Update Flea to 0.1.5 and repair upstream source verification

pkgbuilds/flea/.omarchy/upstream.sh

@@ -1,16 +1,10 @@
 #!/bin/bash
-# Flea publishes signed source tags but no release artifacts or checksum manifest.
-# Check the small GitHub source tarball only when a newer stable release exists,
-# validate its expected root, then report its hash alongside the fixed hashes of
-# the four upstream security patches carried until a release includes them.
+# Verify Flea's published source archive against its checksum manifest when a
+# newer stable release exists, then check its root and required security fixes.
 set -euo pipefail
 
 REPO='thisisgm/flea'
 RELEASES_URL="https://api.github.com/repos/$REPO/releases?per_page=100"
-PATCH_2BD7CC2='c610a9f44294b67341940203943c9c567003b65cc436d6013cd36754379183d8'
-PATCH_27D19CA='e457ef17e26f70057b1184eeb938fccc5906f48a7c77f1df573d55d13a845425'
-PATCH_23290CE='f8381456a3b5f39d341cc6610bf27beb8354892b17a1c8c6d7882db4e40824c3'
-PATCH_B4B7EE4='46bdbe43f135a052c893b1987f8b0928736445616a84b0c65d2181ee74b21b25'
 
 current=$(awk -F= '/^pkgver=/ { print $2; exit }' PKGBUILD)
 releases=$(curl -fsSL "$RELEASES_URL")
@@ -58,7 +52,20 @@ fi
 
 tarball=$(mktemp)
 trap 'rm -f "$tarball"' EXIT
-curl -fsSL -o "$tarball" "https://github.com/$REPO/archive/refs/tags/$best_tag.tar.gz"
+release_url="https://github.com/$REPO/releases/download/$best_tag"
+asset="flea-$best_tag.tar.gz"
+checksums=$(curl -fsSL "$release_url/SHASUMS256.txt")
+expected_sum=$(awk -v asset="$asset" '$2 == asset { print $1 }' <<<"$checksums")
+if [[ ! $expected_sum =~ ^[0-9a-f]{64}$ ]]; then
+  printf 'Release %s has no unique SHA-256 checksum for %s\n' "$best_tag" "$asset" >&2
+  exit 1
+fi
+curl -fsSL -o "$tarball" "$release_url/$asset"
+source_sum=$(sha256sum "$tarball" | cut -d' ' -f1)
+if [[ $source_sum != "$expected_sum" ]]; then
+  printf 'Release %s source archive does not match its checksum manifest\n' "$best_tag" >&2
+  exit 1
+fi
 
 expected_root="flea-$best_version"
 served_roots=$(tar -tzf "$tarball" | cut -d/ -f1 | sort -u)
@@ -76,6 +83,7 @@ mediaprobe_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/mediaprobe.rs")
 metareq_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/metareq.rs")
 sharelink_qml=$(tar -xOzf "$tarball" "$expected_root/ui/ShareLink.qml")
 copyfile_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/copyfile.rs")
+regfile_rs=$(tar -xOzf "$tarball" "$expected_root/src/backend/regfile.rs")
 
 if ! grep -Fq 'a.push("--".to_string());' <<<"$archive_rs" ||
   ! grep -Fq 'let input = std::fs::canonicalize(input)' <<<"$archiveops_rs" ||
@@ -84,7 +92,8 @@ if ! grep -Fq 'a.push("--".to_string());' <<<"$archive_rs" ||
   ! grep -Fq 'if !sandbox::available()' <<<"$mediaprobe_rs" ||
   ! grep -Fq 'if !sandbox::available()' <<<"$metareq_rs" ||
   ! grep -Fq 'copyToClipboard.command = ["wl-copy", url]' <<<"$sharelink_qml" ||
-  ! grep -Fq '.custom_flags(O_NOFOLLOW)' <<<"$copyfile_rs"; then
+  ! grep -Fq 'regfile::open_if_regular(src, O_NOFOLLOW)' <<<"$copyfile_rs" ||
+  ! grep -Fq '.custom_flags(O_NONBLOCK | extra_flags)' <<<"$regfile_rs"; then
   printf 'Release %s does not contain every required upstream security fix\n' "$best_tag" >&2
   exit 1
 fi
@@ -92,9 +101,5 @@ fi
 jq -n \
   --arg pkgver "$best_version" \
   --arg published_at "$best_published_at" \
-  --arg source "$(sha256sum "$tarball" | cut -d' ' -f1)" \
-  --arg patch_2bd7cc2 "$PATCH_2BD7CC2" \
-  --arg patch_27d19ca "$PATCH_27D19CA" \
-  --arg patch_23290ce "$PATCH_23290CE" \
-  --arg patch_b4b7ee4 "$PATCH_B4B7EE4" \
-  '{pkgver: $pkgver, published_at: $published_at, sha256sums: {any: [$source, $patch_2bd7cc2, $patch_27d19ca, $patch_23290ce, $patch_b4b7ee4]}}'
+  --arg source "$source_sum" \
+  '{pkgver: $pkgver, published_at: $published_at, sha256sums: {any: [$source]}}'