From 5394406420972837957276dbbde7b3856c5a7265 Mon Sep 17 00:00:00 2001
From: Carl Smedstad <carsme@archlinux.org>
Date: Mon, 6 Apr 2026 14:53:15 +0200
Subject: [PATCH] upgpkg: 2.11.2-3: Apply Fedora patch disabling executable
 altering commands

---
 .SRCINFO |  4 +++-
 PKGBUILD | 10 +++++++---
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/.SRCINFO b/.SRCINFO
index 821d7b4..e2be7e1 100644
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -1,7 +1,7 @@
 pkgbase = caddy
 	pkgdesc = Fast web server with automatic HTTPS
 	pkgver = 2.11.2
-	pkgrel = 2
+	pkgrel = 3
 	url = https://github.com/caddyserver/caddy
 	arch = x86_64
 	license = Apache-2.0
@@ -19,6 +19,7 @@ pkgbase = caddy
 	source = caddy.sysusers
 	source = Caddyfile
 	source = use-data-dir-for-autosave.patch
+	source = caddy-disable-executable-altering-commands.patch::https://src.fedoraproject.org/rpms/caddy/raw/rawhide/f/0001-Disable-commands-that-can-alter-the-binary.patch
 	validpgpkeys = 29D0817A67156E4F25DC24782A349DD577D586A5
 	sha512sums = 05965d0ac5ac3eb9e9de5b1c3c95ca30ee982cae806fffc099463b5634f2eb5f52f6ae020a28c53da6556fa3a2b599dce0d0da5b00ee49a685c432f9a2e57f6a
 	sha512sums = fe9a2badd9d385aed0f5e625d99eaf4fa67862e076c4fd7b28a26984aaaae7310887759d3a4a97a128fffb7dc4b266717d902b234e19643b0c2d818849d165e3
@@ -28,5 +29,6 @@ pkgbase = caddy
 	sha512sums = b24ff0fc8df05ac92ba6860ce1b9975ecce48492b08c1b03545e7b20d2956f130cdee215fc78c751f9ab4869008e2b9bf7f861311fe16c8f5a85a42e347337c6
 	sha512sums = 4be1ed23e6600d8072c7f4fabd2bd926708502a55d84ae4f62aff9885c7b8e45ad0554503d0fc796338577adfca9e467c468a82ba56ffd69e4ec2778d69bc198
 	sha512sums = 563d6b45e91fc584fb5a27caaa382f59c140cb0a1b28b8d8faced4f7c7cad86d8671eb6ac10056f41518a842c8f606130d7e0c71df2b731d5eb0b4c868ea5d41
+	sha512sums = 42384fa3314e367c4d7ac3e07af66cf7000f68b6d6354183c5ee1579bd46ea6a29edfa84f9cdf5084d99d74af50ea5b14e3979d38ff806232756991bcac2e8db
 
 pkgname = caddy
diff --git a/PKGBUILD b/PKGBUILD
index 1e87ee0..43cd0f7 100644
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -9,7 +9,7 @@
 
 pkgname=caddy
 pkgver=2.11.2
-pkgrel=2
+pkgrel=3
 pkgdesc='Fast web server with automatic HTTPS'
 arch=(x86_64)
 url='https://github.com/caddyserver/caddy'
@@ -33,6 +33,7 @@ source=(
   caddy.sysusers
   Caddyfile
   use-data-dir-for-autosave.patch
+  "$pkgname-disable-executable-altering-commands.patch::https://src.fedoraproject.org/rpms/caddy/raw/rawhide/f/0001-Disable-commands-that-can-alter-the-binary.patch"
 )
 sha512sums=('05965d0ac5ac3eb9e9de5b1c3c95ca30ee982cae806fffc099463b5634f2eb5f52f6ae020a28c53da6556fa3a2b599dce0d0da5b00ee49a685c432f9a2e57f6a'
             'fe9a2badd9d385aed0f5e625d99eaf4fa67862e076c4fd7b28a26984aaaae7310887759d3a4a97a128fffb7dc4b266717d902b234e19643b0c2d818849d165e3'
@@ -41,7 +42,8 @@ sha512sums=('05965d0ac5ac3eb9e9de5b1c3c95ca30ee982cae806fffc099463b5634f2eb5f52f
             '55ee8d3f8b14f9adddc7a1026addcea4f85b4bae4cd512fd4da2a5e8adaae4b6fd0f486d2e3847f75518f4710a897b4fca84e48ee15700b968bad762125c4742'
             'b24ff0fc8df05ac92ba6860ce1b9975ecce48492b08c1b03545e7b20d2956f130cdee215fc78c751f9ab4869008e2b9bf7f861311fe16c8f5a85a42e347337c6'
             '4be1ed23e6600d8072c7f4fabd2bd926708502a55d84ae4f62aff9885c7b8e45ad0554503d0fc796338577adfca9e467c468a82ba56ffd69e4ec2778d69bc198'
-            '563d6b45e91fc584fb5a27caaa382f59c140cb0a1b28b8d8faced4f7c7cad86d8671eb6ac10056f41518a842c8f606130d7e0c71df2b731d5eb0b4c868ea5d41')
+            '563d6b45e91fc584fb5a27caaa382f59c140cb0a1b28b8d8faced4f7c7cad86d8671eb6ac10056f41518a842c8f606130d7e0c71df2b731d5eb0b4c868ea5d41'
+            '42384fa3314e367c4d7ac3e07af66cf7000f68b6d6354183c5ee1579bd46ea6a29edfa84f9cdf5084d99d74af50ea5b14e3979d38ff806232756991bcac2e8db')
 validpgpkeys=(
   29D0817A67156E4F25DC24782A349DD577D586A5 # Matthew Holt <mholt@users.noreply.github.com>
 )
@@ -52,7 +54,9 @@ prepare() {
 
   cd ${pkgname}
   # do not write in /etc
-  patch -Np1 < "${srcdir}/use-data-dir-for-autosave.patch"
+  patch -Np1 < ../use-data-dir-for-autosave.patch
+  # disable commands that bypass the package manager
+  patch -Np1 < ../$pkgname-disable-executable-altering-commands.patch
 
   GOFLAGS="-mod=readonly" go mod vendor -v
 }