From 8a6390ee115dd911612f49cdaa28d2f316cb1604 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 17 Jun 2025 15:21:42 +0200
Subject: [PATCH 1/3] bash: Add a comment to a patch

With this, all (non-upstream) patches are commented
---
 pkgs/shells/bash/5.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 66172bddd125..12cb7ee42bc7 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -74,6 +74,11 @@ lib.warnIf (withDocs != null)
     patchFlags = [ "-p0" ];
 
     patches = upstreamPatches ++ [
+      # Enable PGRP_PIPE independently of the kernel of the build machine.
+      # This doesn't seem to be upstreamed despite such a mention of in https://github.com/NixOS/nixpkgs/pull/77196,
+      # which originally introduced the patch
+      # Some related discussion can be found in
+      # https://lists.gnu.org/archive/html/bug-bash/2015-05/msg00071.html
       ./pgrp-pipe-5.patch
       # Apply parallel build fix pending upstream inclusion:
       #   https://savannah.gnu.org/patch/index.php?10373

From 1b2369a80e38cb5bc79d286c5e921893048dfb78 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 17 Jun 2025 15:22:35 +0200
Subject: [PATCH 2/3] bash: Improve patch signing key fetching and verification

Get it from a more directly trusted source and update md5 -> sha256

Running the script still works with all signature verifications
succeeding
---
 pkgs/shells/bash/update-patch-set.sh | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/shells/bash/update-patch-set.sh b/pkgs/shells/bash/update-patch-set.sh
index ee785cc83123..721b867c3bf8 100755
--- a/pkgs/shells/bash/update-patch-set.sh
+++ b/pkgs/shells/bash/update-patch-set.sh
@@ -22,11 +22,13 @@ set -e
 
 rm -vf "$PATCH_LIST"
 
-wget "https://tiswww.case.edu/php/chet/gpgkey.asc"
-echo "4ef5051ce7200241e65d29c11eb57df8  gpgkey.asc" > gpgkey.asc.md5
-md5sum -c gpgkey.asc.md5
+# https://savannah.gnu.org/projects/bash/: Group Admins: Chet Ramey
+# https://savannah.gnu.org/users/chet: Download GPG Key
+wget "https://savannah.gnu.org/people/viewgpg.php?user_id=2590" -O gpgkey.asc
+echo "db4041b4d3896b9f21250e6c29861958bd5d4781f521f06beda849a9ed79fae8  gpgkey.asc" > gpgkey.asc.sha256
+sha256sum -c gpgkey.asc.sha256
 gpg --import ./gpgkey.asc
-rm gpgkey.asc{,.md5}
+rm gpgkey.asc{,.sha256}
 
 ( echo "# Automatically generated by \`$(basename "$0")'; do not edit." ;	\
   echo "" ;								\

From 0caffc0c071d3cfa41d03bc4d96ffbf4b55a7ed2 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 17 Jun 2025 15:24:14 +0200
Subject: [PATCH 3/3] bash: Generate patch list to conform to the Nix format

---
 pkgs/shells/bash/update-patch-set.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/shells/bash/update-patch-set.sh b/pkgs/shells/bash/update-patch-set.sh
index 721b867c3bf8..0467a2aae4d6 100755
--- a/pkgs/shells/bash/update-patch-set.sh
+++ b/pkgs/shells/bash/update-patch-set.sh
@@ -41,7 +41,7 @@ do
     wget -P "$DIR" "ftp.gnu.org/gnu/$PROJECT/$PROJECT-$VERSION-patches/$PROJECT$VERSION_CONDENSED-$i.sig"
     gpg --verify "$DIR/$PROJECT$VERSION_CONDENSED-$i.sig"
     hash=$(nix-hash --flat --type sha256 --base32 "$DIR/$PROJECT$VERSION_CONDENSED-$i")
-    echo "(patch \"$i\" \"$hash\")"	\
+    echo "  (patch \"$i\" \"$hash\")"	\
     >> "$PATCH_LIST"
 
     rm -f "$DIR/$PROJECT$VERSION_CONDENSED-$i"{,.sig}