Arch Linux User Repository

ArchLinux Pi-hole is not officially supported by Pi-hole project. In case of bugs and malfunctions please DO NOT file a report upstream.

First of all check if the wiki (https://wiki.archlinux.org/index.php/Pi-hole) can help then ask here for assistance and tips.
When it will be excluded that the problem does not depend on ArchLinux we will file a bug upstream.

I can confirm that @chlihug's patch works. Thank you! @pzarycki could you include it into the package?

The password issue is indeed a problem with nettle 4. Specifically its base64_decode_update function. The dst_length argument is now also an input and FTL always passes 0 at the moment.

An updated password.c can fix this by passing the correct buffer size.

diff --git a/src/config/password.c b/src/config/password.c
index a5f7035d..db6f6c51 100644
--- a/src/config/password.c
+++ b/src/config/password.c
@@ -170,13 +170,15 @@ static uint8_t * __attribute__((malloc)) base64_decode(const char *data, size_t
    // Base64 decoding requires 3 bytes for every 4 bytes of input, plus
    // additional bytes for padding. The output buffer must be large enough
    // to hold the decoded data.
-   uint8_t *decoded = calloc(BASE64_DECODE_LENGTH(strlen(data)), sizeof(uint8_t));
+   size_t decoded_length = BASE64_DECODE_LENGTH(strlen(data));
+   uint8_t *decoded = calloc(decoded_length, sizeof(uint8_t));

    // Decode the data
    struct base64_decode_ctx ctx;
    base64_decode_init(&ctx);
-   base64_decode_update(&ctx, length, decoded, strlen(data), data);
+   base64_decode_update(&ctx, &decoded_length, decoded, strlen(data), data);
    base64_decode_final(&ctx);
+   *length = decoded_length;

    return decoded;
 }

(This patch contains tabs for the indentations and a new line at the end. Not sure if it gets filtered out in this comment.)

An updated PKGBUILD could look like this.

diff --git a/PKGBUILD b/PKGBUILD
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -22,14 +22,18 @@ backup=('etc/pihole/pihole-FTL.conf' 'etc/pihole/dhcp.leases')
 source=($pkgname-v$pkgver.tar.gz::"https://github.com/pi-hole/FTL/archive/v$pkgver.tar.gz"
         "$pkgname.tmpfile"
         "$pkgname.sysuser"
-        "$pkgname.service")
+        "$pkgname.service"
+        "nettle4_base64_decode_update.patch")
 sha256sums=('5827e6bfd7ff4a8ed8cd1e475f9bee66061533375ea5061ba1946c73992de082'
             '0feb4597a4afd9054553505d305b0feb7e1f6e1705b092561648ff37d0a2893c'
             'dd1d2a341e774d4e549373ae75604031b9af0ee44debcd71a89259d9110d2a77'
-            '0998da040d038ddbad129ba8e1ea74741bc912813407b579cab1b3b3f206e721')
+            '0998da040d038ddbad129ba8e1ea74741bc912813407b579cab1b3b3f206e721'
+            'b11f98be8dd26c730d351cb2c071af8f6cc2070be2441250295e59646284faca')

 prepare() {
   cd "$srcdir"/"$_pkgname"-"$pkgver"
+  # Fix dst_length argument of base64_decode_update. It's also an input in nettle 4.
+  patch -Np1 -i "$srcdir"/nettle4_base64_decode_update.patch
   # Fix strstr redefined warning treated as error (GCC 14+)
   sed -i '/#define memmove/a #undef strstr' src/FTL.h
   # Fix const qualifier warnings in webserver.c (GCC 14+)

Its the same for me. First thoughts on the nettle3 change, but it stopped working some days after the fix. Passwort ist not usable anymore existing passwords do not work (Login), setting new ones (CLI/Web) does not work, only setting it to to no password.

Hello, I am completely unable to set or change the web interface password on this Pi-hole v6 package. It fails both from the terminal and the web GUI. I am running it on an Intel N100.

When I try to set it via CLI (sudo pihole-FTL --config webserver.api.password "mypassword"), I get this exact output:

Invalid decoded salt length: 0, should be 16
Failed to create password hash (verification failed), password remains unchanged

When I try to set it via the Web GUI, a red error banner appears:

Config item is invalid
webserver.api.password: password hash verification failed

The permissions for /etc/pihole/pihole.toml are correct, but the system just refuses to save the password. Any ideas on what might be causing this?

@fabi, thank you for helping with the pi-hole-ftl-bin package. Request you to maintain this at least until the issue is fixed on AUR.

