From 9e3259b6fd163903c406b250e18782370e63c517 Mon Sep 17 00:00:00 2001
From: Hermes Agent <hermes@localhost>
Date: Wed, 12 Aug 2026 08:16:51 +0000
Subject: Verify initrd digest before native packaging

---
 tests/build.rs | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

(limited to 'tests')

diff --git a/tests/build.rs b/tests/build.rs
index 2fcd1bf..c9cc59f 100644
--- a/tests/build.rs
+++ b/tests/build.rs
@@ -73,6 +73,20 @@ impl PackageInstaller for ArchiveFailingInstaller {
     }
 }
 
+struct MutatingInitrdBuilder;
+
+impl InitramfsBuilder for MutatingInitrdBuilder {
+    fn build(&mut self, request: &InitramfsRequest) -> anyhow::Result<InitramfsResult> {
+        let initrd = request
+            .rootfs()
+            .join(format!("boot/initrd-{}.img", request.kernel().as_str()));
+        fs::write(&initrd, "primary initrd")?;
+        let result = InitramfsResult::from_rootfs(request.rootfs(), request.kernel())?;
+        fs::write(initrd, "mutated initrd")?;
+        Ok(result)
+    }
+}
+
 #[derive(Default)]
 struct FixtureInitramfsBuilder;
 
@@ -355,3 +369,38 @@ fn removes_the_new_workspace_and_partial_artifact_when_packaging_fails() {
         "failed packaging must not leave a companion manifest"
     );
 }
+
+#[test]
+fn removes_the_new_workspace_and_artifact_when_manifest_collection_fails() {
+    let fixture = tempdir().expect("fixture directory");
+    let spec = ImageSpec::load(std::path::Path::new("profiles/alt-controller.toml"))
+        .expect("load controller spec");
+    let plan = BuildPlan::compile(spec).expect("compile build plan");
+    let mut executor = BuildExecutor::new(FixtureInstaller::default(), MutatingInitrdBuilder);
+    let workspace = fixture.path().join("work");
+    let artifact = fixture.path().join("out/image.tar");
+
+    let error = executor
+        .execute(&plan, &workspace, "profiles/apt.conf", &artifact)
+        .expect_err("mutated initrd must fail before packaging");
+
+    assert!(
+        error
+            .to_string()
+            .contains("generated initrd digest changed")
+    );
+    assert!(
+        !workspace.exists(),
+        "failed build must not leave a workspace"
+    );
+    assert!(
+        !artifact.exists(),
+        "failed manifest collection must not leave an artifact"
+    );
+    assert!(
+        !ArtifactManifest::path_beside(&artifact)
+            .expect("manifest path")
+            .exists(),
+        "failed manifest collection must not leave a companion manifest"
+    );
+}
-- 
cgit v1.2.3