fetchpatch: Allow using base64-encoded hash

Nix now returns base64-encoded SRI hashes on hash mismatch. Usually,
people copy the returned hashes in TOFU fashion but since base64-encoded
strings can contain slashes, they often broke our use of them for temporary file name.

Escaping them should prevent the failures.

pkgs/build-support/fetchpatch/default.nix

@@ -11,9 +11,13 @@ let
 in
 { stripLen ? 0, extraPrefix ? null, excludes ? [], includes ? [], revert ? false, ... }@args:
 
+let
+  # Make base-64 encoded SRI hash filename-safe using RFC 4648 §5
+  tmpname = lib.replaceStrings [ "+" "/" "=" ] [ "-" "_" "" ] args.sha256;
+in
 fetchurl ({
   postFetch = ''
-    tmpfile="$TMPDIR/${args.sha256}"
+    tmpfile="$TMPDIR/${tmpname}"
     if [ ! -s "$out" ]; then
       echo "error: Fetched patch file '$out' is empty!" 1>&2
       exit 1