fp6-vendor-blobs: the checksum the extractor change forgot, and a check that finds the next one in a second

CI run 52 failed at minute 57 with `fp6-vendor-blobs-extract: FAILED` from
abuild's checksum verification: 9575e55 changed the extractor and left its
sha512sums entry alone. Nothing was installed or published; latest is the
run-51 image.

Fix the sum, and stop paying an hour to learn it. check-aports.sh sources
every APKBUILD under aports/ and compares the committed sha512sums of its
local source files (scripts, units, configs, patches, including ones in a
subdirectory) against the files themselves. build.sh runs it before
pmbootstrap touches anything, so this class of mistake now fails in the first
seconds of a run and prints the line to paste. Aports whose sums build.sh
regenerates with pmbootstrap checksum are read from build.sh and skipped, so
the two lists cannot drift.

Verified: the checker reports exactly the run-52 mismatch on the tree as
pushed and nothing on the tree as fixed; a scratch copy with one corrupted
sum is caught; the fixed aport builds under abuild in an alpine:edge
container (the only complaint was the throwaway signing key at the index
step, which the CI's pmbootstrap flow does not have).

aports/device/fp6-vendor-blobs/APKBUILD

@@ -55,7 +55,7 @@ package() {
 }
 
 sha512sums="
-a71b2c86f980734d0aae6e135b26272fe52ae5603050bea52f55f7e74c8bd98c62b6194047711248d4fef40851792adc47d77c40016d99a0d68ecd2459894b80  fp6-vendor-blobs-extract
+2caafdedf93e103516834a1f815dd828ecee66c82d569e4a925ccc6bd6ac75d6778290adb02db69538af3bb6ad36cee5c13c8afba2c722a4c4550efe761ba8a0  fp6-vendor-blobs-extract
 b4c290095d9f39515378dfef08de720ce49324210342aa13c131dfce1103785e796e6f821f0c659671a4c44b46f466ce0e03f11f216fdcdee2a99db5e7970800  fp6-vendor-blobs.service
 9e79dd0aed13f11a71282aa24b2a26331e85c105e25ab0c0fed6189b8c300769a5f4308b18b91d9855868d658ad3a57c03e26c9b11bd27fd5e03f9a5decbbd6a  fp6-vendor-blobs.preset
 "

build.sh

@@ -47,6 +47,11 @@ FPD_SHA256="
 PMAPORTS_REPO=https://gitlab.postmarketos.org/postmarketOS/pmaports.git
 
 cd "$(dirname "$0")"
+# Fail in seconds, not at minute 57: a stale sha512sum in one of our own
+# aports (run 52, fp6-vendor-blobs 1-r2) only surfaces when abuild reaches that
+# aport, an hour into the run. This checks every aport's local source files
+# against the committed sums before pmbootstrap does anything.
+./check-aports.sh
 
 # pmbootstrap refuses to run as root: install deps, then re-exec as a build
 # user with passwordless sudo (pmbootstrap escalates itself where needed).

check-aports.sh

@@ -0,0 +1,55 @@
+#!/bin/sh -eu
+# check-aports.sh - verify the committed sha512sums of every aport's LOCAL
+# source files (scripts, units, configs, patches) against the files actually
+# in the aport directory.
+#
+# Why this exists: CI run 52 (2026-09-05) died after 57 minutes, at the point
+# abuild reached fp6-vendor-blobs, because the extractor had been changed and
+# its sha512sum had not. abuild finds that only when it gets to that aport;
+# this finds it in under a second, before pmbootstrap does anything. build.sh
+# runs it first; run it by hand before pushing too.
+#
+# Out of scope, by design: sources fetched from a URL (abuild verifies those
+# against the same sums after fetching), and the aports whose sums build.sh
+# regenerates at build time with 'pmbootstrap checksum' (their tarballs are
+# generated there and do not exist here) - that list is read from build.sh so
+# the two cannot drift apart.
+cd "$(dirname "$0")"
+regen=$(sed -n 's/^pmbootstrap checksum \([a-z0-9-]*\)$/\1/p' build.sh | tr '\n' ' ')
+rc=0
+for d in aports/*/*/; do
+	[ -f "$d/APKBUILD" ] || continue
+	d=${d%/}
+	case " $regen " in *" ${d##*/} "*) continue ;; esac
+	info=$(cd "$d" && sh -c '. ./APKBUILD; printf "%s\n" $source; printf "==\n"; printf "%s\n" "$sha512sums"' 2>/dev/null) || {
+		echo "$d: APKBUILD does not source cleanly" >&2; rc=1; continue
+	}
+	srcs=$(printf '%s\n' "$info" | sed '/^==$/,$d')
+	sums=$(printf '%s\n' "$info" | sed '1,/^==$/d')
+	for s in $srcs; do
+		case "$s" in
+		*://*) continue ;;                 # remote: abuild fetches and verifies
+		*::*) f=${s%%::*} ;;
+		*) f=${s##*/} ;;
+		esac
+		# a local source may sit in a subdirectory (rules/00_log_all.nft);
+		# the sums entry is keyed by its basename either way
+		path="$d/$s"; [ -f "$path" ] || path="$d/$f"
+		want=$(printf '%s\n' "$sums" | awk -v f="$f" '$2==f{print $1}')
+		[ "$want" = REPLACED_BY_CI ] && continue
+		if [ ! -f "$path" ]; then
+			echo "$d: local source '$s' is missing" >&2; rc=1; continue
+		fi
+		if [ -z "$want" ]; then
+			echo "$d: '$f' has no sha512sums entry" >&2; rc=1; continue
+		fi
+		have=$(sha512sum "$path" | awk '{print $1}')
+		if [ "$want" != "$have" ]; then
+			echo "$d: sha512 MISMATCH for '$f' (APKBUILD has ${want%"${want#????????????????}"}..., file is ${have%"${have#????????????????}"}...)" >&2
+			echo "$d:   fix: update the sha512sums entry to: $have  $f" >&2
+			rc=1
+		fi
+	done
+done
+[ "$rc" = 0 ] && echo "check-aports: all local source checksums match"
+exit $rc