Review Results

Comment

The only change in this .SRCINFO hunk is a pkgrel bump from 4 to 5. This is metadata-only and does not alter sources, build steps, install scripts, dependencies, or shipped artifacts. No security-relevant behavior is introduced by this diff alone.

@@ -1,7 +1,7 @@
 pkgbase = pi-hole-core
 	pkgdesc = The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.
 	pkgver = 6.5
-	pkgrel = 4
+	pkgrel = 5
 	url = https://github.com/pi-hole/pi-hole
 	install = pi-hole-core.install
 	arch = any

Comment

This change only bumps pkgrel from 4 to 5 in PKGBUILD and does not alter sources, build steps, dependencies, install scripts, or packaging behavior. No security-relevant content changed in the reviewed hunk.

@@ -5,7 +5,7 @@
 pkgname=pi-hole-core
 _pkgname=pi-hole
 pkgver=6.5
-pkgrel=4
+pkgrel=5
 pkgdesc='The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.'
 arch=('any')
 license=('EUPL-1.2')

Comment

The change removes the package-created symlink that enabled the gravity timer via `multi-user.target.wants/`. That is a packaging behavior change, but it does not introduce any new code execution, network access, privilege escalation, or integrity risk. The remaining change only fixes quoting around an `install` path and leaves the unit file installed without auto-enabling it. No suspicious sources, scripts, or persistence mechanisms were added in this diff.

@@ -65,9 +65,7 @@ package() {
   install -Dm644 pi-hole.tmpfile "$pkgdir"/usr/lib/tmpfiles.d/pi-hole.conf
 
   install -Dm644 "$_pkgname-gravity.timer" "$pkgdir/usr/lib/systemd/system/$_pkgname-gravity.timer"
-  install -Dm644 "$_pkgname-gravity.service" $pkgdir/usr/lib/systemd/system/$_pkgname-gravity.service
-  install -dm755 "$pkgdir/usr/lib/systemd/system/multi-user.target.wants"
-  ln -s ../$_pkgname-gravity.timer "$pkgdir/usr/lib/systemd/system/multi-user.target.wants/$_pkgname-gravity.timer"
+  install -Dm644 "$_pkgname-gravity.service" "$pkgdir/usr/lib/systemd/system/$_pkgname-gravity.service"
 
   install -dm755 "$pkgdir"/etc/pihole
   install -Dm644 $_pkgname-$pkgver/advanced/Templates/logrotate "$pkgdir"/etc/logrotate.d/pihole

Comment

The added post_install message is harmless. The only behavioral change is in post_upgrade: for upgrades from versions older than 6.5-5, it now runs `systemctl enable pi-hole-gravity.timer` unless the unit is masked. This is a root-executed install script action, but it is narrowly scoped to enabling the package's own timer to preserve expected functionality for older installs. It does not download code, modify unrelated system state, or introduce persistence beyond the intended service timer. No high-risk security issue is evident in this diff.

@@ -8,6 +8,9 @@ post_install() {
   # /etc/pihole/versions file generation
   echo -e "\e[1;33m==>\e[0m Creating 'versions' file...\e[0m"
   sudo -u pihole bash /opt/pihole/updatecheck.sh;
+
+  # the gravity timer is not enabled by default
+  echo -e "\e[1;33m==>\e[0m For weekly blocklist updates: \e[1;36msystemctl enable --now pi-hole-gravity.timer\e[0m"
 }
 
 post_upgrade() {

Comment

The change is low risk. It only adds a post-upgrade compatibility check in the .install script to re-enable an existing systemd timer for older installs, and a user-facing echo in post_install. There is no new network access, no privilege escalation beyond the existing root-run install script context, and no modification outside the expected systemd enablement path. The only action performed is `systemctl enable pi-hole-gravity.timer` when upgrading from versions older than 6.5-5 and the timer is not masked, which is consistent with the package’s intended functionality.

@@ -20,6 +23,12 @@ post_upgrade() {
   echo -e "\e[1;33m==>\e[0m Updating 'versions' file...\e[0m"
   sudo -u pihole bash /opt/pihole/updatecheck.sh;
 
+  # 6.5-4 and older shipped an enable symlink: keep the timer on for those installs
+  if [ "$(vercmp "$2" 6.5-5)" -lt 0 ] &&
+     [ "$(systemctl is-enabled pi-hole-gravity.timer 2>/dev/null)" != masked ]; then
+    systemctl enable pi-hole-gravity.timer
+  fi
+
   # keep pacman from throwing errors should none them be on the filesystem
   return 0
 }