fix: filebot

utils/pkgs/filebot/default.nix

@@ -0,0 +1,15 @@
+{ fetchurl, filebot }:
+
+# Override the nixpkgs filebot source URL.
+#
+# Upstream nixpkgs fetches from a single web.archive.org mirror which started
+# returning HTTP 429, breaking builds. The same tarball is still hosted at
+# get.filebot.net, so we swap the URL. The hash matches nixpkgs' pinned one
+# because archive.org captured a byte-identical copy. Run ./update.sh to
+# refresh if upstream re-uploads.
+filebot.overrideAttrs (oldAttrs: {
+  src = fetchurl {
+    url = "https://get.filebot.net/filebot/FileBot_${oldAttrs.version}/FileBot_${oldAttrs.version}-portable.tar.xz";
+    hash = "sha256-OcXXKaZcBuP584SJWeQB+aaxO0kih6Oiud0Vm8e9kPo=";
+  };
+})

utils/pkgs/filebot/update.sh

@@ -0,0 +1,31 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl cacert nix
+
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+# Discover latest upstream version (same logic as nixpkgs' genericUpdater).
+echo "Fetching latest FileBot version from filebot.net..."
+version=$(curl -fsSL https://www.filebot.net \
+  | sed -rne 's,^.*FileBot_([0-9]+\.[0-9]+\.[0-9]+)-portable\.tar\.xz.*,\1,p' \
+  | sort -uV | tail -n1)
+
+# Allow pinning: ./update.sh --version 5.2.0
+if [ "${1:-}" = "--version" ] && [ -n "${2:-}" ]; then
+  version="$2"
+fi
+
+if [ -z "${version:-}" ]; then
+  echo "Error: could not determine FileBot version" >&2
+  exit 1
+fi
+echo "Version: $version"
+
+url="https://get.filebot.net/filebot/FileBot_${version}/FileBot_${version}-portable.tar.xz"
+hash=$(nix-prefetch-url --type sha256 "$url")
+sri_hash=$(nix-hash --type sha256 --to-sri "$hash")
+echo "SRI hash: $sri_hash"
+
+sed -i "s|hash = \"sha256-[A-Za-z0-9+/=]\{43,\}=\";|hash = \"$sri_hash\";|" default.nix
+
+echo "Updated utils/pkgs/filebot/default.nix -> $sri_hash"