graphene-hardened-malloc: add updateScript (#360468)

* graphene-hardened-malloc: add updateScript

* graphene-hardened-malloc: 2024040900 -> 2024120400

pkgs/by-name/gr/graphene-hardened-malloc/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphene-hardened-malloc";
-  version = "2024040900";
+  version = "2024120400";
 
   src = fetchFromGitHub {
     owner = "GrapheneOS";
     repo = "hardened_malloc";
     rev = finalAttrs.version;
-    hash = "sha256-1j7xzhuhK8ZRAJm9dJ95xiTIla7lh3LBiWc/+x/kjp0=";
+    hash = "sha256-VzP7JimAbFcp1HrSS3GArSRhxHaa1s49kFP22iDHt+8=";
   };
 
   nativeCheckInputs = [ python3 ];
@@ -47,6 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   separateDebugInfo = true;
 
   passthru = {
+    updateScript = ./update.sh;
     ld-preload-tests = stdenv.mkDerivation {
       name = "${finalAttrs.pname}-ld-preload-tests";
       inherit (finalAttrs) src;

pkgs/by-name/gr/graphene-hardened-malloc/update.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p bash cacert curl common-updater-scripts
+# shellcheck shell=bash
+set -eu -o pipefail
+
+host="https://releases.grapheneos.org"
+read -ra metadata <<< "$(curl -s "$host/caiman-stable")"
+version=${metadata[0]}
+
+update-source-version graphene-hardened-malloc "$version"