTL "${FTL_BRANCH}")"
+-addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_FTL_VERSION" "${GITHUB_FTL_VERSION}"
+-
+-GITHUB_FTL_HASH="$(get_remote_hash FTL "${FTL_BRANCH}")"
+-addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_FTL_HASH" "${GITHUB_FTL_HASH}"
+-
+ # get Docker versions
+ 
+ if [[ "${DOCKER_TAG}" ]]; then
 diff -uprN pi-hole-6.3/advanced/Templates/logrotate pi-hole-6.3.cust/advanced/Templates/logrotate
 --- pi-hole-6.3/advanced/Templates/logrotate	2025-11-27 19:10:51.000000000 +0100
 +++ pi-hole-6.3.cust/advanced/Templates/logrotate	2025-11-27 23:02:14.747450448 +0100