From 84a55a8cc79adeaa99689838ade184809cb904ac Mon Sep 17 00:00:00 2001
From: vasilito <adminpupkin@gmail.com>
Date: Sun, 12 Jul 2026 17:52:37 +0300
Subject: [PATCH] =?UTF-8?q?fix:=20build=20system=20hardening=20=E2=80=94?=
 =?UTF-8?q?=203=20fixes=20for=20clean=20redbear-mini=20build?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

apply-patches.sh: 005-qtbase signature now checks correct path
(recipes/wip/qt/qtbase, not recipes/libs/qtbase) and respects
local recipe override. Qt is desktop-only (redbear-full target).

check-fork-drift.sh: skip diverged forks (kernel, bootloader, installer)
to suppress spurious DRIFT warnings. These forks intentionally diverge
from upstream per fork-upstream-map.toml.

integrate-redbear.sh: add safety guard — refuse to symlink any path
ending in 'recipe.toml'. 185 local recipe.toml files were corrupted
into broken self-referencing symlinks by an earlier build session.
All restored from git. Guard prevents reoccurrence.
---
 local/scripts/integrate-redbear.sh | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/local/scripts/integrate-redbear.sh b/local/scripts/integrate-redbear.sh
index 7b37b5108b..83ed07eae0 100755
--- a/local/scripts/integrate-redbear.sh
+++ b/local/scripts/integrate-redbear.sh
@@ -72,6 +72,12 @@ symlink() {
     local link="$2"
     local current=""
 
+    # Safety: never operate on recipe.toml files (they are tracked, not symlinks)
+    if [[ "$link" == *recipe.toml ]]; then
+        warn "Refusing to symlink recipe.toml: $link"
+        return 1
+    fi
+
     require_real_parent_dirs "$link"
 
     mkdir -p "$(dirname "$link")"