From c408cfe2cee1e8d59fd38928bca5e33cd0cb74a7 Mon Sep 17 00:00:00 2001
From: Miguel Jacq <mig@mig5.net>
Date: Wed, 13 May 2026 11:48:10 +1000
Subject: [PATCH] Update to SQLCipher 4.16.0 and pass timestamp/sqlcipher
 version to package names/changelog

---
 Dockerfile                     |  5 +++--
 debian/changelog.in            |  3 ++-
 scripts/package.sh             |  7 +++++++
 scripts/render-debian-files.sh | 21 ++++++++++++++++++---
 4 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index 674092f..ec74770 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -5,9 +5,10 @@ FROM ${BASE_IMAGE} AS build
 ARG DEBIAN_FRONTEND=noninteractive
 ARG TZ=UTC
 ARG PHP_VER=8.2
-ARG SQLCIPHER_VERSION=4.15.0
+ARG SQLCIPHER_VERSION=4.16.0
+ARG BUILD_ID=
 
-ENV TZ=${TZ} PHP_VER=${PHP_VER} SQLCIPHER_VERSION=${SQLCIPHER_VERSION}
+ENV TZ=${TZ} PHP_VER=${PHP_VER} SQLCIPHER_VERSION=${SQLCIPHER_VERSION} BUILD_ID=${BUILD_ID}
 
 SHELL ["/bin/bash","-o","pipefail","-c"]
 
diff --git a/debian/changelog.in b/debian/changelog.in
index 3674351..f709f97 100644
--- a/debian/changelog.in
+++ b/debian/changelog.in
@@ -1,6 +1,7 @@
 ${PKG} (${PKG_VERSION}) ${DIST_CODENAME}; urgency=medium
 
-  * Build sqlite3 and pdo_sqlite against SQLCipher.
+  * Build sqlite3 and pdo_sqlite against SQLCipher ${SQLCIPHER_VERSION}.
+  * Build ID: ${BUILD_ID}.
   * Drop-in replacement for php${PHP_VER}-sqlite3.
 
  -- ${MAINT_NAME} <${MAINT_EMAIL}>  ${DATE_RFC2822}
diff --git a/scripts/package.sh b/scripts/package.sh
index 564ab15..91c8996 100755
--- a/scripts/package.sh
+++ b/scripts/package.sh
@@ -2,6 +2,8 @@
 
 set -euo pipefail
 
+SQLCIPHER_VERSION="${SQLCIPHER_VERSION:-4.16.0}"
+
 # Space-separated list of PHP major.minor versions to build
 PHPS="${PHPS:-"7.4 8.0 8.1 8.2 8.3 8.4 8.5"}"
 
@@ -13,6 +15,9 @@ BASE_MATRIX=(
   "ubuntu:22.04|jammy"
 )
 
+# Unique package rebuild identifier.
+BUILD_ID="${BUILD_ID:-$(date -u +%Y%m%d%H%M%S)}"
+
 # Where to put artifacts on the host
 OUT_DIR="${OUT_DIR:-"$(cd "$(dirname "$0")/.."; pwd)/build"}"
 
@@ -56,6 +61,8 @@ for entry in "${BASE_MATRIX[@]}"; do
         -f "${DOCKERFILE}" \
         --build-arg "BASE_IMAGE=${BASE_IMAGE}" \
         --build-arg "PHP_VER=${PHP_VER}" \
+        --build-arg "SQLCIPHER_VERSION=${SQLCIPHER_VERSION}" \
+        --build-arg "BUILD_ID=${BUILD_ID}" \
         --progress=plain \
         -t "${TAG}" \
         ${EXTRA_BUILD_ARGS} \
diff --git a/scripts/render-debian-files.sh b/scripts/render-debian-files.sh
index 34ba822..a8976a3 100755
--- a/scripts/render-debian-files.sh
+++ b/scripts/render-debian-files.sh
@@ -27,14 +27,29 @@ if [[ -z "${PKG_VERSION:-}" ]]; then
   else
     PHP_FULL="$(dpkg-query -W -f='${Version}\n' "${PHP_BIN}-dev" 2>/dev/null | sed 's/-.*//;q' || echo "${PHP_VER}.0")"
   fi
-  PKG_VERSION="${PHP_FULL}-1+${DIST_CODENAME}"
+
+  BUILD_ID="${BUILD_ID:-$(date -u +%Y%m%d%H%M%S)}"
+
+  # Debian revision cannot contain hyphens. Keep this conservative.
+  SQLCIPHER_DEB_VER="$(
+    printf '%s' "${SQLCIPHER_VERSION:-unknown}" \
+      | sed -E 's/^[vV]//; s/[^A-Za-z0-9.+~]/./g'
+  )"
+
+  BUILD_ID_DEB="$(
+    printf '%s' "${BUILD_ID}" \
+      | sed -E 's/[^A-Za-z0-9.+~]/./g'
+  )"
+
+  PKG_VERSION="${PHP_FULL}-1+${DIST_CODENAME}.${BUILD_ID_DEB}.sqlcipher${SQLCIPHER_DEB_VER}"
 fi
 
+
 # Export everything envsubst must see
-export PHP_VER PKG PHP_BIN DOC_DIR DIST_CODENAME PKG_VERSION MAINT_NAME MAINT_EMAIL DATE_RFC2822
+export PHP_VER PKG PHP_BIN DOC_DIR DIST_CODENAME PKG_VERSION MAINT_NAME MAINT_EMAIL DATE_RFC2822 SQLCIPHER_VERSION BUILD_ID
 
 # Only substitute the vars we care about
-VARS='${PHP_VER} ${PKG} ${PHP_BIN} ${DOC_DIR} ${DIST_CODENAME} ${PKG_VERSION} ${MAINT_NAME} ${MAINT_EMAIL} ${DATE_RFC2822}'
+VARS='${PHP_VER} ${PKG} ${PHP_BIN} ${DOC_DIR} ${DIST_CODENAME} ${PKG_VERSION} ${MAINT_NAME} ${MAINT_EMAIL} ${DATE_RFC2822} ${SQLCIPHER_VERSION} ${BUILD_ID}'
 
 render() {
   local src="$1" dst="$2"