Require complete release checksum inventory

tests/run-all.sh

@@ -178,6 +178,51 @@ while read -r expected file; do
     fi
 done < checksums/SHA256SUMS
 
+expected_release_files="$(
+    git ls-files \
+        ocf \
+        postgres-host \
+        quadlet \
+        tests \
+        pacemaker/README.md |
+    while IFS= read -r file; do
+        case "$file" in
+            checksums/SHA256SUMS|quadlet/postgres.env)
+                continue
+                ;;
+        esac
+        printf '%s\n' "$file"
+    done |
+    LC_ALL=C sort
+)"
+
+manifest_release_files="$(
+    awk '{ $1=""; sub(/^[[:space:]]+/, ""); print }' \
+        checksums/SHA256SUMS |
+    LC_ALL=C sort
+)"
+
+if [[ "$manifest_release_files" != "$expected_release_files" ]]; then
+    echo "ERROR: checksum manifest is not a complete release inventory" >&2
+
+    echo >&2
+    echo "--- missing from manifest ---" >&2
+    comm -23 \
+        <(printf '%s\n' "$expected_release_files") \
+        <(printf '%s\n' "$manifest_release_files") \
+        >&2 || true
+
+    echo >&2
+    echo "--- unexpected in manifest ---" >&2
+    comm -13 \
+        <(printf '%s\n' "$expected_release_files") \
+        <(printf '%s\n' "$manifest_release_files") \
+        >&2 || true
+
+    exit 1
+fi
+
+echo "CHECKSUM_MANIFEST_COMPLETE=1"
 echo "CHECKSUM_MANIFEST_OK=1"
 
 echo