AUR AI Reviewer

Review Results

Version #2824 of pi-hole-core · commit 6e188e4c5ab0 · status Reviewed

Risk 0/5 · Safe .SRCINFO
Result #5069

Comment

The change only bumps pkgver/pkgrel in .SRCINFO from 6.4.3-6 to 6.5-1. No sources, checksums, build steps, install scripts, or package metadata affecting execution/persistence were modified in the provided diff hunk. On its face this is a routine version metadata update with no security impact visible in this change alone.

@@ -1,7 +1,7 @@
 pkgbase = pi-hole-core
 	pkgdesc = The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.
-	pkgver = 6.4.3
-	pkgrel = 6
+	pkgver = 6.5
+	pkgrel = 1
 	url = https://github.com/pi-hole/pi-hole
 	install = pi-hole-core.install
 	arch = any
Risk 0/5 · Safe .SRCINFO
Result #5070

Comment

The change is a straightforward version bump in .SRCINFO from 6.4.3 to 6.5, with the source URL still pointing to the official Pi-hole GitHub release archive over HTTPS. No new sources, scripts, or packaging directives were introduced, and the checksum updates are expected for the new release tarball. Based on this diff alone, I do not see a security issue.

@@ -23,7 +23,7 @@ pkgbase = pi-hole-core
 	conflicts = pi-hole-server
 	backup = etc/pihole/pihole.toml
 	backup = etc/sudoers.d/pihole
-	source = pi-hole-core-6.4.3.tar.gz::https://github.com/pi-hole/pi-hole/archive/refs/tags/v6.4.3.tar.gz
+	source = pi-hole-core-6.5.tar.gz::https://github.com/pi-hole/pi-hole/archive/refs/tags/v6.5.tar.gz
 	source = arch-core.patch
 	source = pi-hole.tmpfile
 	source = pi-hole-gravity.service
Risk 0/5 · Safe .SRCINFO
Result #5071

Comment

The .SRCINFO update is a routine version bump from 6.4.3 to 6.5 with corresponding checksum refreshes for the upstream tarball and one additional source file. The source remains an HTTPS GitHub release tag, and there are no signs in this diff of added execution, new sources, privilege escalation, or packaging-policy red flags. Based on the provided hunk alone, this change appears low risk.

@@ -33,8 +33,8 @@ pkgbase = pi-hole-core
 	source = mimic_basic-install.sh
 	source = piholeDebug.sh
 	source = pihole.sudo
-	sha256sums = defe72687f90af45c3e735aa9bfabc01d1d75a3b3d6197e92c6216971859e57e
-	sha256sums = 8c03411068b01c83d2128c00d641e6e11278c3fc2032f59a847c4136fae09097
+	sha256sums = 277a1115b3b3b3ee0c115a6496710539709eefcd34fb5015480cd0bf2785b3f7
+	sha256sums = 6dd5182c1b744a76a93a4eb959e5faa15b8d68e825eae4ff8ad2a1e13deb52df
 	sha256sums = d09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e
 	sha256sums = 9b72d7769036f8f4bb7121968d2ae4bdba427e4b16787ce340205a5f62b45c7c
 	sha256sums = 5228b4f923eab7784952a0fd6da895e7bff2f80a7f91c4a7c6350491dfdbb2e8
Risk 0/5 · Safe PKGBUILD
Result #5072

Comment

The change only bumps pkgver from 6.4.3 to 6.5 and resets pkgrel from 6 to 1. No source URLs, checksums, build steps, install scripts, or packaging logic are modified in the provided diff hunk, so there is no new security-relevant behavior introduced here. Based on this hunk alone, the update appears low risk.

@@ -4,8 +4,8 @@
 
 pkgname=pi-hole-core
 _pkgname=pi-hole
-pkgver=6.4.3
-pkgrel=6
+pkgver=6.5
+pkgrel=1
 pkgdesc='The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.'
 arch=('any')
 license=('EUPL-1.2')
Risk 0/5 · Safe PKGBUILD
Result #5073

Comment

The change is a routine version bump in PKGBUILD from 6.4.3-6 to 6.5-1 with updated checksums for the upstream tarball and one auxiliary script. The source remains pinned to a GitHub release archive over HTTPS, there are no new sources, no build-time network fetches, and no packaging logic changes that would introduce privilege escalation or persistence. I do not see any security-relevant red flags in this diff alone.

