diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/build.rs | 1 | ||||
| -rw-r--r-- | src/initramfs.rs | 20 |
2 files changed, 21 insertions, 0 deletions
diff --git a/src/build.rs b/src/build.rs index 8b6ebb0..cb6a436 100644 --- a/src/build.rs +++ b/src/build.rs @@ -110,6 +110,7 @@ impl<I: PackageInstaller, B: InitramfsBuilder> BuildExecutor<I, B> { Err(error) => return Self::fail_and_remove_workspace(workspace, error), }; let result = (|| { + initrd.verify_in_rootfs(&rootfs)?; std::fs::create_dir_all(parent) .with_context(|| format!("create artifact directory {}", parent.display()))?; self.tar_writer.write(&rootfs, artifact)?; diff --git a/src/initramfs.rs b/src/initramfs.rs index a108b85..4ece24c 100644 --- a/src/initramfs.rs +++ b/src/initramfs.rs @@ -249,4 +249,24 @@ impl InitramfsResult { pub fn sha256(&self) -> &str { &self.sha256 } + + /// Ensure the initrd recorded by the platform adapter still exists in the + /// assembled rootfs and has not changed before native packaging begins. + pub fn verify_in_rootfs(&self, rootfs: &Path) -> Result<()> { + let contents = fs::read(rootfs.join(&self.initrd_path)).with_context(|| { + format!( + "read generated initrd {}", + rootfs.join(&self.initrd_path).display() + ) + })?; + let digest = format!("{:x}", Sha256::digest(contents)); + if digest != self.sha256 { + bail!( + "generated initrd digest changed for {}: expected {}, found {digest}", + self.initrd_path.display(), + self.sha256 + ); + } + Ok(()) + } } |