fix: add SHA1 checksums to data tar for apk-tools 3.0 compatibility

Alpine apk-tools 3.0 requires embedded SHA1 checksums in PAX headers.
Use abuild-tar --hash to generate these checksums, which is compatible
with both apk-tools v2 (warning) and v3 (required).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: bordeux

scripts/generate_repo.py

@@ -532,13 +532,14 @@ def build_apk_from_binary(
                 f"builddate = {builddate}",
             ]
 
-            # Create data tar using abuild-tar --cut to remove EOF markers (Alpine APK format)
+            # Create data tar using abuild-tar --hash --cut for proper APK format
             data_tar_gz = tmpdir / "data.tar.gz"
 
-            # Use tar + abuild-tar --cut + gzip pipeline for proper APK format
-            # abuild-tar --cut removes the end-of-archive zero blocks that standard tar adds
-            # Use 'usr' instead of '.' to avoid ./usr paths - Alpine expects 'usr/bin/...' not './usr/bin/...'
-            tar_cmd = f"tar -C {data_dir} -cf - usr | abuild-tar --cut | gzip -n -9 > {data_tar_gz}"
+            # Use tar + abuild-tar --hash --cut + gzip pipeline
+            # --hash: Adds SHA1 checksums as PAX headers (required for apk-tools 3.0)
+            # --cut: Removes the end-of-archive zero blocks
+            # Use 'usr' instead of '.' to avoid ./usr paths
+            tar_cmd = f"tar -C {data_dir} -cf - usr | abuild-tar --hash --cut | gzip -n -9 > {data_tar_gz}"
             subprocess.run(tar_cmd, shell=True, timeout=120, check=True)
 
             # Calculate datahash