# Local patches

Fixes carried in the **phoebe-lab production deployment** of SourceHut that are *not* upstream yet. These are stored here for reference and provenance — they are **not applied** to the clones in this workspace, which mirrors upstream verbatim.

If a question is about behavior that diverges from upstream, check here first to see whether phoebe-lab is running a patched version.

Patches are kept in `git format-patch`/`git diff` format against the target upstream repo and are sourced from `~/data/home/phoebe-lab/srht/patches/`.

## Patches

### `core-go-checksum.patch`

**Repo:** `core-go`  ·  **File:** `objects/middleware.go` (`NewClient`)

**Problem.** AWS SDK for Go v2 defaults `RequestChecksumCalculation` to `WhenSupported`, which causes the S3 client to **seek the request body** before `PutObject` to compute a checksum. Non-seekable bodies (streamed uploads) fail or get fully buffered into memory.

This hits two upload paths in production:

- `pages.sr.ht` Publish — streaming the site tarball into S3.
- `builds.sr.ht` artifact upload — workers POST job artifacts as a stream.

**Fix.** Set both `RequestChecksumCalculation` and `ResponseChecksumValidation` to `WhenRequired`, so the SDK only checksums when the protocol mandates it. This restores pre-SDK-v1.30 behavior and is the workaround Amazon documents for non-AWS S3 backends (Garage/Ceph/Minio) where strict checksum negotiation is also unreliable.

**Status.** Applied in phoebe-lab production; **not upstreamed yet**.

**Verify it still applies cleanly:**

```bash
cd ~/data/home/sourcehut/core-go
git apply --check ../patches/core-go-checksum.patch
```

If `git apply --check` fails after a `sourcehut-refresh`, upstream has changed that file — re-derive the patch against the new context and update the copy in `~/data/home/phoebe-lab/srht/patches/` first, then re-import here.

### `builds-images-ubuntu-genimg.patch`

**Repo:** `builds.sr.ht`  ·  **File:** `images/ubuntu/genimg`

Two independent bugs in the apk-shipped recipe (`builds.sr.ht-images` 0.103.12-r0; the git-tag at 0.103.12 has slight drift from the apk, see the patch header):

1. **NBD settle race.** After `qemu-nbd --connect=/dev/nbd0` the kernel hasn't updated the block device's reported size yet, and the immediate `dd if=mbr.bin of=/dev/nbd0` fails with `No space left on device`. `debian/genimg` already handles this with a `partprobe` loop; ubuntu's variant is missing it. The patch is a verbatim copy of the debian fix.
2. **Host vs chroot chown.** The recipe runs `chown build:build /mnt/home/build/.gitconfig` on the *host* near the end — but `build` is a chroot user, not a host user. On any builder that doesn't happen to have a same-UID host `build` user, ~5 min of debootstrap work is thrown away by the failing chown. Patch routes it via `run_root chown ... /home/build/.gitconfig`, matching the rest of the script.

**Status.** Applied on `work.lab.local` (the out-of-band image builder VM) at 2026-05-19; **not upstreamed yet**. Should file with sr.ht-dev when a moment opens up — both are obvious bugs the upstream maintainers will likely take.

**Verify it still applies cleanly:**

```bash
cd ~/data/home/sourcehut/builds.sr.ht
git apply --check ../patches/builds-images-ubuntu-genimg.patch
```

Note: the patch is written against the apk-shipped baseline. `git apply --check` may complain about line offsets against the upstream submodule; the underlying logic is what matters. After a `sourcehut-refresh`, eyeball whether the two hunks still describe the same issue before trusting the patch verbatim.