From 9e3259b6fd163903c406b250e18782370e63c517 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@localhost>
Date: Wed, 12 Aug 2026 08:16:51 +0000
Subject: Verify initrd digest before native packaging

---
 src/build.rs     |  1 +
 src/initramfs.rs | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+)

(limited to 'src')

diff --git a/src/build.rs b/src/build.rs
index 8b6ebb0..cb6a436 100644
--- a/src/build.rs
+++ b/src/build.rs
@@ -110,6 +110,7 @@ impl<I: PackageInstaller, B: InitramfsBuilder> BuildExecutor<I, B> {
             Err(error) => return Self::fail_and_remove_workspace(workspace, error),
         };
         let result = (|| {
+            initrd.verify_in_rootfs(&rootfs)?;
             std::fs::create_dir_all(parent)
                 .with_context(|| format!("create artifact directory {}", parent.display()))?;
             self.tar_writer.write(&rootfs, artifact)?;
diff --git a/src/initramfs.rs b/src/initramfs.rs
index a108b85..4ece24c 100644
--- a/src/initramfs.rs
+++ b/src/initramfs.rs
@@ -249,4 +249,24 @@ impl InitramfsResult {
     pub fn sha256(&self) -> &str {
         &self.sha256
     }
+
+    /// Ensure the initrd recorded by the platform adapter still exists in the
+    /// assembled rootfs and has not changed before native packaging begins.
+    pub fn verify_in_rootfs(&self, rootfs: &Path) -> Result<()> {
+        let contents = fs::read(rootfs.join(&self.initrd_path)).with_context(|| {
+            format!(
+                "read generated initrd {}",
+                rootfs.join(&self.initrd_path).display()
+            )
+        })?;
+        let digest = format!("{:x}", Sha256::digest(contents));
+        if digest != self.sha256 {
+            bail!(
+                "generated initrd digest changed for {}: expected {}, found {digest}",
+                self.initrd_path.display(),
+                self.sha256
+            );
+        }
+        Ok(())
+    }
 }
-- 
cgit v1.2.3