Update Flea to 0.1.5 and repair upstream source verification

pkgbuilds/flea/.omarchy/upstream.sh

@@ -1,16 +1,10 @@
 #!/bin/bash
-# Flea publishes signed source tags but no release artifacts or checksum manifest.
-# Check the small GitHub source tarball only when a newer stable release exists,
-# validate its expected root, then report its hash alongside the fixed hashes of
-# the four upstream security patches carried until a release includes them.
+# Verify Flea's published source archive against its checksum manifest when a
+# newer stable release exists, then check its root and required security fixes.
 set -euo pipefail
 
 REPO='thisisgm/flea'
 RELEASES_URL="https://api.github.com/repos/$REPO/releases?per_page=100"
-PATCH_2BD7CC2='c610a9f44294b67341940203943c9c567003b65cc436d6013cd36754379183d8'
-PATCH_27D19CA='e457ef17e26f70057b1184eeb938fccc5906f48a7c77f1df573d55d13a845425'
-PATCH_23290CE='f8381456a3b5f39d341cc6610bf27beb8354892b17a1c8c6d7882db4e40824c3'
-PATCH_B4B7EE4='46bdbe43f135a052c893b1987f8b0928736445616a84b0c65d2181ee74b21b25'
 
 current=$(awk -F= '/^pkgver=/ { print $2; exit }' PKGBUILD)
 releases=$(curl -fsSL "$RELEASES_URL")
@@ -58,7 +52,20 @@ fi
 
 tarball=$(mktemp)
 trap 'rm -f "$tarball"' EXIT
-curl -fsSL -o "$tarball" "https://github.com/$REPO/archive/refs/tags/$best_tag.tar.gz"
+release_url="https://github.com/$REPO/releases/download/$best_tag"
+asset="flea-$best_tag.tar.gz"
+checksums=$(curl -fsSL "$release_url/SHASUMS256.txt")
+expected_sum=$(awk -v asset="$asset" '$2 == asset { print $1 }' <<<"$checksums")
+if [[ ! $expected_sum =~ ^[0-9a-f]{64}$ ]]; then
+  printf 'Release %s has no unique SHA-256 checksum for %s\n' "$best_tag" "$asset" >&2
+  exit 1
+fi
+curl -fsSL -o "$tarball" "$release_url/$asset"
+source_sum=$(sha256sum "$tarball" | cut -d' ' -f1)
+if [[ $source_sum != "$expected_sum" ]]; then
+  printf 'Release %s source archive does not match its checksum manifest\n' "$best_tag" >&2
+  exit 1
+fi
 
 expected_root="flea-$best_version"
 served_roots=$(tar -tzf "$tarball" | cut -d/ -f1 | sort -u)
@@ -76,6 +83,7 @@ mediaprobe_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/mediaprobe.rs")
 metareq_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/metareq.rs")
 sharelink_qml=$(tar -xOzf "$tarball" "$expected_root/ui/ShareLink.qml")
 copyfile_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/copyfile.rs")
+regfile_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/regfile.rs")
 
 if ! grep -Fq 'a.push("--".to_string());' <<<"$archive_rs" ||
   ! grep -Fq 'let input = std::fs::canonicalize(input)' <<<"$archiveops_rs" ||
@@ -84,7 +92,8 @@ if ! grep -Fq 'a.push("--".to_string());' <<<"$archive_rs" ||
   ! grep -Fq 'if !sandbox::available()' <<<"$mediaprobe_rs" ||
   ! grep -Fq 'if !sandbox::available()' <<<"$metareq_rs" ||
   ! grep -Fq 'copyToClipboard.command = ["wl-copy", url]' <<<"$sharelink_qml" ||
-  ! grep -Fq '.custom_flags(O_NOFOLLOW)' <<<"$copyfile_rs"; then
+  ! grep -Fq 'regfile::open_if_regular(src, O_NOFOLLOW)' <<<"$copyfile_rs" ||
+  ! grep -Fq '.custom_flags(O_NONBLOCK | extra_flags)' <<<"$regfile_rs"; then
   printf 'Release %s does not contain every required upstream security fix\n' "$best_tag" >&2
   exit 1
 fi
@@ -92,9 +101,5 @@ fi
 jq -n \
   --arg pkgver "$best_version" \
   --arg published_at "$best_published_at" \
-  --arg source "$(sha256sum "$tarball" | cut -d' ' -f1)" \
-  --arg patch_2bd7cc2 "$PATCH_2BD7CC2" \
-  --arg patch_27d19ca "$PATCH_27D19CA" \
-  --arg patch_23290ce "$PATCH_23290CE" \
-  --arg patch_b4b7ee4 "$PATCH_B4B7EE4" \
-  '{pkgver: $pkgver, published_at: $published_at, sha256sums: {any: [$source, $patch_2bd7cc2, $patch_27d19ca, $patch_23290ce, $patch_b4b7ee4]}}'
+  --arg source "$source_sum" \
+  '{pkgver: $pkgver, published_at: $published_at, sha256sums: {any: [$source]}}'

pkgbuilds/flea/PKGBUILD

@@ -1,7 +1,7 @@
 # Maintainer: GM <gianmarcomorales@icloud.com>
 
 pkgname=flea
-pkgver=0.1.4
+pkgver=0.1.5
 pkgrel=1
 pkgdesc='Fast, keyboard-first file manager for Omarchy'
 arch=('x86_64' 'aarch64')
@@ -20,6 +20,7 @@ depends=(
   'gvfs-smb'
   'hicolor-icon-theme'
   'omarchy'
+  'python'
   'python-gobject'
   'quickshell'
   'qt6-multimedia'
@@ -31,7 +32,6 @@ depends=(
   'xdg-utils'
 )
 makedepends=('cargo')
-checkdepends=('python')
 optdepends=(
   '7zip: 7z archive support'
   'dropbox-cli: Dropbox browsing and share links'
@@ -44,11 +44,9 @@ conflicts=('flea-git')
 options=('!debug')
 
 source=(
-  "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
-)
-sha256sums=(
-  '02ccb77929058862072b17a60b9dd08733e395faebfd4cbabd6e5c4be5362b8f'
+  "$url/releases/download/v$pkgver/$pkgname-v$pkgver.tar.gz"
 )
+sha256sums=('5f9b6591e2a912625055c25d44d20bd5a6ebb94f4cf5d3c03fddd4b114beb480')
 
 build() {
   cd "$pkgname-$pkgver"
@@ -107,6 +105,9 @@ package() {
     "$pkgdir/usr/share/xdg-desktop-portal/portals/flea.portal"
   install -Dm644 packaging/org.freedesktop.impl.portal.desktop.flea.service \
     "$pkgdir/usr/share/dbus-1/services/org.freedesktop.impl.portal.desktop.flea.service"
+  install -Dm755 tools/flea-filemanager1 "$pkgdir/usr/lib/flea/flea-filemanager1"
+  install -Dm644 packaging/com.thisisgm.flea.FileManager1.service \
+    "$pkgdir/usr/share/dbus-1/services/com.thisisgm.flea.FileManager1.service"
   install -Dm644 packaging/com.thisisgm.flea.desktop \
     "$pkgdir/usr/share/applications/com.thisisgm.flea.desktop"
   install -Dm644 packaging/com.thisisgm.flea.svg \