@@ -29,8 +29,8 @@ source=($pkgname-$pkgver.tar.gz::https://github.com/$_pkgname/$_pkgname/archive/
 	    piholeDebug.sh
 	    pihole.sudo
 )
-sha256sums=('defe72687f90af45c3e735aa9bfabc01d1d75a3b3d6197e92c6216971859e57e'
-            '8c03411068b01c83d2128c00d641e6e11278c3fc2032f59a847c4136fae09097'
+sha256sums=('277a1115b3b3b3ee0c115a6496710539709eefcd34fb5015480cd0bf2785b3f7'
+            '6dd5182c1b744a76a93a4eb959e5faa15b8d68e825eae4ff8ad2a1e13deb52df'
             'd09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e'
             '9b72d7769036f8f4bb7121968d2ae4bdba427e4b16787ce340205a5f62b45c7c'
             '5228b4f923eab7784952a0fd6da895e7bff2f80a7f91c4a7c6350491dfdbb2e8'
Risk 0/5 · Safe arch-core.patch
Result #5074

Comment

The patch only adjusts updatecheck.sh to use pacman -Q for installed package versions and writes all metadata into VERSION_FILE_TMP instead of VERSION_FILE, plus a service control call in piholeLogFlush.sh is switched from `service` to `systemctl`. I do not see any added network fetches, privilege escalation, persistence, or other malicious behavior in the provided hunk. The change appears to be packaging/compatibility cleanup for Arch Linux rather than a security-sensitive modification.

@@ -22,81 +22,65 @@ diff -uprN pi-hole-6.3/advanced/Scripts/piholeLogFlush.sh pi-hole-6.3.cust/advan
  fi
  FTLFILE=$(getFTLConfigValue "files.log.ftl")
  if [ -z "$FTLFILE" ]; then
-@@ -105,13 +105,13 @@ else
-     fi
- 
-     # Stop FTL to make sure it doesn't write to the database while we're deleting data
--    service pihole-FTL stop
-+    systemctl stop pihole-FTL
- 
-     # Delete most recent 24 hours from FTL's database, leave even older data intact (don't wipe out all history)
-     deleted=$(pihole-FTL sqlite3 -ni "${DBFILE}" "DELETE FROM query_storage WHERE timestamp >= strftime('%s','now')-86400; select changes() from query_storage limit 1")
- 
-     # Restart FTL
--    service pihole-FTL restart
-+    systemctl restart pihole-FTL
-     if [[ "$*" != *"quiet"* ]]; then
-         echo -e "${OVER}  ${TICK} Deleted ${deleted} queries from long-term query database"
-     fi
 --- pi-hole-6.3/advanced/Scripts/updatecheck.sh	2026-09-17 21:24:04.695634438 +0200
 +++ pi-hole-6.3.cust/advanced/Scripts/updatecheck.sh	2026-09-17 21:24:23.221678486 +0200
-@@ -74,38 +74,26 @@ fi
- 
+@@ -91,38 +91,26 @@
+
  # get Core versions
- 
+
 -CORE_VERSION="$(get_local_version /etc/.pihole)"
 +CORE_VERSION="$(pacman -Q pi-hole-core | awk '{print $2}' | cut -d- -f1)"
- addOrEditKeyValPair "${VERSION_FILE}" "CORE_VERSION" "${CORE_VERSION}"
- 
+ addOrEditKeyValPair "${VERSION_FILE_TMP}" "CORE_VERSION" "${CORE_VERSION}"
+
 -CORE_BRANCH="$(get_local_branch /etc/.pihole)"
 +CORE_BRANCH="master"
- addOrEditKeyValPair "${VERSION_FILE}" "CORE_BRANCH" "${CORE_BRANCH}"
- 
+ addOrEditKeyValPair "${VERSION_FILE_TMP}" "CORE_BRANCH" "${CORE_BRANCH}"
+
 -CORE_HASH="$(get_local_hash /etc/.pihole)"
 +CORE_HASH="builtfromreleasetarball"
- addOrEditKeyValPair "${VERSION_FILE}" "CORE_HASH" "${CORE_HASH}"
- 
+ addOrEditKeyValPair "${VERSION_FILE_TMP}" "CORE_HASH" "${CORE_HASH}"
+
 -GITHUB_CORE_VERSION="$(get_remote_version pi-hole "${CORE_BRANCH}")"
--addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_CORE_VERSION" "${GITHUB_CORE_VERSION}"
+-addOrEditKeyValPair "${VERSION_FILE_TMP}" "GITHUB_CORE_VERSION" "${GITHUB_CORE_VERSION}"
 -
 -GITHUB_CORE_HASH="$(get_remote_hash pi-hole "${CORE_BRANCH}")"
--addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_CORE_HASH" "${GITHUB_CORE_HASH}"
