From 36d844cb23d5bfbc01874c71ec625892f2e6de67 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@localhost>
Date: Wed, 12 Aug 2026 05:21:12 +0000
Subject: Validate semantic manifest paths

---
 tests/compare.rs | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

(limited to 'tests')

diff --git a/tests/compare.rs b/tests/compare.rs
index 45522d1..17342c3 100644
--- a/tests/compare.rs
+++ b/tests/compare.rs
@@ -205,6 +205,29 @@ fn rejects_malformed_file_records_before_comparison() {
     assert!(error.to_string().contains("symlink record cannot carry a digest"));
 }
 
+#[test]
+fn rejects_non_portable_manifest_paths_before_comparison() {
+    let error = ArtifactManifest::new(
+        vec![],
+        vec![FileRecord::file("../etc/controller.conf", "digest")],
+        None,
+        vec![],
+        vec![],
+    )
+    .expect_err("parent paths must not enter a semantic manifest");
+    assert!(error.to_string().contains("parent path is not valid"));
+
+    let error = ArtifactManifest::new(
+        vec![],
+        vec![],
+        Some(InitrdRecord::new("/boot/initrd-rt.img", "digest")),
+        vec![],
+        vec![],
+    )
+    .expect_err("absolute initrd paths must not enter a semantic manifest");
+    assert!(error.to_string().contains("absolute path is not valid"));
+}
+
 #[test]
 fn collects_semantic_facts_from_native_rootfs_and_tar_artifact() {
     let fixture = tempdir().expect("temporary directory");
-- 
cgit v1.2.3