From f91f5ff929fbd226cfec256aee6f0ba0d492339f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vin=C3=ADcius=20Ferr=C3=A3o?=
 <2031761+viniciusferrao@users.noreply.github.com>
Date: Sat, 22 Aug 2026 19:27:24 -0300
Subject: [PATCH] fix(genesis): share copied package verification

---
 build-apt-repo.sh                   | 14 ++++-------
 genesis-openembedded/verify-release | 37 ++++++++++++++++++++++++++---
 lib/XCAT/GenesisRelease.pm          | 10 ++++----
 3 files changed, 44 insertions(+), 17 deletions(-)

diff --git a/build-apt-repo.sh b/build-apt-repo.sh
index 55ef407..83fc300 100755
--- a/build-apt-repo.sh
+++ b/build-apt-repo.sh
@@ -123,8 +123,6 @@ command -v cmp >/dev/null 2>&1 \
 if [[ -n "$GENESIS_RELEASE" ]]; then
     command -v dpkg-deb >/dev/null 2>&1 \
         || die "dpkg-deb not found. Install: sudo apt-get install dpkg"
-    command -v sha256sum >/dev/null 2>&1 \
-        || die "sha256sum not found. Install: sudo apt-get install coreutils"
     GENESIS_CHECKSUMS=$(mktemp "${TMPDIR:-/tmp}/xcat-genesis-checksums.XXXXXX")
     cp -- "$GENESIS_RELEASE/SHA256SUMS" "$GENESIS_CHECKSUMS"
     "$GENESIS_VERIFIER" --complete --format deb "$GENESIS_RELEASE"
@@ -193,17 +191,15 @@ copy_deb() {
 copy_genesis_deb() {
     local source="$1"
     local directory="$2"
-    local name destination relative expected actual
+    local name destination relative
     name=$(basename "$source")
     destination="$directory/$name"
     relative="deb/$name"
     cp -- "$source" "$destination"
-    expected=$(awk -v path="$relative" '$2 == path { print $1 }' "$GENESIS_CHECKSUMS")
-    [[ -n "$expected" ]] || die "Missing verified checksum for $relative"
-    actual=$(sha256sum "$destination")
-    actual=${actual%% *}
-    [[ "$actual" = "$expected" ]] \
-        || die "Collected Genesis package checksum mismatch: $destination"
+    "$GENESIS_VERIFIER" \
+        --checksum-file "$GENESIS_CHECKSUMS" \
+        --relative-file "$relative" \
+        --copied-file "$destination"
 }
 
 for ver in "${SELECTED_VERS[@]}"; do
diff --git a/genesis-openembedded/verify-release b/genesis-openembedded/verify-release
index da7563a..d91e45d 100755
--- a/genesis-openembedded/verify-release
+++ b/genesis-openembedded/verify-release
@@ -10,17 +10,44 @@ use lib "$FindBin::Bin/../lib";
 use XCAT::BuildUtils qw(capture_command require_command);
 use XCAT::GenesisRelease qw(
   deb_package_name
+  read_checksum_manifest
   rpm_package_name
   validate_complete_release
   validate_release
+  verify_release_file
 );
 
 my $format = 'all';
 my $complete = 0;
+my ($checksum_file, $relative_file, $copied_file);
 GetOptions(
-    'format=s' => \$format,
-    'complete!' => \$complete,
+    'format=s'        => \$format,
+    'complete!'       => \$complete,
+    'checksum-file=s' => \$checksum_file,
+    'relative-file=s' => \$relative_file,
+    'copied-file=s'   => \$copied_file,
 ) or die usage();
+
+my $copy_mode = grep { defined($_) }
+  ($checksum_file, $relative_file, $copied_file);
+if ($copy_mode) {
+    die usage()
+      unless defined($checksum_file)
+      && defined($relative_file)
+      && defined($copied_file)
+      && !$complete
+      && $format eq 'all'
+      && !@ARGV;
+    $checksum_file = abs_path($checksum_file)
+      or die "Cannot resolve checksum file\n";
+    $copied_file = abs_path($copied_file)
+      or die "Cannot resolve copied file\n";
+    my $checksums = read_checksum_manifest($checksum_file);
+    verify_release_file($checksums, $relative_file, $copied_file);
+    print "Verified copied Genesis package: $copied_file\n";
+    exit(0);
+}
+
 die usage() unless @ARGV == 1;
 die "Unsupported verification format: $format\n"
   unless $format eq 'all' || $format eq 'rpm' || $format eq 'deb';
@@ -103,5 +130,9 @@ sub _verify_deb {
 }
 
 sub usage {
-    return "Usage: verify-release [--format all|rpm|deb] [--complete] RELEASE_DIRECTORY\n";
+    return <<'USAGE';
+Usage: verify-release [--format all|rpm|deb] [--complete] RELEASE_DIRECTORY
+       verify-release --checksum-file SHA256SUMS --relative-file PATH
+                      --copied-file FILE
+USAGE
 }
diff --git a/lib/XCAT/GenesisRelease.pm b/lib/XCAT/GenesisRelease.pm
index 0bcc9ae..2dbeaa3 100644
--- a/lib/XCAT/GenesisRelease.pm
+++ b/lib/XCAT/GenesisRelease.pm
@@ -9,6 +9,7 @@ use XCAT::BuildUtils qw(digest_file read_lines relative_files);
 our @EXPORT_OK = qw(
   architectures
   deb_package_name
+  read_checksum_manifest
   read_release_manifest
   rpm_package_name
   validated_release_checksums
@@ -60,9 +61,8 @@ sub _read_key_values {
     return \%values;
 }
 
-sub _read_checksums {
-    my ($root) = @_;
-    my $path = "$root/SHA256SUMS";
+sub read_checksum_manifest {
+    my ($path) = @_;
     my %checksums;
     for my $line (read_lines($path)) {
         die "Invalid checksum entry in $path: $line\n"
@@ -80,7 +80,7 @@ sub _read_checksums {
 sub _verify_checksums {
     my ($root) = @_;
     my @files = grep { $_ ne 'SHA256SUMS' } relative_files($root);
-    my $checksums = _read_checksums($root);
+    my $checksums = read_checksum_manifest("$root/SHA256SUMS");
 
     my %files = map { $_ => 1 } @files;
     for my $name (@files) {
@@ -224,7 +224,7 @@ sub validate_complete_release {
 sub validated_release_checksums {
     my ($directory) = @_;
     validate_release($directory);
-    return _read_checksums($directory);
+    return read_checksum_manifest("$directory/SHA256SUMS");
 }
 
 sub verify_release_file {