Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 2 to 3. No source URLs, build logic, dependencies, install scripts, or packaged artifacts are modified here, so there is no security-relevant behavior change to assess from this diff alone.

@@ -1,7 +1,7 @@
 pkgbase = pi-hole-core
 	pkgdesc = The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.
 	pkgver = 6.5
-	pkgrel = 2
+	pkgrel = 3
 	url = https://github.com/pi-hole/pi-hole
 	install = pi-hole-core.install
 	arch = any

Comment

The .SRCINFO change is limited to a pkgrel bump and a single updated sha256 checksum for one source file. There is no evidence here of a new source URL, added build-time network access, privilege escalation, or other malicious packaging behavior. The checksum change is consistent with a corresponding source artifact update in the package metadata, but by itself it does not indicate a security issue in this diff hunk.

@@ -33,7 +33,7 @@ pkgbase = pi-hole-core
 	sha256sums = 6dd5182c1b744a76a93a4eb959e5faa15b8d68e825eae4ff8ad2a1e13deb52df
 	sha256sums = d09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e
 	sha256sums = b8f93892c98f8e7cac4890dc510e38e0aa471387868a416fbb01f35576ab0c6f
-	sha256sums = 5228b4f923eab7784952a0fd6da895e7bff2f80a7f91c4a7c6350491dfdbb2e8
+	sha256sums = 4cf95831215536bea184468d3dc7a43e88e86c550516b7d12381d37cf30adf9b
 	sha256sums = 27288535f7d5e18c73b9fe13aa0bcd78a2fd935cb2e978c70d51b0439c87844f
 	sha256sums = 69a71c29dbe42ef0cbd3655fd7ce5cf04e8a77e27a5b2c3a1fcce0b544223309
 

Comment

The change only bumps pkgrel from 2 to 3 in PKGBUILD. No source URLs, build steps, dependencies, install scripts, or packaging logic changed, so there is no new security-relevant behavior introduced by this diff.

@@ -5,7 +5,7 @@
 pkgname=pi-hole-core
 _pkgname=pi-hole
 pkgver=6.5
-pkgrel=2
+pkgrel=3
 pkgdesc='The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.'
 arch=('any')
 license=('EUPL-1.2')

Comment

The change only bumps pkgrel and updates one sha256 checksum in PKGBUILD. There are no new sources, no build logic changes, no added scripts, and no evidence of network access or privilege-related behavior. Based on the diff alone this appears to be a routine integrity checksum refresh for an existing source artifact, with no security red flags introduced by the change.

@@ -30,7 +30,7 @@ sha256sums=('277a1115b3b3b3ee0c115a6496710539709eefcd34fb5015480cd0bf2785b3f7'
             '6dd5182c1b744a76a93a4eb959e5faa15b8d68e825eae4ff8ad2a1e13deb52df'
             'd09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e'
             'b8f93892c98f8e7cac4890dc510e38e0aa471387868a416fbb01f35576ab0c6f'
-            '5228b4f923eab7784952a0fd6da895e7bff2f80a7f91c4a7c6350491dfdbb2e8'
+            '4cf95831215536bea184468d3dc7a43e88e86c550516b7d12381d37cf30adf9b'
             '27288535f7d5e18c73b9fe13aa0bcd78a2fd935cb2e978c70d51b0439c87844f'
             '69a71c29dbe42ef0cbd3655fd7ce5cf04e8a77e27a5b2c3a1fcce0b544223309')
 

Comment

The change removes the initial gravity/adlist generation from the post_install script, which reduces post-install side effects and avoids running the networked list-update step as root via sudo. The remaining actions are limited to sysusers, chown, and updatecheck.sh as the pihole user, which are expected for package setup. No new suspicious downloads, privilege escalation, or persistence mechanisms are introduced by this diff.

@@ -1,16 +1,10 @@
 post_install() {
   echo -e "\e[1;33m==>\e[0m Read setup instructions at \e[1;36mhttps://wiki.archlinux.org/index.php/Pi-hole\e[0m"
-  echo -e "\e[1;33m==>\e[0m Generating initial block list, please wait...\e[0m"
 
   # pre apply sys user creation and rights
   /usr/bin/systemd-sysusers > /dev/null 2>&1
   /usr/bin/chown -R pihole:pihole /etc/pihole
 
-  # update lists on first run
-  echo -e "\e[1;33m==>\e[0m Creating initial adlists...\e[0m"
-  sudo -u pihole bash /opt/pihole/gravity.sh --force > /dev/null 2>&1;
-  # pihole -g > /dev/null
-
   # /etc/pihole/versions file generation
   echo -e "\e[1;33m==>\e[0m Creating 'versions' file...\e[0m"
   sudo -u pihole bash /opt/pihole/updatecheck.sh;

Comment

The change only modifies a systemd timer unit. Adding [Install]/WantedBy=timers.target is standard packaging hygiene so the timer can be enabled normally, and OnActiveSec=10s simply causes the timer to fire shortly after activation in addition to the existing weekly schedule. I do not see any network, privilege escalation, persistence beyond the intended timer, or other suspicious behavior in this diff. The only potential concern is that the timer will now run once 10 seconds after being started, but for a gravity-update timer that is consistent with expected behavior and not inherently malicious.

@@ -2,6 +2,10 @@
 Description=Weekly ad-serving domains gathering
 
 [Timer]
+OnActiveSec=10s
 OnCalendar=weekly
 AccuracySec=3h
 Persistent=true
+
+[Install]
+WantedBy=timers.target