| [CmdletBinding()] | |
| param( | |
| [Parameter(Mandatory=$true)][string]$Root, | |
| [ValidateSet("Warn","Fail")][string]$Mode="Fail" | |
| ) | |
| $manifest = Join-Path $Root "manifest\sha256-manifest.json" | |
| if (!(Test-Path $manifest)) { | |
| if ($Mode -eq "Fail") { throw "Missing sha256 manifest." } | |
| Write-Warning "Missing sha256 manifest." | |
| exit 0 | |
| } | |
| $data = Get-Content $manifest -Raw | ConvertFrom-Json | |
| $bad = @() | |
| foreach ($entry in $data.files) { | |
| $p = Join-Path $Root $entry.path | |
| if (!(Test-Path $p)) { $bad += "missing: $($entry.path)"; continue } | |
| $h = (Get-FileHash -Algorithm SHA256 $p).Hash.ToLowerInvariant() | |
| if ($h -ne $entry.sha256.ToLowerInvariant()) { $bad += "hash mismatch: $($entry.path)" } | |
| } | |
| if ($bad.Count -gt 0) { | |
| $msg = "Integrity check failed:`n" + ($bad -join "`n") | |
| if ($Mode -eq "Fail") { throw $msg } | |
| Write-Warning $msg | |
| } | |