+-addOrEditKeyValPair "${VERSION_FILE_TMP}" "GITHUB_CORE_HASH" "${GITHUB_CORE_HASH}"
 -
  # get Web versions
- 
+
 -WEB_VERSION="$(get_local_version "${ADMIN_INTERFACE_DIR}")"
 +WEB_VERSION="$(pacman -Q pi-hole-web | awk '{print $2}' | cut -d- -f1)"
- addOrEditKeyValPair "${VERSION_FILE}" "WEB_VERSION" "${WEB_VERSION}"
- 
+ addOrEditKeyValPair "${VERSION_FILE_TMP}" "WEB_VERSION" "${WEB_VERSION}"
+
 -WEB_BRANCH="$(get_local_branch "${ADMIN_INTERFACE_DIR}")"
 +WEB_BRANCH="master"
- addOrEditKeyValPair "${VERSION_FILE}" "WEB_BRANCH" "${WEB_BRANCH}"
- 
+ addOrEditKeyValPair "${VERSION_FILE_TMP}" "WEB_BRANCH" "${WEB_BRANCH}"
+
 -WEB_HASH="$(get_local_hash "${ADMIN_INTERFACE_DIR}")"
 +WEB_HASH="builtfromreleasetarball"
- addOrEditKeyValPair "${VERSION_FILE}" "WEB_HASH" "${WEB_HASH}"
- 
+ addOrEditKeyValPair "${VERSION_FILE_TMP}" "WEB_HASH" "${WEB_HASH}"
+
 -GITHUB_WEB_VERSION="$(get_remote_version web "${WEB_BRANCH}")"
--addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_WEB_VERSION" "${GITHUB_WEB_VERSION}"
+-addOrEditKeyValPair "${VERSION_FILE_TMP}" "GITHUB_WEB_VERSION" "${GITHUB_WEB_VERSION}"
 -
 -GITHUB_WEB_HASH="$(get_remote_hash web "${WEB_BRANCH}")"
--addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_WEB_HASH" "${GITHUB_WEB_HASH}"
+-addOrEditKeyValPair "${VERSION_FILE_TMP}" "GITHUB_WEB_HASH" "${GITHUB_WEB_HASH}"
 -
  # get FTL versions
- 
+
  FTL_VERSION="$(pihole-FTL version)"
-@@ -117,12 +105,6 @@ addOrEditKeyValPair "${VERSION_FILE}" "F
+@@ -134,12 +122,6 @@
  FTL_HASH="$(pihole-FTL --hash)"
- addOrEditKeyValPair "${VERSION_FILE}" "FTL_HASH" "${FTL_HASH}"
- 
+ addOrEditKeyValPair "${VERSION_FILE_TMP}" "FTL_HASH" "${FTL_HASH}"
+
 -GITHUB_FTL_VERSION="$(get_remote_version FTL "${FTL_BRANCH}")"
--addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_FTL_VERSION" "${GITHUB_FTL_VERSION}"
+-addOrEditKeyValPair "${VERSION_FILE_TMP}" "GITHUB_FTL_VERSION" "${GITHUB_FTL_VERSION}"
 -
 -GITHUB_FTL_HASH="$(get_remote_hash FTL "${FTL_BRANCH}")"
--addOrEditKeyValPair "${VERSION_FILE}" "GITHUB_FTL_HASH" "${GITHUB_FTL_HASH}"
+-addOrEditKeyValPair "${VERSION_FILE_TMP}" "GITHUB_FTL_HASH" "${GITHUB_FTL_HASH}"
 -
  # get Docker versions
- 
+
  if [[ "${DOCKER_TAG}" ]]; then
 diff -uprN pi-hole-6.3/advanced/Templates/logrotate pi-hole-6.3.cust/advanced/Templates/logrotate
 --- pi-hole-6.3/advanced/Templates/logrotate	2025-11-27 19:10:51.000000000 +0100
Risk 0/5 · Safe arch-core.patch
Result #5075

Comment

The patch only adjusts Pi-hole's logrotate paths from /var/log/pihole to /run/log/pihole and updates updatecheck.sh to read installed package versions via pacman instead of local install metadata. I do not see any added network fetches, privilege escalation, persistence, or other malicious behavior in the reviewed hunk. The logrotate change is consistent with a runtime log location change and does not itself introduce a security issue.

@@ -107,20 +91,13 @@ diff -uprN pi-hole-6.3/advanced/Templates/logrotate pi-hole-6.3.cust/advanced/Te
      # su #
      daily
      create 640 pihole pihole
-@@ -13,7 +13,7 @@
- }
-
- # FTL.log and webserver.log are opened and closed for each line, therefore no postrotate is needed
--/var/log/pihole/FTL.log {
-+/run/log/pihole/FTL.log {
-     # su #
-     weekly
-     create 640 pihole pihole
-@@ -24,7 +24,7 @@
-     nomail
+@@ -13,8 +13,8 @@
+     endscript
  }
 
+-/var/log/pihole/FTL.log
 -/var/log/pihole/webserver.log {
++/run/log/pihole/FTL.log
 +/run/log/pihole/webserver.log {
      # su #
      weekly