Add manifest generation and checksum verification for Debian base tarballs.

Signed-off-by: Richard Qin <richard.qin.x@gmail.com>

5 files changed, 87 insertions, 1 deletions

diff --git a/debian-container/README b/debian-container/README
index 25734f0..c0ef344 100644
--- a/debian-container/README
+++ b/debian-container/README
@@ -13,6 +13,14 @@ sudo ./debian-container.sh base-create \
   --arch amd64 \
   --include sudo,vim-tiny,curl
 
+默认同时生成：
+
+debian-stable.tar.gz.manifest
+
+查看基础 tarball 信息：
+
+sudo ./debian-container.sh base-info ./debian-stable.tar.gz
+
 从 tarball 创建容器：
 
 sudo ./debian-container.sh init test-1 --tarball ./debian-stable.tar.gz
diff --git a/debian-container/debian-container.sh b/debian-container/debian-container.sh
index 44bd55a..da7a4f2 100755
--- a/debian-container/debian-container.sh
+++ b/debian-container/debian-container.sh
@@ -15,6 +15,7 @@ source "$DC_DIR/lib/storage.sh"
 source "$DC_DIR/lib/mount.sh"
 source "$DC_DIR/lib/binds.sh"
 source "$DC_DIR/lib/profiles.sh"
+source "$DC_DIR/lib/manifest.sh"
 source "$DC_DIR/lib/container.sh"
 
 DC_ACTION=${1:-}
@@ -51,6 +52,7 @@ esac
 
 case "$DC_ACTION" in
   base-create) dc_base_create "$@" ;;
+  base-info)   dc_manifest_info "$@" ;;
   init)    dc_init "$@" ;;
   _init)   dc_init_rootfs "$@" ;;
   enter)   dc_enter "$@" ;;
diff --git a/debian-container/lib/common.sh b/debian-container/lib/common.sh
index 96ed00b..6177482 100644
--- a/debian-container/lib/common.sh
+++ b/debian-container/lib/common.sh
@@ -50,6 +50,7 @@ dc_usage() {
 
 命令：
   base-create [选项]  下载一次并创建 debootstrap 软件包 tarball
+  base-info TAR      查看基础 tarball 的 manifest
   init NAME [选项]    创建指定名称的容器镜像
   enter NAME [选项]   进入指定容器
   exec NAME [选项]    在指定容器中执行命令
@@ -68,6 +69,7 @@ resize 选项：
 
 base-create 选项：
   --output PATH       输出 tarball 路径
+  --manifest PATH     manifest 路径（默认：TARBALL.manifest）
   --suite SUITE       Debian 版本
   --arch ARCH         目标架构
   --mirror URL        Debian 镜像地址
diff --git a/debian-container/lib/container.sh b/debian-container/lib/container.sh
index 2ae920e..b3d8c9b 100644
--- a/debian-container/lib/container.sh
+++ b/debian-container/lib/container.sh
@@ -128,6 +128,7 @@ dc_base_create() {
   local mirror=$DC_MIRROR
   local include=$DC_INCLUDE
   local exclude=$DC_EXCLUDE
+  local manifest=
   local temporary_root
   local -a debootstrap_options=(--variant=minbase)
 
@@ -138,6 +139,11 @@ dc_base_create() {
         output=$2
         shift 2
         ;;
+      --manifest)
+        (($# >= 2)) || dc_die '--manifest 需要一个文件路径。'
+        manifest=$2
+        shift 2
+        ;;
       --suite)
         (($# >= 2)) || dc_die '--suite 需要一个版本名称。'
         suite=$2
@@ -174,10 +180,18 @@ dc_base_create() {
   done
 
   output=$(readlink -m -- "$output")
+  if [[ -z "$manifest" ]]; then
+    manifest="$output.manifest"
+  else
+    manifest=$(readlink -m -- "$manifest")
+  fi
+  [[ "$manifest" != "$output" ]] || dc_die 'manifest 不能覆盖 tarball。'
   [[ ! -e "$output" ]] || dc_die "tarball 已存在：$output"
+  [[ ! -e "$manifest" ]] || dc_die "manifest 已存在：$manifest"
 
-  dc_require_commands debootstrap mktemp readlink
+  dc_require_commands awk date debootstrap mktemp readlink sha256sum
   mkdir -p "$(dirname -- "$output")"
+  mkdir -p "$(dirname -- "$manifest")"
   temporary_root=$(mktemp -d)
 
   [[ -n "$arch" ]] && debootstrap_options+=("--arch=$arch")
@@ -192,7 +206,9 @@ dc_base_create() {
       "$suite" "$temporary_root" "$mirror"
   )
 
+  dc_manifest_write "$manifest" "$output" "$suite" "${arch:-native}" "$mirror" "$include" "$exclude"
   echo "基础 tarball 已创建：$output"
+  echo "manifest 已创建：$manifest"
 }
 
 dc_enter() {
diff --git a/debian-container/lib/manifest.sh b/debian-container/lib/manifest.sh
new file mode 100644
index 0000000..2b018c9
--- /dev/null
+++ b/debian-container/lib/manifest.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: GPL-3.0-or-later
+# Copyright (C) 2026 by Richard Qin
+
+dc_manifest_write() {
+  local manifest=$1
+  local tarball=$2
+  local suite=$3
+  local arch=$4
+  local mirror=$5
+  local include=$6
+  local exclude=$7
+  local checksum
+
+  checksum=$(sha256sum "$tarball" | awk '{print $1}')
+  {
+    printf 'format=debootstrap-package-tarball\n'
+    printf 'tarball=%s\n' "$tarball"
+    printf 'suite=%s\n' "$suite"
+    printf 'arch=%s\n' "$arch"
+    printf 'mirror=%s\n' "$mirror"
+    printf 'include=%s\n' "$include"
+    printf 'exclude=%s\n' "$exclude"
+    printf 'created_at=%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    printf 'sha256=%s\n' "$checksum"
+  } > "$manifest"
+}
+
+dc_manifest_info() {
+  local input=${1:-}
+  local manifest
+  local tarball
+  local expected
+  local actual
+
+  (($# == 1)) || dc_die '用法：base-info TARBALL'
+  dc_require_commands awk sha256sum
+
+  if [[ "$input" == *.manifest ]]; then
+    manifest=$input
+    tarball=${input%.manifest}
+  else
+    manifest="$input.manifest"
+    tarball=$input
+  fi
+  [[ -f "$manifest" ]] || dc_die "找不到 manifest：$manifest"
+
+  cat "$manifest"
+  expected=$(awk -F= '$1 == "sha256" { print $2 }' "$manifest")
+  if [[ -f "$tarball" && -n "$expected" ]]; then
+    actual=$(sha256sum "$tarball" | awk '{print $1}')
+    if [[ "$actual" == "$expected" ]]; then
+      echo 'checksum=match'
+    else
+      echo 'checksum=mismatch'
+    fi
+  fi
+}