Validate initrd manifest digests

2 files changed, 24 insertions, 0 deletions

diff --git a/src/manifest.rs b/src/manifest.rs
index a68245b..0848a98 100644
--- a/src/manifest.rs
+++ b/src/manifest.rs
@@ -32,6 +32,7 @@ impl ArtifactManifest {
         services.sort_by(|left, right| left.name.cmp(&right.name));
         archive_members.sort_by(|left, right| left.path.cmp(&right.path));
         validate_file_records(&files)?;
+        validate_initrd_record(initrd.as_ref())?;
         validate_manifest_paths(&files, initrd.as_ref(), &archive_members)?;
         ensure_unique("package", packages.iter().map(|record| record.name.as_str()))?;
         ensure_unique("file", files.iter().map(|record| record.path.as_str()))?;
@@ -371,6 +372,15 @@ fn validate_manifest_paths(
     Ok(())
 }
 
+fn validate_initrd_record(record: Option<&InitrdRecord>) -> Result<()> {
+    if let Some(record) = record {
+        if record.sha256.is_empty() {
+            bail!("initrd record requires a sha256 digest: {}", record.path);
+        }
+    }
+    Ok(())
+}
+
 fn validate_file_records(records: &[FileRecord]) -> Result<()> {
     for record in records {
         match record.kind.as_str() {
diff --git a/tests/compare.rs b/tests/compare.rs
index 17342c3..f7b3a04 100644
--- a/tests/compare.rs
+++ b/tests/compare.rs
@@ -206,6 +206,20 @@ fn rejects_malformed_file_records_before_comparison() {
 }
 
 #[test]
+fn rejects_malformed_initrd_records_before_comparison() {
+    let error = ArtifactManifest::new(
+        vec![],
+        vec![],
+        Some(InitrdRecord::new("boot/initrd-rt.img", "")),
+        vec![],
+        vec![],
+    )
+    .expect_err("initrd records require a digest");
+
+    assert!(error.to_string().contains("initrd record requires a sha256 digest"));
+}
+
+#[test]
 fn rejects_non_portable_manifest_paths_before_comparison() {
     let error = ArtifactManifest::new(
         vec![],