Review Results

Comment

The only change in this .SRCINFO diff is a version bump from 6.5-5 to 6.6-1. No build logic, sources, checksums, install scripts, or package metadata affecting trust boundaries were modified in the provided hunk. On its face this is a routine package update with no security-relevant red flags visible in the reviewed change.

@@ -1,7 +1,7 @@
 pkgbase = pi-hole-core
 	pkgdesc = The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.
-	pkgver = 6.5
-	pkgrel = 5
+	pkgver = 6.6
+	pkgrel = 1
 	url = https://github.com/pi-hole/pi-hole
 	install = pi-hole-core.install
 	arch = any

Comment

The .SRCINFO change is a straightforward version bump from 6.5 to 6.6 with the corresponding source tarball and checksum update. No new sources, no protocol downgrade, no added build-time network fetches, and no packaging metadata changes that would suggest privilege escalation or persistence. Based on the diff shown, this is low risk.

@@ -21,14 +21,14 @@ pkgbase = pi-hole-core
 	provides = pi-hole-server
 	conflicts = pi-hole-standalone
 	conflicts = pi-hole-server
-	source = pi-hole-core-6.5.tar.gz::https://github.com/pi-hole/pi-hole/archive/refs/tags/v6.5.tar.gz
+	source = pi-hole-core-6.6.tar.gz::https://github.com/pi-hole/pi-hole/archive/refs/tags/v6.6.tar.gz
 	source = arch-core.patch
 	source = pi-hole.tmpfile
 	source = pi-hole-gravity.service
 	source = pi-hole-gravity.timer
 	source = mimic_basic-install.sh
 	source = piholeDebug.sh
-	sha256sums = 277a1115b3b3b3ee0c115a6496710539709eefcd34fb5015480cd0bf2785b3f7
+	sha256sums = 0d2b8eafd888a59a16f08f9cef7b3ab6e55a7a5adc4878fd12126f7c61602c4a
 	sha256sums = 6dd5182c1b744a76a93a4eb959e5faa15b8d68e825eae4ff8ad2a1e13deb52df
 	sha256sums = d09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e
 	sha256sums = b8f93892c98f8e7cac4890dc510e38e0aa471387868a416fbb01f35576ab0c6f

Comment

The change is a routine version bump from 6.5-5 to 6.6-1 with an updated source checksum. The source remains the official GitHub archive over HTTPS, and there are no new build-time commands, scripts, or packaging behaviors introduced by this diff. No integrity or persistence red flags are visible in the reviewed hunk.

@@ -4,8 +4,8 @@
 
 pkgname=pi-hole-core
 _pkgname=pi-hole
-pkgver=6.5
-pkgrel=5
+pkgver=6.6
+pkgrel=1
 pkgdesc='The Pi-hole is an advertising-aware DNS/Web server. Arch adaptation for lan wide DNS server.'
 arch=('any')
 license=('EUPL-1.2')

Comment

The change only bumps the upstream release version from 6.5 to 6.6 and updates the source checksum accordingly. The source remains an HTTPS GitHub tag archive, and there are no new build-time commands, network fetches, privilege changes, or packaging-path changes in this diff. I did not see any suspicious additions in the PKGBUILD hunk itself.

@@ -25,7 +25,7 @@ source=($pkgname-$pkgver.tar.gz::https://github.com/$_pkgname/$_pkgname/archive/
 	    mimic_basic-install.sh
 	    piholeDebug.sh
 )
-sha256sums=('277a1115b3b3b3ee0c115a6496710539709eefcd34fb5015480cd0bf2785b3f7'
+sha256sums=('0d2b8eafd888a59a16f08f9cef7b3ab6e55a7a5adc4878fd12126f7c61602c4a'
             '6dd5182c1b744a76a93a4eb959e5faa15b8d68e825eae4ff8ad2a1e13deb52df'
             'd09f9d10ebdfb6db24d4e1abff8cd09519a7b3f3878ef3974c26aa6838f74e7e'
             'b8f93892c98f8e7cac4890dc510e38e0aa471387868a416fbb01f35576ab0c6f'