From 70f6efc0030bdf71c3cbcb8443bb619c0bb28878 Mon Sep 17 00:00:00 2001
From: emersonbusson <93008583+emersonbusson@users.noreply.github.com>
Date: Fri, 18 Sep 2026 10:26:25 +0000
Subject: [PATCH] fix: actually verify the tarball sha256 against its checksum
 file

---
 scripts/package/build-rpm-package.sh | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/scripts/package/build-rpm-package.sh b/scripts/package/build-rpm-package.sh
index 5d3580fb1..84e478850 100755
--- a/scripts/package/build-rpm-package.sh
+++ b/scripts/package/build-rpm-package.sh
@@ -42,7 +42,7 @@ Name:           ramshared
 Version:        ${RPM_VERSION}
 Release:        1%{?dist}
 Summary:        Hardware-accelerated VRAM memory tiering & low-level kernel drivers
-License:        GPL-2.0-only
+License:        Apache-2.0
 URL:            https://github.com/emersonbusson/ramshared
 
 %description
@@ -79,6 +79,25 @@ fi
 - Official v0.9.0-beta.2 Linux RPM release with hardware DMA & ublk support.
 SPEC_EOF
 
+
+TARBALL_PATH="$RPM_ROOT/SOURCES/ramshared-${RPM_VERSION}.tar.gz"
+if [[ -f "$TARBALL_PATH" ]]; then
+  echo "==> Verifying source tarball SHA-256..."
+  EXPECTED_SHA_FILE="${TARBALL_PATH}.sha256"
+  if [[ -f "$EXPECTED_SHA_FILE" ]]; then
+    if ! sha256sum -c "$EXPECTED_SHA_FILE" --status; then
+      echo "ERROR: SHA-256 checksum mismatch for tarball" >&2
+      exit 1
+    fi
+  else
+    echo "ERROR: Missing SHA-256 checksum file ($EXPECTED_SHA_FILE)" >&2
+    exit 1
+  fi
+  echo "✓ Tarball verified"
+else
+  echo "==> No tarball to verify at $TARBALL_PATH (not building from source tarball)"
+fi
+
 if command -v rpmbuild >/dev/null 2>&1; then
   echo "==> Executing rpmbuild..."
   rpmbuild --define "_topdir $RPM_ROOT" -bb "$SPEC_FILE"