scripts/fossil-as-user/secure-wrap
scripts/fossil-as-user/filter.h
repos/*
db/*.db
scripts/fossil/fossil-*
scripts/fossil/work

#! /usr/bin/env bash

target='x86_64-generic-linux-musl'

fossil_version='2.26'
fossil_commit_hash='1205ec86cb5508e94b90698db2900997fe5c9db62429c67ac6fdc03d59aa2782'
fossil_url="https://fossil-scm.org/home/tarball/${fossil_commit_hash}/fossil-src-${fossil_version}.tar.gz"
fossil_sha256='a9be104c8055ada40985a158392d73f3c84829accb5b5d404e361fea360774c2'
fossil_archive="fossil-${fossil_version}.tar.gz"
fossil_dir='fossil'

libressl_version='3.1.4'
libressl_url="http://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-${libressl_version}.tar.gz"
libressl_sha256='414c149c9963983f805a081db5bd3aec146b5f82d529bb63875ac941b25dcbb6'
libressl_archive="libressl-${libressl_version}.tar.gz"

		patch --no-backup-if-mismatch --force -p1 < "${file}" || exit 1
	done

	# Setup cross-compiler
	## From Build-CC 0.9+
	eval $(~/root/cross-compilers/setup-cc "${target}") || exit 1
	export CC="${CC} -std=gnu99"

	# Setup to use LibreSSL we just compiled
	export PKG_CONFIG_PATH="${workdir}/libressl/INST/lib/pkgconfig"

	# Setup to use KitCreator's KitDLL
	export TCLKIT_SDK_DIR="${workdir}/kitcreator/INST/"

diff -uNr fossil-src-2.26.orig/src/manifest.c fossil-src-2.26/src/manifest.c
--- fossil-src-2.26.orig/src/manifest.c	2025-04-30 11:57:32.000000000 -0500
+++ fossil-src-2.26/src/manifest.c	2025-06-05 09:51:52.210449872 -0500
@@ -314,6 +314,138 @@
 }
 
 /*
+** Remove the SMIME signature if there is one
+*/
+static void remove_smime_signature(const char **pz, int *pn){
+	const char *manifest;
+	char boundary[256];
+	int manifest_len;
+	int idx;
+	int line_start, line_end, boundary_start, boundary_end, boundary_len;
+	int manifestclear_start, manifestclear_end, manifestclear_len;
+	int allow_quote;
+
+	manifest = *pz;
+	manifest_len = *pn;
+
+	if (manifest_len >= 18 && memcmp(manifest, "MIME-Version: 1.0\n", 18) == 0) {
+		/* Proccess as a multipart MIME message */
+		if (manifest_len < 30) {
+			return;
+		}
+
+		line_start = -1;
+		for (idx = 18; idx < manifest_len - 30; idx++) {
+			if (memcmp(&manifest[idx], "Content-Type: multipart/signed", 30) != 0) {
+				continue;
+			}
+
+			line_start = idx;
+
+			break;
+		}
+
+		if (line_start == -1) {
+			return;
+		}
+
+		line_end = -1;
+		for (idx = line_start + 1; idx < manifest_len; idx++) {
+			if (manifest[idx] != '\n') {
+				continue;
+			}
+
+			line_end = idx - 1;
+
+			break;
+		}
+
+		if (line_end == -1) {
+			return;
+		}
+
+		boundary_start = -1;
+		allow_quote = 1;
+		for (idx = line_start; idx < line_end - 9; idx++) {
+			if (memcmp(&manifest[idx], "boundary=", 9) != 0) {
+				continue;
+			}
+
+			if (manifest[idx - 1] != ' ' && manifest[idx - 1] != ';') {
+				continue;
+			}
+
+			boundary_start = idx + 9;
+
+			if (manifest[idx + 9] == '"') {
+				allow_quote = 0;
+
+				boundary_start++;
+			}
+
+			break;
+		}
+		if (boundary_start == -1) {
+			return;
+		}
+
+		boundary_end = line_end;
+		for (idx = boundary_start; idx < line_end; idx++) {
+			if (manifest[idx] == '"' && allow_quote) {
+				continue;
+			}
+
+			if (manifest[idx] != ' ' && manifest[idx] != ';' && manifest[idx] != '"') {
+				continue;
+			}
+
+			boundary_end = idx;
+
+			break;
+		}
+
+		boundary_len = boundary_end - boundary_start;
+		boundary_len = snprintf(boundary, sizeof(boundary), "\n--%.*s\n", boundary_len, manifest + boundary_start);
+
+		manifestclear_start = -1;
+		for (idx = 0; idx < manifest_len - boundary_len; idx++) {
+			if (memcmp(&manifest[idx], boundary, boundary_len) != 0) {
+				continue;
+			}
+
+			manifestclear_start = idx + boundary_len;
+
+			break;
+		}
+
+		if (manifestclear_start == -1) {
+			return;
+		}
+
+		manifestclear_end = -1;
+		for (idx = manifestclear_start; idx < manifest_len - boundary_len; idx++) {
+			if (memcmp(&manifest[idx], boundary, boundary_len) != 0) {
+				continue;
+			}
+
+			manifestclear_end = idx;
+
+			break;
+		}
+
+		if (manifestclear_end == -1) {
+			return;
+		}
+
+		manifestclear_len = manifestclear_end - manifestclear_start;
+		*pz = &manifest[manifestclear_start];
+		*pn = manifestclear_len;
+	}
+
+	return;
+}
+
+/*
 ** Remove the PGP signature from the artifact, if there is one.
 */
 static void remove_pgp_signature(const char **pz, int *pn){
@@ -322,7 +454,7 @@
   int i;
   if( strncmp(z, "-----BEGIN PGP SIGNED MESSAGE-----", 34)==0 ) i = 34;
   else if( strncmp(z, "-----BEGIN SSH SIGNED MESSAGE-----", 34)==0 ) i = 34;
-  else return;
+  else { remove_smime_signature(pz, pn); return; }
   for(; i<n && !after_blank_line(z+i); i++){}
   if( i>=n ) return;
   z += i;