From 2226b1c1ab204aede1eb19a19988641e57e10798 Mon Sep 17 00:00:00 2001
From: Lyncoln <arcticfoxx_dlf@hotmail.com>
Date: Thu, 17 Sep 2026 11:15:19 -0400
Subject: [PATCH] Validate tracked release checksum manifest

---
 checksums/SHA256SUMS |  9 +--------
 tests/run-all.sh     | 38 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 8 deletions(-)

diff --git a/checksums/SHA256SUMS b/checksums/SHA256SUMS
index a06ab9a..21106fc 100644
--- a/checksums/SHA256SUMS
+++ b/checksums/SHA256SUMS
@@ -7,27 +7,20 @@
 957a5a72ed277d0216e070abb80733483be3d421b9fa488e27fdd75bb2919548  ocf/loxthelion/managed-container.d/applications/postgresql/peer_config.sh
 5091bc554915d1450fe939f94c0b0a370fecdb2ae5db9c4f0f55c340c0145519  ocf/loxthelion/managed-container.d/applications/postgresql/plugin.sh
 c1d878dabf22ad3928d66a5542bda3c150e5e9b039926629e7c5fd3401d29be4  ocf/loxthelion/managed-container.d/applications/postgresql/postgres.sh
-3a6c92e8fe7d0df2573b19be22dd707b89b1eaa8147bdc07ef84dcded51aaa31  ocf/loxthelion/managed-container.d/applications/postgresql/postgres.sh.pre-score-rejoin-reconcile-20260917-103742
-d7547d66e4960a6aadfdd5cb1270431009453c8b769d0fa21f0b06d7fe7df686  ocf/loxthelion/managed-container.d/applications/postgresql/postgres.sh.pre-streaming-rejoin-marker-fix-20260917-103610
 f482853a0c7992981e59b4ad78d1ee69851d5d60fdec1f695673228017dd8244  ocf/loxthelion/managed-container.d/applications/postgresql/promote.sh
 5166fc3370f49ab14cd975ded4b03a74b9bd7dbff5762b41a15552c42f934ea7  ocf/loxthelion/managed-container.d/applications/postgresql/promotion_state.py
 b0ebad749ed736f08ec748a693f12e8dc2541430e0d3db75bbb6b2b7e517f84b  ocf/loxthelion/managed-container.d/applications/postgresql/rejoin.sh
 0d3017fdca92b2dc5dba406065bc269622ce5140e3fce4a959ca95ce4a78e755  ocf/loxthelion/managed-container.d/applications/postgresql/replication.sh
 d7d2fd7ab651d1f2f026bdb11d62e2c0c6ce6ee3128c9814d09550cf4304b3f2  ocf/loxthelion/managed-container.d/common.sh
-2c897c3a21d924a1a865494cb5c76a3405e2de7fee55e41ccd7bee2511726927  ocf/loxthelion/managed-container.d/common.sh.pre-named-proxy-rc-20260917-100736
 3a27ac9c63c61310da8b8711fa2c4400b37ea8eae2ee2a79e28bc63180b06c7c  ocf/loxthelion/managed-container.d/container.sh
 70431e0d390a3612339c7b5887286c1be4d6b305cbe8898e7895a211c26b6087  ocf/loxthelion/managed-container.d/engine.sh
 6c92c095ce10ac95d843fdc1c49e31c19491ca22fdac960affd8649606d76d82  ocf/loxthelion/managed-container.d/lifecycles/systemd.sh
 259e8cafa5b6d3fb54896ab37ff3917942c62c51eaa6e9bfa8ccf3afc6a7327b  ocf/loxthelion/managed-container.d/proxy.sh
-d5ca2aceddd5c8c5467e0997b099118279b9f54b96b8275e3a33182e1b992093  ocf/loxthelion/managed-container.d/proxy.sh.pre-named-proxy-rc-20260917-100736
 f82e2571d309bce8e4d7e6aee6b61b68feb7d99dc85bb8b688b6123c13ccf6a7  ocf/loxthelion/managed-container.d/runtimes/podman.sh
-8679baffebc77614fd80888d344ca55e11a13f84de6f096a2399c22a49c8cc6a  ocf/loxthelion/managed-container.pre-entrypoint-selftest-20260917-105341
-01eb9b161c8e3db289f09bf63953be779921e15bdf8b1a4d8ce7e60032b826e4  ocf/loxthelion/managed-container.pre-named-proxy-rc-20260917-100736
-62ec256e108f40f91d626ea71e8945862aedb347e576a00e6bd1e15f9f363e70  ocf/loxthelion/managed-container.pre-proxy-load-fix-20260917-101231
 4a99efea3d4a185e0630db89cfacc28aa8777bad9c747794ae69f70d87cd0327  pacemaker/README.md
 a42bb59a058ffeb59c1baa96e403856910bbbaea98f9104ff93daf4b5970c780  postgres-host/postgres-ha-bootstrap
 957a5a72ed277d0216e070abb80733483be3d421b9fa488e27fdd75bb2919548  postgres-host/postgres-ha-peer-config.sh
 deb09e3ae40629f43b262ba4f9a7ebf59a1dca3da9d8c94478f670aea28bd0e1  quadlet/postgres.container
 04a125068677bbee6e71d313ca9d95d35faa32851b79de781cd7b9f466561445  quadlet/postgres.env.example
-761e4d5166e26507f34b3276258bd012ddbd7c667020a9797542e08b8976891a  tests/run-all.sh
+9d4ddadcea57484bf80e9c21612952a037108aa73781a400df22ae25e7af1b0e  tests/run-all.sh
 5e5d4fdd2b6c7e0b8b146de7aad06c1f96b221a10fec525b00d40e0d85709fb0  tests/test-entrypoint-structure.sh
diff --git a/tests/run-all.sh b/tests/run-all.sh
index d77a363..87770e0 100755
--- a/tests/run-all.sh
+++ b/tests/run-all.sh
@@ -142,5 +142,43 @@ if errors:
 print("SECRET_GUARD_OK=1")
 PY_SECRET_GUARD
 
+echo
+echo ">>> Checksum manifest"
+
+if [[ ! -f checksums/SHA256SUMS ]]; then
+    echo "ERROR: checksums/SHA256SUMS is missing" >&2
+    exit 1
+fi
+
+if grep -Eq '\.pre-|\.new($|[[:space:]])' checksums/SHA256SUMS; then
+    echo "ERROR: checksum manifest contains development artifacts" >&2
+    exit 1
+fi
+
+while read -r expected file; do
+    [[ -n "${expected:-}" && -n "${file:-}" ]] || continue
+
+    if [[ ! -f "$file" ]]; then
+        echo "ERROR: checksum target is missing: $file" >&2
+        exit 1
+    fi
+
+    actual="$(sha256sum "$file" | awk '{print $1}')"
+
+    if [[ "$actual" != "$expected" ]]; then
+        echo "ERROR: checksum mismatch: $file" >&2
+        echo "  expected=$expected" >&2
+        echo "  actual=$actual" >&2
+        exit 1
+    fi
+
+    if ! git ls-files --error-unmatch "$file" >/dev/null 2>&1; then
+        echo "ERROR: checksum manifest references untracked file: $file" >&2
+        exit 1
+    fi
+done < checksums/SHA256SUMS
+
+echo "CHECKSUM_MANIFEST_OK=1"
+
 echo
 echo "ALL_TESTS_PASS=1"