From 464a9558df89fc6a72a65ba00e7f7685b972d471 Mon Sep 17 00:00:00 2001
From: eva <s1d3sw1ped+eva@gmail.com>
Date: Mon, 7 Sep 2026 03:30:04 +0000
Subject: [PATCH] pkgbuild: Fix sha256sums for four package sources

update.sh only rewrote deb+launch shim checksums, truncating
pkexec-pacman-u and polkit policy after version bumps. Cover all
four sources in PKGBUILD/.SRCINFO and future update.sh runs.
---
 .SRCINFO          |  2 ++
 PKGBUILD          |  2 ++
 scripts/update.sh | 46 ++++++++++++++++++++++++++++++++--------------
 3 files changed, 36 insertions(+), 14 deletions(-)

diff --git a/.SRCINFO b/.SRCINFO
index 4552f30..513b3df 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -34,5 +34,7 @@ pkgbase = grok-bot-bin
 	noextract = grok-bot_0.44.0_amd64.deb
 	sha256sums = dded18b2d3d44b1c32d6b9f63446d2b27bca68b3de7a2aa028ce7956e9694164
 	sha256sums = 36e1c522f7a3920a850a6235263d82ad5990611612979447c1e9eff92548ac1e
+	sha256sums = e92ea4534d864d7f302a082a8717a52af9675195af41092d18f15094f74fed45
+	sha256sums = a9533dfe4d31332ac1505d2e582eff27771dd0107108a5f6289d0d3839431a74
 
 pkgname = grok-bot-bin
diff --git a/PKGBUILD b/PKGBUILD
index 5de6520..58f554f 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -48,6 +48,8 @@ noextract=("grok-bot_${pkgver}_amd64.deb")
 sha256sums=(
   'dded18b2d3d44b1c32d6b9f63446d2b27bca68b3de7a2aa028ce7956e9694164'
   '36e1c522f7a3920a850a6235263d82ad5990611612979447c1e9eff92548ac1e'
+  'e92ea4534d864d7f302a082a8717a52af9675195af41092d18f15094f74fed45'
+  'a9533dfe4d31332ac1505d2e582eff27771dd0107108a5f6289d0d3839431a74'
 )
 
 package() {
diff --git a/scripts/update.sh b/scripts/update.sh
index ef95ddd..154a455 100755
--- a/scripts/update.sh
+++ b/scripts/update.sh
@@ -97,10 +97,16 @@ fi
 
 deb_sha=$(sha256sum "$tmp" | cut -d' ' -f1)
 shim_sha=$(sha256sum grok-bot-launch.sh | cut -d' ' -f1)
-if [[ ! "$deb_sha" =~ ^[0-9a-f]{64}$ || ! "$shim_sha" =~ ^[0-9a-f]{64}$ ]]; then
-  echo "error: sha256sum failed (deb=$deb_sha shim=$shim_sha)" >&2
-  exit 1
-fi
+pkexec_sha=$(sha256sum pkexec-pacman-u | cut -d' ' -f1)
+policy_sha=$(sha256sum com.s1d3sw1ped.grok-bot-bin.policy | cut -d' ' -f1)
+for label in deb_sha:$deb_sha shim_sha:$shim_sha pkexec_sha:$pkexec_sha policy_sha:$policy_sha; do
+  name=${label%%:*}
+  val=${label#*:}
+  if [[ ! "$val" =~ ^[0-9a-f]{64}$ ]]; then
+    echo "error: sha256sum failed ($name=$val)" >&2
+    exit 1
+  fi
+done
 
 # Reset pkgrel on upstream version bumps.
 sed -i \
@@ -117,24 +123,32 @@ if [[ "$newver" != "$version" || "$newcommit" != "$commit" || "$newrel" != "1" ]
   exit 1
 fi
 
-python3 - "$deb_sha" "$shim_sha" <<'PY'
+python3 - "$deb_sha" "$shim_sha" "$pkexec_sha" "$policy_sha" <<'PY2'
 import pathlib, re, sys
-deb_sha, shim_sha = sys.argv[1], sys.argv[2]
+deb_sha, shim_sha, pkexec_sha, policy_sha = sys.argv[1:5]
 p = pathlib.Path("PKGBUILD")
 text = p.read_text()
-block = f"sha256sums=(\n  '{deb_sha}'\n  '{shim_sha}'\n)"
+block = (
+    "sha256sums=(\n"
+    f"  '{deb_sha}'\n"
+    f"  '{shim_sha}'\n"
+    f"  '{pkexec_sha}'\n"
+    f"  '{policy_sha}'\n"
+    ")"
+)
 text2, n = re.subn(r"sha256sums=\([^\)]*\)", block, text, count=1, flags=re.S)
 if n != 1:
     raise SystemExit(f"sha256sums replace failed (n={n})")
 p.write_text(text2)
-PY
+PY2
 
-python3 - "$version" "$commit" "$deb_sha" "$shim_sha" <<'PY'
+python3 - "$version" "$commit" "$deb_sha" "$shim_sha" "$pkexec_sha" "$policy_sha" <<'PY2'
 import pathlib, sys
-version, commit, deb_sha, shim_sha = sys.argv[1:5]
+version, commit, deb_sha, shim_sha, pkexec_sha, policy_sha = sys.argv[1:7]
 p = pathlib.Path(".SRCINFO")
 if not p.is_file():
     raise SystemExit(".SRCINFO missing")
+shas = [deb_sha, shim_sha, pkexec_sha, policy_sha]
 lines = []
 saw_sha = False
 saw_pkgver = saw_pkgrel = saw_source = saw_noextract = False
@@ -155,8 +169,8 @@ for line in p.read_text().splitlines(True):
         continue
     if line.startswith("\tsha256sums ="):
         if not saw_sha:
-            lines.append(f"\tsha256sums = {deb_sha}\n")
-            lines.append(f"\tsha256sums = {shim_sha}\n")
+            for s in shas:
+                lines.append(f"\tsha256sums = {s}\n")
             saw_sha = True
         continue
     lines.append(line)
@@ -169,7 +183,11 @@ missing = [n for n, ok in (
 ) if not ok]
 if missing:
     raise SystemExit(f".SRCINFO rewrite missed fields: {', '.join(missing)}")
+# Ensure four sha lines present
+sha_lines = [l for l in lines if l.startswith("\tsha256sums =")]
+if len(sha_lines) != 4:
+    raise SystemExit(f".SRCINFO expected 4 sha256sums lines, got {len(sha_lines)}")
 p.write_text("".join(lines))
-PY
+PY2
 
-echo "Updated PKGBUILD and .SRCINFO to ${version} deb_sha=${deb_sha} shim_sha=${shim_sha}"
+echo "Updated PKGBUILD and .SRCINFO to ${version} deb_sha=${deb_sha} shim_sha=${shim_sha} pkexec_sha=${pkexec_sha} policy_sha=${policy_sha}"
-- 
2.39.5