From 638daaadb3b91988157b193ee30ec5d0e1251b35 Mon Sep 17 00:00:00 2001
From: cr0n <cr0n@cypherpunks.cc>
Date: Mon, 8 Jun 2026 15:11:11 +0200
Subject: [PATCH] necesse-server: 1.2.0-22728942 -> 1.2.0-23522718

add s3 server file caching via update script
---
 pkgs/by-name/ne/necesse-server/package.nix |  6 +++---
 pkgs/by-name/ne/necesse-server/update.sh   | 23 +++++++++++++++++++---
 2 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/ne/necesse-server/package.nix b/pkgs/by-name/ne/necesse-server/package.nix
index 73e8e1bf9b73..88e7c558b6e1 100644
--- a/pkgs/by-name/ne/necesse-server/package.nix
+++ b/pkgs/by-name/ne/necesse-server/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.2.0-22728942";
+  version = "1.2.0-23522718";
   urlVersion = lib.replaceStrings [ "." ] [ "-" ] version;
 
 in
@@ -15,8 +15,8 @@ stdenvNoCC.mkDerivation {
   inherit version;
 
   src = fetchzip {
-    url = "https://necessegame.com/content/server/${urlVersion}/necesse-server-linux64-${urlVersion}.zip";
-    hash = "sha256-kSBql3oHG368DczSM7FkWeAZcfTrNP1x31LX7HRrgTE=";
+    url = "https://necesse.pwn.sh/server/necesse-server-linux64-${urlVersion}.zip";
+    hash = "sha256-PIguTYULddLKj6PpoSvX3gNSvqrS7oRTOPuwoA0/XOc=";
   };
 
   # removing packaged jre since we use our own
diff --git a/pkgs/by-name/ne/necesse-server/update.sh b/pkgs/by-name/ne/necesse-server/update.sh
index 19c409d3700a..d034702d1713 100755
--- a/pkgs/by-name/ne/necesse-server/update.sh
+++ b/pkgs/by-name/ne/necesse-server/update.sh
@@ -3,13 +3,30 @@
 
 set -eu -o pipefail
 
+website=$(curl -sL https://necessegame.com/server)
+
 version=$(
-    curl -s http://www.necessegame.com/server \
+    echo "$website" \
         | pup 'a[href*="linux64"] text{}' \
         | awk -F'[v ]' '/Linux64/ {print $4"-"$6}' \
         | sort -Vu \
         | tail -n1
 )
 
-[[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+\-[0-9]+$ ]] \
-    && update-source-version necesse-server "$version"
+if [[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+\-[0-9]+$ ]]; then
+    version_url=${version//./-}
+
+    # extract the expiring presigned S3 URL for the new zip
+    url=$(
+        echo "$website" \
+            | pup "a[href*=\"linux64-${version_url}\"] attr{href}" \
+            | sed 's/\&amp;/\&/g'
+    )
+
+    # call API to remote-fetch the zip immediately and keep it cached,
+    # then fetch the zip locally to get the SRI hash, then update.
+    # fails early if the zip cannot be remote-fetched / cached.
+    curl -s --fail-with-body "https://necesse.pwn.sh/cache.php?version=${version_url}" \
+        && sri=$(nix-prefetch-url --unpack "$url" | xargs nix hash convert --hash-algo sha256 --to sri) \
+        && update-source-version necesse-server "$version" "$sri"
+fi