Arch Linux User Repository

ArchLinux Pi-hole is not officially supported by Pi-hole project. In case of bugs and malfunctions please DO NOT file a report upstream.

First of all check if the wiki (https://wiki.archlinux.org/index.php/Pi-hole) can help then ask here for assistance and tips.
When it will be excluded that the problem does not depend on ArchLinux we will file a bug upstream.

the version from @rossome worked. my pihole is resolving DNS again. Thanks everyone.

One follow-up from testing this on a systemd-only Arch setup: I think the post_upgrade() call to /opt/pihole/updatecheck.sh should be removed from pi-hole-ftl.install.

updatecheck.sh performs remote GitHub queries for Core, Web, and FTL. Running it synchronously from a pacman transaction means an FTL upgrade can emit errors or stall briefly when networking/DNS is unavailable. This is especially awkward when Pi-hole itself is providing DNS.

Since version checking is a periodic maintenance task rather than something required to complete the package upgrade, it would be cleaner to keep it outside the pacman transaction. I have also suggested adding a native systemd update-check timer in pi-hole-core for systemd-only installations.

Proposed change:

 post_upgrade() {
-  # /etc/pihole/versions file generation
-  [ -f /opt/pihole/updatecheck.sh ] && sudo -u pihole bash /opt/pihole/updatecheck.sh;
-
   post_install $1
 }

This keeps the FTL package upgrade network-independent while allowing /etc/pihole/versions to be refreshed separately by the periodic systemd timer.

Version 6.7 is available. I tested a source build on current Arch/GCC 16 and have FTL 6.7 building, installing, and running successfully.

6.7 PKGBUILD

The changes I needed were:

• Keep the existing Nettle 4 base64_decode_update() patch.
• Remove the old global Nettle digest, strstr, and webserver.c const workarounds. These are already handled upstream in 6.7, and the const substitutions - actually produce const const char now.
• GCC 16 reports the unused i in sanitize_dns_hosts(). The workaround should be scoped specifically to that function, since the other validator loops actually use their i counters.
• Build against Arch's mbedtls3 compatibility package. Current mbedtls 4.x does not provide MBEDTLS_THREADING_C, which FTL 6.7 intentionally requires for the multithreaded CivetWeb server. I used /usr/include/mbedtls3 as a system include and explicitly linked the libraries under /usr/lib/mbedtls3.
• The GitHub release tarball has no .git directory. FTL's gen_version.cmake falls back to running Git commands, which can walk up into the AUR package checkout and embed unrelated metadata. My build consequently reported vDev-f2a924d instead of v6.7. FTL already supports GIT_BRANCH, GIT_HASH, GIT_VERSION, GIT_DATE, and GIT_TAG environment overrides, so these can be supplied from the release metadata while retaining the checksummed release tarball.

For v6.7 the upstream commit is fa65a88f8cdef1013594d4de14108077954faea4.

With the compatibility changes above, the resulting binary passes FTL's integrity check, all shared libraries resolve with ldd, and pihole-FTL.service starts and runs normally.

Can confirm, @no_gafam's suggestion to patch the PKGBUILD fixed the issue for me as well. @tonivade's suggestion to install mbedtls3 did not work for me unfortunately. I'm still getting an error about logrotate not being found (which I see mention in these comments that the directory has changed), but at least pihole is resolving DNS again, so I'll leave that alone until the fix is added.

Thanks all!!

You can fix the issue by adapting the new mbedtls4 syntax to the concerning lines in prepare():

sed -i 's/mbedtls_x509write_crt_pem(\([^,]*\), \([^,]*\), sizeof(\([^)]*\)))/mbedtls_x509write_crt_pem(\1, \2, sizeof(\3))/g' src/webserver/x509.c
sed -i 's/mbedtls_pk_parse_keyfile(\([^,]*\), \([^,]*\), NULL, NULL, NULL);/mbedtls_pk_parse_keyfile(\1, \2, NULL);/g' src/webserver/x509.c

The maintainer is probably just on vacation ^^

Temporary you can install mbedtls3 to fix the issue with mbedtls-4.1.0

With the release of mbedtls-4.1.0 this morning, it looks like the two sed commands under "Fix mbedtls 3.x API changes" are causing build errors. It looks like they're probably unnecessary now (at the very least, removing them got my build running).

I can confirm that @chlihug's patch works. Thank you! @pzarycki could you include it into the package?

The password issue is indeed a problem with nettle 4. Specifically its base64_decode_update function. The dst_length argument is now also an input and FTL always passes 0 at the moment.

An updated password.c can fix this by passing the correct buffer size.

diff --git a/src/config/password.c b/src/config/password.c
index a5f7035d..db6f6c51 100644
--- a/src/config/password.c
+++ b/src/config/password.c
@@ -170,13 +170,15 @@ static uint8_t * __attribute__((malloc)) base64_decode(const char *data, size_t
    // Base64 decoding requires 3 bytes for every 4 bytes of input, plus
    // additional bytes for padding. The output buffer must be large enough
    // to hold the decoded data.
-   uint8_t *decoded = calloc(BASE64_DECODE_LENGTH(strlen(data)), sizeof(uint8_t));
+   size_t decoded_length = BASE64_DECODE_LENGTH(strlen(data));
+   uint8_t *decoded = calloc(decoded_length, sizeof(uint8_t));

    // Decode the data
    struct base64_decode_ctx ctx;
    base64_decode_init(&ctx);
-   base64_decode_update(&ctx, length, decoded, strlen(data), data);
+   base64_decode_update(&ctx, &decoded_length, decoded, strlen(data), data);
    base64_decode_final(&ctx);
+   *length = decoded_length;

    return decoded;
 }

(This patch contains tabs for the indentations and a new line at the end. Not sure if it gets filtered out in this comment.)

An updated PKGBUILD could look like this.

diff --git a/PKGBUILD b/PKGBUILD
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -22,14 +22,18 @@ backup=('etc/pihole/pihole-FTL.conf' 'etc/pihole/dhcp.leases')
 source=($pkgname-v$pkgver.tar.gz::"https://github.com/pi-hole/FTL/archive/v$pkgver.tar.gz"
         "$pkgname.tmpfile"
         "$pkgname.sysuser"
-        "$pkgname.service")
+        "$pkgname.service"
+        "nettle4_base64_decode_update.patch")
 sha256sums=('5827e6bfd7ff4a8ed8cd1e475f9bee66061533375ea5061ba1946c73992de082'
             '0feb4597a4afd9054553505d305b0feb7e1f6e1705b092561648ff37d0a2893c'
             'dd1d2a341e774d4e549373ae75604031b9af0ee44debcd71a89259d9110d2a77'
-            '0998da040d038ddbad129ba8e1ea74741bc912813407b579cab1b3b3f206e721')
+            '0998da040d038ddbad129ba8e1ea74741bc912813407b579cab1b3b3f206e721'
+            'b11f98be8dd26c730d351cb2c071af8f6cc2070be2441250295e59646284faca')

 prepare() {
   cd "$srcdir"/"$_pkgname"-"$pkgver"
+  # Fix dst_length argument of base64_decode_update. It's also an input in nettle 4.
+  patch -Np1 -i "$srcdir"/nettle4_base64_decode_update.patch
   # Fix strstr redefined warning treated as error (GCC 14+)
   sed -i '/#define memmove/a #undef strstr' src/FTL.h
   # Fix const qualifier warnings in webserver.c (GCC 14+)

Its the same for me. First thoughts on the nettle3 change, but it stopped working some days after the fix. Passwort ist not usable anymore existing passwords do not work (Login), setting new ones (CLI/Web) does not work, only setting it to to no password.