From 990da710c1e332189c825eb3db0b176f058d8a5b Mon Sep 17 00:00:00 2001
From: jensmohr <lha643@jensmohr.de>
Date: Mon, 8 Jun 2026 21:17:21 +0200
Subject: [PATCH] Link GVL snapshots to raw evidence records

---
 src/background.js             |  9 +++++++--
 src/background/gvl-service.js | 11 +++++++++--
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/src/background.js b/src/background.js
index 1b90a19..6ab280f 100644
--- a/src/background.js
+++ b/src/background.js
@@ -619,7 +619,8 @@ function isGvlImportCandidate(value) {
 
 async function handleFetchOfficialGvlMessage() {
   try {
-    const { rawJson, responseStatus } = await fetchOfficialGvlJson();
+    const { rawJson, rawGvlSha256, responseStatus } =
+      await fetchOfficialGvlJson();
 
     if (!isGvlImportCandidate(rawJson)) {
       return {
@@ -633,6 +634,7 @@ async function handleFetchOfficialGvlMessage() {
     const result = await VendorGetGvlService.ingestGvlSnapshot(db, rawJson, {
       sourceUrl: OFFICIAL_IAB_GVL_URL,
       fetchedAt: new Date().toISOString(),
+      rawGvlSha256: rawGvlSha256,
       diagnostics: {
         ingestionSource: "official_iab_fetch",
         responseStatus: responseStatus
@@ -689,6 +691,7 @@ async function fetchOfficialGvlJson() {
 
   return {
     rawJson: JSON.parse(rawBody),
+    rawGvlSha256: rawGvlSha256,
     responseStatus: response.status
   };
 }
@@ -773,7 +776,8 @@ async function runStartupGvlAutoUpdateCheck() {
       result: "started"
     });
 
-    const { rawJson, responseStatus } = await fetchOfficialGvlJson();
+    const { rawJson, rawGvlSha256, responseStatus } =
+      await fetchOfficialGvlJson();
 
     if (!isGvlImportCandidate(rawJson)) {
       throw new Error("invalid_gvl_json");
@@ -793,6 +797,7 @@ async function runStartupGvlAutoUpdateCheck() {
       {
         sourceUrl: OFFICIAL_IAB_GVL_URL,
         fetchedAt: new Date().toISOString(),
+        rawGvlSha256: rawGvlSha256,
         diagnostics: {
           ingestionSource: "official_iab_auto_update",
           responseStatus: responseStatus,
diff --git a/src/background/gvl-service.js b/src/background/gvl-service.js
index 916626c..be795ad 100644
--- a/src/background/gvl-service.js
+++ b/src/background/gvl-service.js
@@ -50,11 +50,17 @@ function storeGvlRawEvidenceIfNew(db, rawEvidence) {
   });
 }
 
-async function buildGvlSnapshotRecord(rawJson, sourceUrl, fetchedAt) {
+async function buildGvlSnapshotRecord(
+  rawJson,
+  sourceUrl,
+  fetchedAt,
+  rawGvlSha256
+) {
   const gvlJson = normalizeGvlSnapshotValueForMetadata(rawJson);
 
   return {
     sha256: await calculateGvlSnapshotSha256(rawJson),
+    rawGvlSha256: rawGvlSha256 ?? null,
     vendorListVersion: gvlJson?.vendorListVersion ?? null,
     gvlSpecificationVersion: gvlJson?.gvlSpecificationVersion ?? null,
     tcfPolicyVersion: gvlJson?.tcfPolicyVersion ?? null,
@@ -129,7 +135,8 @@ async function ingestGvlSnapshot(db, rawJson, options = {}) {
   const snapshot = await buildGvlSnapshotRecord(
     rawJson,
     options.sourceUrl ?? null,
-    options.fetchedAt ?? null
+    options.fetchedAt ?? null,
+    options.rawGvlSha256 ?? null
   );
   const storeResult = await storeGvlSnapshotIfNew(db, snapshot);
   const alreadyKnown = !storeResult.stored;