From db995d26a09b23c87f7a255bcd88662dfedda867 Mon Sep 17 00:00:00 2001
From: Ochenstarik <ochenstarik@inbox.ru>
Date: Sun, 19 Jul 2026 13:25:06 +0700
Subject: [PATCH] Validate bootstrap release payloads

---
 deploy/ochenstarik-server-monitor-manager.sh | 14 ++++++++++++++
 docs/linux-bootstrap.md                      |  2 ++
 tests/bootstrap/test-bootstrap-contract.sh   | 20 ++++++++++++++++++++
 3 files changed, 36 insertions(+)

diff --git a/deploy/ochenstarik-server-monitor-manager.sh b/deploy/ochenstarik-server-monitor-manager.sh
index d27dd4d..3e63eb0 100755
--- a/deploy/ochenstarik-server-monitor-manager.sh
+++ b/deploy/ochenstarik-server-monitor-manager.sh
@@ -33,6 +33,7 @@ Server Monitor Manager Linux bootstrap
 
 Usage:
   ochenstarik-server-monitor-manager.sh preflight
+  ochenstarik-server-monitor-manager.sh verify-release ARCHIVE
   ochenstarik-server-monitor-manager.sh install-control ARCHIVE PUBLIC_HOST [HTTPS_PORT]
   ochenstarik-server-monitor-manager.sh install-agent ARCHIVE NODE_ID CONTROL_URL CA_CERT
   ochenstarik-server-monitor-manager.sh install-node ARCHIVE
@@ -143,6 +144,18 @@ extract_archive() {
     [[ -f "$TEMP_DIR/deploy/$AGENT_UNIT" ]] || fail "Agent systemd unit is missing from archive."
 }
 
+verify_release_payload() {
+    local archive="$1"
+    require_command sha256sum
+    require_command tar
+    extract_archive "$archive"
+    [[ -x "$TEMP_DIR/control/ochenstarik-smm-control" ]] || fail "Control binary is missing."
+    [[ -x "$TEMP_DIR/agent/ochenstarik-smm-agent" ]] || fail "Agent binary is missing."
+    [[ -x "$TEMP_DIR/deploy/ochenstarik-smm-policy-apply" ]] || fail "Policy helper is missing."
+    [[ -x "$TEMP_DIR/bootstrap/ochenstarik-server-monitor-manager.sh" ]] || fail "Packaged bootstrap is missing."
+    log "Release archive and checksum are valid."
+}
+
 ensure_system_user() {
     local user="$1"
     if ! getent group "$user" >/dev/null; then
@@ -558,6 +571,7 @@ main() {
         help|-h|--help) usage ;;
         version|--version) printf '%s %s\n' "$PROGRAM" "$VERSION" ;;
         preflight) preflight ;;
+        verify-release) [[ $# -eq 1 ]] || fail "verify-release requires ARCHIVE"; verify_release_payload "$1" ;;
         install-control) [[ $# -ge 2 && $# -le 3 ]] || fail "install-control requires ARCHIVE PUBLIC_HOST [HTTPS_PORT]"; install_control "$@" ;;
         install-agent) [[ $# -eq 4 ]] || fail "install-agent requires ARCHIVE NODE_ID CONTROL_URL CA_CERT"; install_agent "$@" ;;
         install-node) [[ $# -eq 1 ]] || fail "install-node requires ARCHIVE"; install_node_from_code "$1" ;;
diff --git a/docs/linux-bootstrap.md b/docs/linux-bootstrap.md
index 0bf3d52..8b2c94c 100644
--- a/docs/linux-bootstrap.md
+++ b/docs/linux-bootstrap.md
@@ -25,6 +25,8 @@
 sha256sum -c ochenstarik-server-monitor-manager.sh.sha256
 chmod 700 ochenstarik-server-monitor-manager.sh
 sudo ./ochenstarik-server-monitor-manager.sh preflight
+sudo ./ochenstarik-server-monitor-manager.sh verify-release \
+  ./server-monitor-manager-linux-x64.tar.gz
 sudo ./ochenstarik-server-monitor-manager.sh install-control \
   ./server-monitor-manager-linux-x64.tar.gz \
   hub.example.com \
diff --git a/tests/bootstrap/test-bootstrap-contract.sh b/tests/bootstrap/test-bootstrap-contract.sh
index 42f5ec4..004f7ff 100755
--- a/tests/bootstrap/test-bootstrap-contract.sh
+++ b/tests/bootstrap/test-bootstrap-contract.sh
@@ -14,6 +14,7 @@ grep -Fq "install-agent ARCHIVE NODE_ID CONTROL_URL CA_CERT" <<<"$help_output"
 grep -Fq "install-node ARCHIVE" <<<"$help_output"
 grep -Fq "SMM_ENROLL_TOKEN" <<<"$help_output"
 grep -Fq "node-code NODE_ID" <<<"$help_output"
+grep -Fq "verify-release ARCHIVE" <<<"$help_output"
 grep -Fq "node-token NODE_ID" <<<"$help_output"
 grep -Eq '^ochenstarik-server-monitor-manager [0-9]+\.[0-9]+\.[0-9]+-' <<<"$version_output"
 
@@ -27,4 +28,23 @@ if env -u SUDO_UID -u SUDO_USER bash "$helper" link-connect source target tcp 22
     exit 1
 fi
 
+fixture="$(mktemp -d -t smm-bootstrap-test.XXXXXXXX)"
+trap 'rm -rf -- "$fixture"' EXIT
+mkdir -p "$fixture/payload/agent" "$fixture/payload/control" "$fixture/payload/deploy" "$fixture/payload/bootstrap"
+install -m 0755 /bin/true "$fixture/payload/agent/ochenstarik-smm-agent"
+install -m 0755 /bin/true "$fixture/payload/control/ochenstarik-smm-control"
+install -m 0755 "$helper" "$fixture/payload/deploy/ochenstarik-smm-policy-apply"
+install -m 0644 "$root/deploy/ochenstarik-smm-control.service" "$fixture/payload/deploy/"
+install -m 0644 "$root/deploy/ochenstarik-smm-agent.service" "$fixture/payload/deploy/"
+install -m 0755 "$bootstrap" "$fixture/payload/bootstrap/ochenstarik-server-monitor-manager.sh"
+tar -C "$fixture/payload" -czf "$fixture/release.tar.gz" agent control deploy bootstrap
+sha256sum "$fixture/release.tar.gz" >"$fixture/release.tar.gz.sha256"
+bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null
+
+printf '%064d  %s\n' 0 release.tar.gz >"$fixture/release.tar.gz.sha256"
+if bash "$bootstrap" verify-release "$fixture/release.tar.gz" >/dev/null 2>&1; then
+    printf '%s\n' "corrupt release checksum unexpectedly succeeded" >&2
+    exit 1
+fi
+
 printf '%s\n' "BOOTSTRAP_CONTRACT=PASS"