From 7763a03efdffd76a65218a71cc0dbefbebea2f5a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Sat, 22 Aug 2026 01:25:58 -0300
Subject: [PATCH] test(genesis): reject changed release packages

---
 t/genesis_openembedded_release.t | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/t/genesis_openembedded_release.t b/t/genesis_openembedded_release.t
index 3d531f5..44aeb3c 100644
--- a/t/genesis_openembedded_release.t
+++ b/t/genesis_openembedded_release.t
@@ -2,6 +2,7 @@ use strict;
 use warnings;
 
 use Cwd qw(abs_path);
+use File::Copy qw(copy);
 use File::Path qw(make_path);
 use File::Temp qw(tempdir);
 use FindBin;
@@ -13,10 +14,12 @@ use XCAT::GenesisRelease qw(
   architectures
   deb_package_name
   rpm_package_name
+  validated_release_checksums
   validate_architecture
   validate_complete_release
   validate_export
   validate_release
+  verify_release_file
 );
 use XCAT::GenesisReleaseTest qw(
   command_exists
@@ -101,6 +104,18 @@ write_release_manifest(
 write_checksums($release_dir);
 my $manifest = validate_release($release_dir);
 is($manifest->{xcat_revision}, $revision, 'release records xcat-core revision');
+my $verified_checksums = validated_release_checksums($release_dir);
+my $verified_relative = "rpm/xCAT-genesis-base-x86_64-$version-$release.noarch.rpm";
+my $verified_copy = "$tmp/verified-copy.rpm";
+copy("$release_dir/$verified_relative", $verified_copy) or die $!;
+ok(verify_release_file($verified_checksums, $verified_relative, $verified_copy),
+    'collected package matches the verified release');
+write_file($verified_copy, 'changed after verification');
+dies_like(
+    sub { verify_release_file($verified_checksums, $verified_relative, $verified_copy) },
+    qr/Collected release file checksum mismatch/,
+    'release changes after verification are rejected',
+);
 dies_like(
     sub { validate_complete_release($release_dir) },
     qr/Genesis release is missing supported architectures/,