Cheers.

bpierre's patch below also fixes the following error that I encountered while building 6.6-1:

/home/bruda/.cache/pacaur/pi-hole-ftl/src/FTL-6.6.1/src/api/2fa.c: In function ‘hotp’:
/home/bruda/.cache/pacaur/pi-hole-ftl/src/FTL-6.6.1/src/api/2fa.c:36:32: error: passing argument 2 of ‘nettle_hmac_sha1_digest’ makes pointer from integer without a cast [-Wint-conversion]
   36 |         hmac_sha1_digest(&ctx, SHA1_DIGEST_SIZE, out);
      |                                ^~~~~~~~~~~~~~~~
      |                                |
      |                                int
In file included from /home/bruda/.cache/pacaur/pi-hole-ftl/src/FTL-6.6.1/src/api/2fa.c:20:
/usr/include/nettle/hmac.h:139:27: note: expected ‘uint8_t *’ {aka ‘unsigned char *’} but argument is of type ‘int’
  139 |                  uint8_t *digest);
      |                  ~~~~~~~~~^~~~~~
/home/bruda/.cache/pacaur/pi-hole-ftl/src/FTL-6.6.1/src/api/2fa.c:36:9: error: too many arguments to function ‘nettle_hmac_sha1_digest’; expected 2, have 3
   36 |         hmac_sha1_digest(&ctx, SHA1_DIGEST_SIZE, out);
      |         ^~~~~~~~~~~~~~~~
/usr/include/nettle/hmac.h:138:1: note: declared here
  138 | hmac_sha1_digest(struct hmac_sha1_ctx *ctx,
      | ^~~~~~~~~~~~~~~~
make[2]: *** [src/api/CMakeFiles/api.dir/build.make:79: src/api/CMakeFiles/api.dir/2fa.c.o] Error 1
make[1]: *** [CMakeFiles/Makefile2:618: src/api/CMakeFiles/api.dir/all] Error 2

Installing nettle3 fixed my local install of pi-hole-ftl. And here's a patch for building the package:

 .SRCINFO | 4 ++--
 PKGBUILD | 7 +++++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git i/.SRCINFO w/.SRCINFO
index 11d7d1c..ca4f130 100644
--- i/.SRCINFO
+++ w/.SRCINFO
@@ -1,7 +1,7 @@
 pkgbase = pi-hole-ftl
    pkgdesc = The Pi-hole FTL engine
    pkgver = 6.6.1
-   pkgrel = 1
+   pkgrel = 2
    url = https://github.com/pi-hole/FTL
    install = pi-hole-ftl.install
    arch = i686
@@ -13,7 +13,7 @@ pkgbase = pi-hole-ftl
    license = EUPL-1.2
    makedepends = cmake
    makedepends = xxd
-   depends = nettle
+   depends = nettle3
    depends = gmp
    depends = mbedtls
    depends = pi-hole-web
diff --git i/PKGBUILD w/PKGBUILD
index 78fb586..df3b58a 100644
--- i/PKGBUILD
+++ w/PKGBUILD
@@ -8,12 +8,12 @@ pkgname=pi-hole-ftl
 _pkgname=FTL
 _servicename=pihole-FTL
 pkgver=6.6.1
-pkgrel=1
+pkgrel=2
 arch=('i686' 'x86_64' 'arm' 'armv6h' 'armv7h' 'aarch64')
 pkgdesc="The Pi-hole FTL engine"
 url="https://github.com/pi-hole/FTL"
 license=('EUPL-1.2')
-depends=('nettle' 'gmp' 'mbedtls' 'pi-hole-web')
+depends=('nettle3' 'gmp' 'mbedtls' 'pi-hole-web')
 makedepends=('cmake' 'xxd')
 conflicts=('dnsmasq')
 provides=('dnsmasq')
@@ -38,6 +38,9 @@ prepare() {
   # Fix mbedtls 3.x API changes
   sed -i 's/mbedtls_x509write_crt_pem(\([^,]*\), \([^,]*\), sizeof(\([^)]*\)))/mbedtls_x509write_crt_pem(\1, \2, sizeof(\3), NULL, NULL)/g' src/webserver/x509.c
   sed -i 's/mbedtls_pk_parse_keyfile(\([^,]*\), \([^,]*\), NULL);/mbedtls_pk_parse_keyfile(\1, \2, NULL, NULL, NULL);/g' src/webserver/x509.c
+  # Use nettle3
+  find src -name '*.[ch]' -print0 | xargs -0 sed -i 's,^# *include <nettle/,#include <nettle3/nettle/,'
+  sed -E -i 's,(find_library\(LIB(HOGWEED|NETTLE) .*) HINTS .*\),\1 HINTS /usr/lib/nettle3),' src/CMakeLists.txt
 }

 build() {

Today I updated Nettle from version 3.10.2-1 to 4.0-1. After restarting my server, pi-hole-ftl failed to start. I then tried to rebuild pi-hole-ftl on a clean system. Unfortunately, the build process aborted with several errors related to Nettle. I temporarily downgraded Nettle, but of course that’s not a solution...Can someone take a look at this? Thanks in advance.

@CountMurphy: Make sure you are building in a clean chroot

6.6.1 doesn't build for me, but it also doesn't state why it doesn't build.

[ 58%] Building C object src/dnsmasq/CMakeFiles/dnsmasq.dir/ubus.c.o
[ 59%] Building C object src/dnsmasq/CMakeFiles/dnsmasq.dir/util.c.o
<command-line>: warning: ‘_FORTIFY_SOURCE’ redefined
<command-line>: note: this is the location of the previous definition
<command-line>: warning: ‘_FORTIFY_SOURCE’ redefined
<command-line>: note: this is the location of the previous definition
[ 59%] Built target dnsmasq
[ 59%] Built target lua
[ 59%] Built target sqlite3
make: *** [Makefile:136: all] Error 2
==> ERROR: A failure occurred in build().
    Aborting...
 -> error making: pi-hole-ftl-exit status 4
 -> Failed to install the following packages. Manual intervention is required:
pi-hole-ftl - exit status 4