Update to SQLCipher 4.16.0 and pass timestamp/sqlcipher version to package names/changelog

Dockerfile

@@ -5,9 +5,10 @@ FROM ${BASE_IMAGE} AS build
 ARG DEBIAN_FRONTEND=noninteractive
 ARG TZ=UTC
 ARG PHP_VER=8.2
-ARG SQLCIPHER_VERSION=4.15.0
+ARG SQLCIPHER_VERSION=4.16.0
+ARG BUILD_ID=
 
-ENV TZ=${TZ} PHP_VER=${PHP_VER} SQLCIPHER_VERSION=${SQLCIPHER_VERSION}
+ENV TZ=${TZ} PHP_VER=${PHP_VER} SQLCIPHER_VERSION=${SQLCIPHER_VERSION} BUILD_ID=${BUILD_ID}
 
 SHELL ["/bin/bash","-o","pipefail","-c"]
 

debian/changelog.in

@@ -1,6 +1,7 @@
 ${PKG} (${PKG_VERSION}) ${DIST_CODENAME}; urgency=medium
 
-  * Build sqlite3 and pdo_sqlite against SQLCipher.
+  * Build sqlite3 and pdo_sqlite against SQLCipher ${SQLCIPHER_VERSION}.
+  * Build ID: ${BUILD_ID}.
   * Drop-in replacement for php${PHP_VER}-sqlite3.
 
  -- ${MAINT_NAME} <${MAINT_EMAIL}>  ${DATE_RFC2822}

scripts/package.sh

@@ -2,6 +2,8 @@
 
 set -euo pipefail
 
+SQLCIPHER_VERSION="${SQLCIPHER_VERSION:-4.16.0}"
+
 # Space-separated list of PHP major.minor versions to build
 PHPS="${PHPS:-"7.4 8.0 8.1 8.2 8.3 8.4 8.5"}"
 
@@ -13,6 +15,9 @@ BASE_MATRIX=(
   "ubuntu:22.04|jammy"
 )
 
+# Unique package rebuild identifier.
+BUILD_ID="${BUILD_ID:-$(date -u +%Y%m%d%H%M%S)}"
+
 # Where to put artifacts on the host
 OUT_DIR="${OUT_DIR:-"$(cd "$(dirname "$0")/.."; pwd)/build"}"
 
@@ -56,6 +61,8 @@ for entry in "${BASE_MATRIX[@]}"; do
         -f "${DOCKERFILE}" \
         --build-arg "BASE_IMAGE=${BASE_IMAGE}" \
         --build-arg "PHP_VER=${PHP_VER}" \
+        --build-arg "SQLCIPHER_VERSION=${SQLCIPHER_VERSION}" \
+        --build-arg "BUILD_ID=${BUILD_ID}" \
         --progress=plain \
         -t "${TAG}" \
         ${EXTRA_BUILD_ARGS} \

scripts/render-debian-files.sh

@@ -27,14 +27,29 @@ if [[ -z "${PKG_VERSION:-}" ]]; then
   else
     PHP_FULL="$(dpkg-query -W -f='${Version}\n' "${PHP_BIN}-dev" 2>/dev/null | sed 's/-.*//;q' || echo "${PHP_VER}.0")"
   fi
-  PKG_VERSION="${PHP_FULL}-1+${DIST_CODENAME}"
+
+  BUILD_ID="${BUILD_ID:-$(date -u +%Y%m%d%H%M%S)}"
+
+  # Debian revision cannot contain hyphens. Keep this conservative.
+  SQLCIPHER_DEB_VER="$(
+    printf '%s' "${SQLCIPHER_VERSION:-unknown}" \
+      | sed -E 's/^[vV]//; s/[^A-Za-z0-9.+~]/./g'
+  )"
+
+  BUILD_ID_DEB="$(
+    printf '%s' "${BUILD_ID}" \
+      | sed -E 's/[^A-Za-z0-9.+~]/./g'
+  )"
+
+  PKG_VERSION="${PHP_FULL}-1+${DIST_CODENAME}.${BUILD_ID_DEB}.sqlcipher${SQLCIPHER_DEB_VER}"
 fi
 
+
 # Export everything envsubst must see
-export PHP_VER PKG PHP_BIN DOC_DIR DIST_CODENAME PKG_VERSION MAINT_NAME MAINT_EMAIL DATE_RFC2822
+export PHP_VER PKG PHP_BIN DOC_DIR DIST_CODENAME PKG_VERSION MAINT_NAME MAINT_EMAIL DATE_RFC2822 SQLCIPHER_VERSION BUILD_ID
 
 # Only substitute the vars we care about
-VARS='${PHP_VER} ${PKG} ${PHP_BIN} ${DOC_DIR} ${DIST_CODENAME} ${PKG_VERSION} ${MAINT_NAME} ${MAINT_EMAIL} ${DATE_RFC2822}'
+VARS='${PHP_VER} ${PKG} ${PHP_BIN} ${DOC_DIR} ${DIST_CODENAME} ${PKG_VERSION} ${MAINT_NAME} ${MAINT_EMAIL} ${DATE_RFC2822} ${SQLCIPHER_VERSION} ${BUILD_ID}'
 
 render() {
   local src="$1" dst="$2"