upgpkg: 2.11.2-3: Apply Fedora patch disabling executable altering commands

PKGBUILD

@@ -9,7 +9,7 @@
 
 pkgname=caddy
 pkgver=2.11.2
-pkgrel=2
+pkgrel=3
 pkgdesc='Fast web server with automatic HTTPS'
 arch=(x86_64)
 url='https://github.com/caddyserver/caddy'
@@ -33,6 +33,7 @@ source=(
   caddy.sysusers
   Caddyfile
   use-data-dir-for-autosave.patch
+  "$pkgname-disable-executable-altering-commands.patch::https://src.fedoraproject.org/rpms/caddy/raw/rawhide/f/0001-Disable-commands-that-can-alter-the-binary.patch"
 )
 sha512sums=('05965d0ac5ac3eb9e9de5b1c3c95ca30ee982cae806fffc099463b5634f2eb5f52f6ae020a28c53da6556fa3a2b599dce0d0da5b00ee49a685c432f9a2e57f6a'
             'fe9a2badd9d385aed0f5e625d99eaf4fa67862e076c4fd7b28a26984aaaae7310887759d3a4a97a128fffb7dc4b266717d902b234e19643b0c2d818849d165e3'
@@ -41,7 +42,8 @@ sha512sums=('05965d0ac5ac3eb9e9de5b1c3c95ca30ee982cae806fffc099463b5634f2eb5f52f
             '55ee8d3f8b14f9adddc7a1026addcea4f85b4bae4cd512fd4da2a5e8adaae4b6fd0f486d2e3847f75518f4710a897b4fca84e48ee15700b968bad762125c4742'
             'b24ff0fc8df05ac92ba6860ce1b9975ecce48492b08c1b03545e7b20d2956f130cdee215fc78c751f9ab4869008e2b9bf7f861311fe16c8f5a85a42e347337c6'
             '4be1ed23e6600d8072c7f4fabd2bd926708502a55d84ae4f62aff9885c7b8e45ad0554503d0fc796338577adfca9e467c468a82ba56ffd69e4ec2778d69bc198'
-            '563d6b45e91fc584fb5a27caaa382f59c140cb0a1b28b8d8faced4f7c7cad86d8671eb6ac10056f41518a842c8f606130d7e0c71df2b731d5eb0b4c868ea5d41')
+            '563d6b45e91fc584fb5a27caaa382f59c140cb0a1b28b8d8faced4f7c7cad86d8671eb6ac10056f41518a842c8f606130d7e0c71df2b731d5eb0b4c868ea5d41'
+            '42384fa3314e367c4d7ac3e07af66cf7000f68b6d6354183c5ee1579bd46ea6a29edfa84f9cdf5084d99d74af50ea5b14e3979d38ff806232756991bcac2e8db')
 validpgpkeys=(
   29D0817A67156E4F25DC24782A349DD577D586A5 # Matthew Holt <mholt@users.noreply.github.com>
 )
@@ -52,7 +54,9 @@ prepare() {
 
   cd ${pkgname}
   # do not write in /etc
-  patch -Np1 < "${srcdir}/use-data-dir-for-autosave.patch"
+  patch -Np1 < ../use-data-dir-for-autosave.patch
+  # disable commands that bypass the package manager
+  patch -Np1 < ../$pkgname-disable-executable-altering-commands.patch
 
   GOFLAGS="-mod=readonly" go mod vendor -v
 }