Repository navigation
REQ 013
REQ-013: Base-OS ISO fail-closed on SHA-256 mismatch before attach (auxiliary bootstrap media not covered -- known gap)
build-virtualbox.ps1/.sh (both the Windows- and Ubuntu-LabVIEW families) shall reject a create-vm/provision-public request whose base-OS ISO does not match a pinned SHA-256 hash, before attaching that media to any VM.
Prevents an operator-supplied or cached installer file from silently differing from the exact, previously-verified binary the pipeline was proven against.
build-virtualbox.sh's -Run/--run path (both families) pipes the downloaded/supplied ISO through sha256sum --check against the pinned iso_sha256, exiting non-zero on mismatch, before VM creation. Scoped to the base-OS ISO specifically -- the optional, operator-overridable auxiliary bootstrap media (-NsisBootstrapIso/NSIS_BOOTSTRAP_ISO, SERVICE_BOOTSTRAP_ISO) is only existence-checked, not hash-verified, a known, narrower gap tracked separately.
Code review of vm/windows-labview/build-virtualbox.sh (the actually-invoked script per provision-windows-labview-vm.yml:130,132 -- its sibling vm/windows-labview/build-virtualbox.ps1 has equivalent Get-FileHash/Stop-Build logic but is never called by any real workflow, confirmed via a repo-wide reference search) and vm/ubuntu-labview/build-virtualbox.sh (the sha256sum --check call ahead of VM creation). This is distinct from provision-windows-labview-vm.yml's separate install-vipm/install-labview phases, which pin the VIPM/LabVIEW installer's own hash, not the base-OS ISO.
Software-Requirements-Specification
High
Code review of vm/windows-labview/build-virtualbox.sh's sha256sum --check call (the script actually invoked by provision-windows-labview-vm.yml -- its sibling .ps1 has equivalent logic but zero real callers) and vm/ubuntu-labview/build-virtualbox.sh's equivalent sha256sum --check call
vm/windows-labview/build-virtualbox.sh, vm/ubuntu-labview/build-virtualbox.sh
Verified (manual)