From ec74c27faad3e65782ae5bb51a8e8e5b629f42ec Mon Sep 17 00:00:00 2001 From: Hermes Agent Date: Wed, 12 Aug 2026 06:49:50 +0000 Subject: Create protected boot aliases after initramfs build --- tests/initramfs.rs | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) (limited to 'tests/initramfs.rs') diff --git a/tests/initramfs.rs b/tests/initramfs.rs index f5a7b02..429411a 100644 --- a/tests/initramfs.rs +++ b/tests/initramfs.rs @@ -83,6 +83,31 @@ fn make_initrd_adapter_uses_typed_chroot_arguments_and_records_output_digest() { result.sha256(), "aec42bc86f526931d7c7f01ecba8d643dbb748f9102539a99db5d4855ee4435f" ); + assert_eq!( + fs::read_link(rootfs.path().join("boot/vmlinuz")).expect("kernel boot symlink"), + Path::new("vmlinuz-6.12-rt1") + ); + assert_eq!( + fs::read_link(rootfs.path().join("boot/initrd.img")).expect("initrd boot symlink"), + Path::new("initrd-6.12-rt1.img") + ); +} + +#[test] +fn initramfs_adapter_refuses_to_replace_a_non_symlink_boot_alias() { + let rootfs = tempdir().expect("rootfs directory"); + let boot = rootfs.path().join("boot"); + fs::create_dir(&boot).expect("boot directory"); + fs::write(boot.join("vmlinuz-6.12-rt1"), "kernel").expect("RT kernel"); + fs::write(boot.join("initrd-6.12-rt1.img"), b"generated initrd").expect("generated initrd"); + fs::write(boot.join("initrd.img"), "do not replace").expect("protected boot alias"); + let request = InitramfsRequest::discover(rootfs.path()).expect("initramfs request"); + let mut builder = MakeInitrdBuilder::new(RecordingRunner::default()); + + let error = builder.build(&request).expect_err("regular boot alias must be protected"); + + assert!(error.to_string().contains("refusing to replace non-symlink boot alias")); + assert_eq!(fs::read_to_string(boot.join("initrd.img")).expect("protected alias"), "do not replace"); } #[derive(Debug, Default)] -- cgit v1.2.3