From e46de2b9679e4517f70e8ecd14dd01eef0131558 Mon Sep 17 00:00:00 2001
From: Chaosoffire <81634128+chaosoffire@users.noreply.github.com>
Date: Mon, 12 Jan 2026 20:49:19 +0800
Subject: [PATCH] sources: Fix portage snapshot GPG verification

Pass both portage-latest.tar.xz and its detached signature
(.gpgsig) to VerifyFile for proper GPG verification.

Signed-off-by: Chaosoffire <81634128+chaosoffire@users.noreply.github.com>
---
 sources/gentoo.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sources/gentoo.go b/sources/gentoo.go
index 693a9969..03b9cf1d 100644
--- a/sources/gentoo.go
+++ b/sources/gentoo.go
@@ -131,8 +131,8 @@ func (s *gentoo) Run() error {
 		}
 
 		valid, err := s.VerifyFile(
-			filepath.Join(fpath, fname+".gpgsig"),
-			"")
+			filepath.Join(fpath, fname),
+			filepath.Join(fpath, fname+".gpgsig"))
 		if err != nil {
 			return fmt.Errorf("Failed to verify %q: %w", filepath.Join(fpath, fname+".gpgsig"), err)
 		}