Require complete release checksum inventory

checksums/SHA256SUMS

@@ -22,5 +22,5 @@ a42bb59a058ffeb59c1baa96e403856910bbbaea98f9104ff93daf4b5970c780  postgres-host/
 957a5a72ed277d0216e070abb80733483be3d421b9fa488e27fdd75bb2919548  postgres-host/postgres-ha-peer-config.sh
 deb09e3ae40629f43b262ba4f9a7ebf59a1dca3da9d8c94478f670aea28bd0e1  quadlet/postgres.container
 04a125068677bbee6e71d313ca9d95d35faa32851b79de781cd7b9f466561445  quadlet/postgres.env.example
-9d4ddadcea57484bf80e9c21612952a037108aa73781a400df22ae25e7af1b0e  tests/run-all.sh
+93f8b5c4a0c0e390fadeb680848156d198d356086574793032c5d2286c90c86b  tests/run-all.sh
 5e5d4fdd2b6c7e0b8b146de7aad06c1f96b221a10fec525b00d40e0d85709fb0  tests/test-entrypoint-structure.sh

tests/run-all.sh

@@ -178,6 +178,51 @@ while read -r expected file; do
     fi
 done < checksums/SHA256SUMS
 
+expected_release_files="$(
+    git ls-files \
+        ocf \
+        postgres-host \
+        quadlet \
+        tests \
+        pacemaker/README.md |
+    while IFS= read -r file; do
+        case "$file" in
+            checksums/SHA256SUMS|quadlet/postgres.env)
+                continue
+                ;;
+        esac
+        printf '%s\n' "$file"
+    done |
+    LC_ALL=C sort
+)"
+
+manifest_release_files="$(
+    awk '{ $1=""; sub(/^[[:space:]]+/, ""); print }' \
+        checksums/SHA256SUMS |
+    LC_ALL=C sort
+)"
+
+if [[ "$manifest_release_files" != "$expected_release_files" ]]; then
+    echo "ERROR: checksum manifest is not a complete release inventory" >&2
+
+    echo >&2
+    echo "--- missing from manifest ---" >&2
+    comm -23 \
+        <(printf '%s\n' "$expected_release_files") \
+        <(printf '%s\n' "$manifest_release_files") \
+        >&2 || true
+
+    echo >&2
+    echo "--- unexpected in manifest ---" >&2
+    comm -13 \
+        <(printf '%s\n' "$expected_release_files") \
+        <(printf '%s\n' "$manifest_release_files") \
+        >&2 || true
+
+    exit 1
+fi
+
+echo "CHECKSUM_MANIFEST_COMPLETE=1"
 echo "CHECKSUM_MANIFEST_OK=1"
 
 echo