Create protected boot aliases after initramfs build

1 files changed, 25 insertions, 0 deletions

diff --git a/tests/initramfs.rs b/tests/initramfs.rs
index f5a7b02..429411a 100644
--- a/tests/initramfs.rs
+++ b/tests/initramfs.rs
@@ -83,6 +83,31 @@ fn make_initrd_adapter_uses_typed_chroot_arguments_and_records_output_digest() {
         result.sha256(),
         "aec42bc86f526931d7c7f01ecba8d643dbb748f9102539a99db5d4855ee4435f"
     );
+    assert_eq!(
+        fs::read_link(rootfs.path().join("boot/vmlinuz")).expect("kernel boot symlink"),
+        Path::new("vmlinuz-6.12-rt1")
+    );
+    assert_eq!(
+        fs::read_link(rootfs.path().join("boot/initrd.img")).expect("initrd boot symlink"),
+        Path::new("initrd-6.12-rt1.img")
+    );
+}
+
+#[test]
+fn initramfs_adapter_refuses_to_replace_a_non_symlink_boot_alias() {
+    let rootfs = tempdir().expect("rootfs directory");
+    let boot = rootfs.path().join("boot");
+    fs::create_dir(&boot).expect("boot directory");
+    fs::write(boot.join("vmlinuz-6.12-rt1"), "kernel").expect("RT kernel");
+    fs::write(boot.join("initrd-6.12-rt1.img"), b"generated initrd").expect("generated initrd");
+    fs::write(boot.join("initrd.img"), "do not replace").expect("protected boot alias");
+    let request = InitramfsRequest::discover(rootfs.path()).expect("initramfs request");
+    let mut builder = MakeInitrdBuilder::new(RecordingRunner::default());
+
+    let error = builder.build(&request).expect_err("regular boot alias must be protected");
+
+    assert!(error.to_string().contains("refusing to replace non-symlink boot alias"));
+    assert_eq!(fs::read_to_string(boot.join("initrd.img")).expect("protected alias"), "do not replace");
 }
 
 #[derive(Debug, Default)]