# Local patches

Fixes carried in the **phoebe-lab production deployment** of SourceHut that are *not* upstream yet. These are stored here for reference and provenance — they are **not applied** to the clones in this workspace, which mirrors upstream verbatim.

If a question is about behavior that diverges from upstream, check here first to see whether phoebe-lab is running a patched version.

Patches are kept in `git format-patch`/`git diff` format against the target upstream repo and are sourced from `~/data/home/phoebe-lab/srht/patches/`.

## Patches

### `core-go-checksum.patch`

**Repo:** `core-go`  ·  **File:** `objects/middleware.go` (`NewClient`)

**Problem.** AWS SDK for Go v2 defaults `RequestChecksumCalculation` to `WhenSupported`, which causes the S3 client to **seek the request body** before `PutObject` to compute a checksum. Non-seekable bodies (streamed uploads) fail or get fully buffered into memory.

This hits two upload paths in production:

- `pages.sr.ht` Publish — streaming the site tarball into S3.
- `builds.sr.ht` artifact upload — workers POST job artifacts as a stream.

**Fix.** Set both `RequestChecksumCalculation` and `ResponseChecksumValidation` to `WhenRequired`, so the SDK only checksums when the protocol mandates it. This restores pre-SDK-v1.30 behavior and is the workaround Amazon documents for non-AWS S3 backends (Garage/Ceph/Minio) where strict checksum negotiation is also unreliable.

**Status.** Applied in phoebe-lab production; **not upstreamed yet**. It reaches production two ways, both from the copy in `~/data/home/phoebe-lab/srht/patches/`:

- **Baked into the fork** `sourcecraft.dev/bigbes/sr-ht-core` (upstream core-go + this patch), consumed by the three custom Go services (`sr-ht-compare`, `sr-ht-dolt`, `sr-ht-spec`) as a normal pinned `go.mod` dependency — *not* via a `replace` directive.
- **`git apply`d at image-build time** by the two stack services built from source against upstream core-go: `Dockerfile.pages` and `Dockerfile.builds-worker` each `git clone` core-go (at `SRHT_PAGES_COREGO_REV` / `SRHT_BUILDS_COREGO_REV`), `git apply` this patch, then `go mod edit -replace` onto the patched tree. The `srht-build-1` worker binary reapplies it the same way via `update-worker`. The apk-packaged `builds.sr.ht` api/web is stock (unpatched) — it never uploads to S3, so it doesn't need it.

**Verify it still applies cleanly:**

```bash
cd ~/data/home/sourcehut/core-go
git apply --check ../patches/core-go-checksum.patch
```

If `git apply --check` fails after a `sourcehut-refresh`, upstream has changed that file — re-derive the patch against the new context and update the copy in `~/data/home/phoebe-lab/srht/patches/` first, then re-import here.

### `builds-images-ubuntu-genimg.patch`

**Repo:** `builds.sr.ht`  ·  **File:** `images/ubuntu/genimg`

Two independent bugs in the apk-shipped recipe (`builds.sr.ht-images` 0.103.12-r0; the git-tag at 0.103.12 has slight drift from the apk, see the patch header):

1. **NBD settle race.** After `qemu-nbd --connect=/dev/nbd0` the kernel hasn't updated the block device's reported size yet, and the immediate `dd if=mbr.bin of=/dev/nbd0` fails with `No space left on device`. `debian/genimg` already handles this with a `partprobe` loop; ubuntu's variant is missing it. The patch is a verbatim copy of the debian fix.
2. **Host vs chroot chown.** The recipe runs `chown build:build /mnt/home/build/.gitconfig` on the *host* near the end — but `build` is a chroot user, not a host user. On any builder that doesn't happen to have a same-UID host `build` user, ~5 min of debootstrap work is thrown away by the failing chown. Patch routes it via `run_root chown ... /home/build/.gitconfig`, matching the rest of the script.

**Status.** Applied on `work.lab.local` (the out-of-band image builder VM) at 2026-05-19; **not upstreamed yet**. Should file with sr.ht-dev when a moment opens up — both are obvious bugs the upstream maintainers will likely take.

**Verify it still applies cleanly:**

```bash
cd ~/data/home/sourcehut/builds.sr.ht
git apply --check ../patches/builds-images-ubuntu-genimg.patch
```

Note: the patch is written against the apk-shipped baseline. `git apply --check` may complain about line offsets against the upstream submodule; the underlying logic is what matters. After a `sourcehut-refresh`, eyeball whether the two hunks still describe the same issue before trusting the patch verbatim.