From 35af190cac33650b90e8056b890b8c2c03dca7e7 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@localhost>
Date: Wed, 12 Aug 2026 05:53:50 +0000
Subject: Validate initrd manifest digests

---
 src/manifest.rs  | 10 ++++++++++
 tests/compare.rs | 14 ++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/src/manifest.rs b/src/manifest.rs
index a68245b..0848a98 100644
--- a/src/manifest.rs
+++ b/src/manifest.rs
@@ -32,6 +32,7 @@ impl ArtifactManifest {
         services.sort_by(|left, right| left.name.cmp(&right.name));
         archive_members.sort_by(|left, right| left.path.cmp(&right.path));
         validate_file_records(&files)?;
+        validate_initrd_record(initrd.as_ref())?;
         validate_manifest_paths(&files, initrd.as_ref(), &archive_members)?;
         ensure_unique("package", packages.iter().map(|record| record.name.as_str()))?;
         ensure_unique("file", files.iter().map(|record| record.path.as_str()))?;
@@ -371,6 +372,15 @@ fn validate_manifest_paths(
     Ok(())
 }
 
+fn validate_initrd_record(record: Option<&InitrdRecord>) -> Result<()> {
+    if let Some(record) = record {
+        if record.sha256.is_empty() {
+            bail!("initrd record requires a sha256 digest: {}", record.path);
+        }
+    }
+    Ok(())
+}
+
 fn validate_file_records(records: &[FileRecord]) -> Result<()> {
     for record in records {
         match record.kind.as_str() {
diff --git a/tests/compare.rs b/tests/compare.rs
index 17342c3..f7b3a04 100644
--- a/tests/compare.rs
+++ b/tests/compare.rs
@@ -205,6 +205,20 @@ fn rejects_malformed_file_records_before_comparison() {
     assert!(error.to_string().contains("symlink record cannot carry a digest"));
 }
 
+#[test]
+fn rejects_malformed_initrd_records_before_comparison() {
+    let error = ArtifactManifest::new(
+        vec![],
+        vec![],
+        Some(InitrdRecord::new("boot/initrd-rt.img", "")),
+        vec![],
+        vec![],
+    )
+    .expect_err("initrd records require a digest");
+
+    assert!(error.to_string().contains("initrd record requires a sha256 digest"));
+}
+
 #[test]
 fn rejects_non_portable_manifest_paths_before_comparison() {
     let error = ArtifactManifest::new(
-- 
cgit v1.2.3