From f623205f45b38c5bc74a4552867f2dfa34b0ab8e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cristian=20Cezar=20Mois=C3=A9s?= <sac@securityops.co>
Date: Mon, 31 Aug 2026 15:41:34 -0300
Subject: [PATCH] packaging: pin 5.2.3 source archive checksums [skip ci]

---
 packaging/aur/PKGBUILD     | 4 ++--
 packaging/guix/zupt.scm    | 2 +-
 packaging/homebrew/zupt.rb | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/packaging/aur/PKGBUILD b/packaging/aur/PKGBUILD
index 87c1061..561103e 100644
--- a/packaging/aur/PKGBUILD
+++ b/packaging/aur/PKGBUILD
@@ -22,8 +22,8 @@ makedepends=('gcc' 'git' 'make')
 checkdepends=('python')
 
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/cristiancmoises/zupt/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz")
-# Replace only after generating the byte-reproducible final release archive.
-sha256sums=('REPLACE_AFTER_FINAL_ARCHIVE_SHA256')
+# Byte-reproducible upstream v5.2.3 source archive.
+sha256sums=('062f008751a4333bd88ad8a826b98066704b4cb9bc08a016f2f5083365b449d4')
 
 build() {
     cd "${pkgname}-${pkgver}"
diff --git a/packaging/guix/zupt.scm b/packaging/guix/zupt.scm
index 41cf041..80138c6 100644
--- a/packaging/guix/zupt.scm
+++ b/packaging/guix/zupt.scm
@@ -72,7 +72,7 @@
           "/releases/download/v" %zupt-version
           "/zupt-" %zupt-version ".tar.gz"))
     (sha256
-    (base32 "REPLACE_AFTER_FINAL_ARCHIVE_GUIX_BASE32"))))
+    (base32 "1m29nijk627my8ba025wp564nw36h2wjda6qibc3ncx4a63h0bq6"))))
 
 (define-public zupt
   (package
diff --git a/packaging/homebrew/zupt.rb b/packaging/homebrew/zupt.rb
index 81f2322..2ca5e47 100644
--- a/packaging/homebrew/zupt.rb
+++ b/packaging/homebrew/zupt.rb
@@ -24,7 +24,7 @@ class Zupt < Formula
   homepage "https://github.com/cristiancmoises/zupt"
   url "https://github.com/cristiancmoises/zupt/releases/download/v5.2.3/zupt-5.2.3.tar.gz"
   version "5.2.3"
-  sha256 "REPLACE_AFTER_FINAL_ARCHIVE_SHA256"
+  sha256 "062f008751a4333bd88ad8a826b98066704b4cb9bc08a016f2f5083365b449d4"
   license all_of: ["AGPL-3.0-or-later", "GPL-3.0-or-later", "BSD-2-Clause", "BSD-3-Clause", "CC0-1.0"]
 
   depends_on "python@3.12" => :test  # only for test-suite tamper harness