From 6b1fcc6030c787c94d2b1529978c30a5b59a6bf8 Mon Sep 17 00:00:00 2001
From: "Jan Alexander Steffens (heftig)" <heftig@archlinux.org>
Date: Wed, 19 Mar 2025 21:17:26 +0100
Subject: [PATCH 1/2] libmakepkg: Always look in SRCDEST for sources, never
 startdir

Otherwise `verify()` would have to replicate the behavior of
`get_filepath` for each source it wants to check, and test both
`$startdir` and `$SRCDEST`.
---
 doc/PKGBUILD.5.asciidoc              | 12 ++++++------
 scripts/libmakepkg/util/source.sh.in | 22 +++-------------------
 2 files changed, 9 insertions(+), 25 deletions(-)

diff --git a/doc/PKGBUILD.5.asciidoc b/doc/PKGBUILD.5.asciidoc
index 9e2c36fa..775ad021 100644
--- a/doc/PKGBUILD.5.asciidoc
+++ b/doc/PKGBUILD.5.asciidoc
@@ -102,12 +102,12 @@ systems (see below).
 
 *source (array)*::
 	An array of source files required to build the package. Source files
-	must either reside in the same directory as the PKGBUILD, or be a
-	fully-qualified URL that makepkg can use to download the file.
-	To simplify the maintenance of PKGBUILDs, use the `$pkgname` and `$pkgver`
-	variables when specifying the download location, if possible.
-	Compressed files will be extracted automatically unless found in the
-	noextract array described below.
+	must either reside in `$SRCDEST` (if set, otherwise the same directory
+	as the PKGBUILD) or be a fully-qualified URL that makepkg can use to
+	download the file. To simplify the maintenance of PKGBUILDs, use the
+	`$pkgname` and `$pkgver` variables when specifying the download
+	location, if possible. Compressed files will be extracted automatically
+	unless found in the noextract array described below.
 +
 Additional architecture-specific sources can be added by appending an
 underscore and the architecture name e.g., 'source_x86_64=()'. There must be a
diff --git a/scripts/libmakepkg/util/source.sh.in b/scripts/libmakepkg/util/source.sh.in
index 894dc25e..cbd5351f 100644
--- a/scripts/libmakepkg/util/source.sh.in
+++ b/scripts/libmakepkg/util/source.sh.in
@@ -90,28 +90,12 @@ get_filename() {
 
 # Return the absolute filename of a source entry
 get_filepath() {
-	local file="$(get_filename "$1")"
+	local file="$SRCDEST/$(get_filename "$1")"
 	local proto="$(get_protocol "$1")"
 
 	case $proto in
-		bzr|git|hg|svn)
-			if [[ -d "$startdir/$file" ]]; then
-				file="$startdir/$file"
-			elif [[ -d "$SRCDEST/$file" ]]; then
-				file="$SRCDEST/$file"
-			else
-				return 1
-			fi
-			;;
-		*)
-			if [[ -f "$startdir/$file" ]]; then
-				file="$startdir/$file"
-			elif [[ -f "$SRCDEST/$file" ]]; then
-				file="$SRCDEST/$file"
-			else
-				return 1
-			fi
-			;;
+		bzr|git|hg|svn) [[ -d $file ]] || return 1 ;;
+		*) [[ -f $file ]] || return 1 ;;
 	esac
 
 	printf "%s\n" "$file"

From 773de6e82050e02e7b6aa22d6c097a1352f4eb32 Mon Sep 17 00:00:00 2001
From: "Jan Alexander Steffens (heftig)" <heftig@archlinux.org>
Date: Wed, 19 Mar 2025 21:17:28 +0100
Subject: [PATCH 2/2] makepkg: Run verify in SRCDEST, not always startdir

`verify()` verifies downloaded sources before we link or copy them into
`$srcdir`. For this reason it runs in `$startdir`. However, sources are
actually downloaded into `$SRCDEST`, which merely defaults to
`$startdir`.
---
 doc/PKGBUILD.5.asciidoc | 3 ++-
 scripts/makepkg.sh.in   | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/doc/PKGBUILD.5.asciidoc b/doc/PKGBUILD.5.asciidoc
index 775ad021..f37c6e77 100644
--- a/doc/PKGBUILD.5.asciidoc
+++ b/doc/PKGBUILD.5.asciidoc
@@ -342,7 +342,8 @@ function.
 	An optional `verify()` function can be specified to implement arbitrary
 	source authentication. The function should return a non-zero exit code when
 	verification fails. This function is run before sources are extracted.
-	This function is run inside `$startdir`.
+	This function is run inside `$SRCDEST`, if set, otherwise the same
+	directory as the PKGBUILD.
 
 *prepare() Function*::
 	An optional `prepare()` function can be specified in which operations to
diff --git a/scripts/makepkg.sh.in b/scripts/makepkg.sh.in
index 591b010e..f69d3b09 100644
--- a/scripts/makepkg.sh.in
+++ b/scripts/makepkg.sh.in
@@ -450,7 +450,7 @@ run_function() {
 }
 
 run_verify() {
-	run_function_safe "verify" "$startdir"
+	run_function_safe "verify" "$SRCDEST"
 }
 
 run_prepare() {