From 7b9dcaeff7ca0eaaea59c34533fa5f15e3bdb3fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Mon, 24 Aug 2026 13:45:23 -0300
Subject: [PATCH] test(genesis): pin the pooled Genesis DEB as an independent
 file

The pooled package carries the release bytes, which the existing digest check
covers, but it must not be the release file itself; assert the identity is
distinct so a link cannot come back unnoticed.
---
 t/genesis_openembedded_consumer.t | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/t/genesis_openembedded_consumer.t b/t/genesis_openembedded_consumer.t
index 4881013..db34048 100644
--- a/t/genesis_openembedded_consumer.t
+++ b/t/genesis_openembedded_consumer.t
@@ -198,6 +198,12 @@ sub test_deb_consumer {
         'legacy Genesis DEB remains available');
     ok(!-e "$apt_root/pool/main/noble/xcat-genesis-openembedded-stale.deb",
         'stale OpenEmbedded DEB is not collected');
+    # The published package must be a file of its own: sharing an inode with the release
+    # would make a later write through either path change what the other one holds.
+    my @pooled = stat($pool_package);
+    my @released = stat("$release_root/deb/$package");
+    isnt("$pooled[0]:$pooled[1]", "$released[0]:$released[1]",
+        'pooled DEB is published independently of the release file');
 
     my $collision = "$tmp/apt-collision";
     make_path("$collision/ubuntu24.04");