From dab33f11e2b82853e68bda9f83520eab4366f8bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82?= <ash8820@proton.me>
Date: Mon, 17 Aug 2026 18:14:07 +0200
Subject: [PATCH] feat: generate ISO sha256 checksum on build

artools only embeds internal LiveOS md5 files; nothing verifies the ISO
itself. Emit <iso>.sha256 alongside the artifact in both CI and the
podman build script so releases ship a verifiable checksum.
---
 .github/workflows/build.yml | 8 ++++++++
 build-iso-podman.sh         | 5 +++++
 2 files changed, 13 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 418c48e..8402522 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -59,6 +59,14 @@ jobs:
       run: |
         sudo -E ./buildiso -p antergos
 
+    - name: Generate checksums
+      run: |
+        cd "${WORKSPACE_DIR}/iso/antergos"
+        ISO=$(ls antergos-*.iso | head -1)
+        [[ -z "$ISO" || ! -f "$ISO" ]] && { echo "No ISO found"; exit 1; }
+        sha256sum "$ISO" > "$ISO.sha256"
+        cat "$ISO.sha256"
+
     - name: Upload ISO artifact
       uses: actions/upload-artifact@v4
       with:
diff --git a/build-iso-podman.sh b/build-iso-podman.sh
index 8acdc2f..78cae3a 100755
--- a/build-iso-podman.sh
+++ b/build-iso-podman.sh
@@ -31,5 +31,10 @@ sudo podman run --rm --privileged --entrypoint sh \
     echo "=== BUILD FINISHED ==="
     mkdir -p /workspace/iso-output
     cp -a /workspace/iso/antergos/. /workspace/iso-output/ 2>/dev/null || true
+    cd /workspace/iso-output
+    ISO=$(ls antergos-*.iso 2>/dev/null | head -1)
+    [[ -z "$ISO" || ! -f "$ISO" ]] && { echo "No ISO found in iso-output/"; exit 1; }
+    sha256sum "$ISO" > "$ISO.sha256"
+    cat "$ISO.sha256"
     ls -la /workspace/iso-output/ | head -20
   '