Obtain lock on gha.sum for verification

Author: ericcornelissen

CHANGELOG.md

@@ -16,6 +16,7 @@ Versioning].
 
 - Correct typo in the `ghasum help verify` output.
 - Enable cache eviction on `ghasum init`.
+- Ensure `ghasum verify` outcome is linked to `gha.sum` content.
 
 ## [v0.4.0] - 2025-04-27
 

SPECIFICATION.md

@@ -33,8 +33,8 @@ If the checksum file does not exist the process shall exit immediately with an
 error.
 
 If the checksum file exists the process shall obtain a lock on it, if this is
-not possible to process shall exit immediately (it means the file may be edited
-by another process leading to an inconsistent state).
+not possible the process shall exit immediately. Otherwise the file could be
+changed by another process potentially leading to an inconsistent sumfile.
 
 If the file lock is obtained, the process shall first read it and parse it
 completely to extract the sumfile version. If this fails the process shall exit
@@ -62,6 +62,11 @@ This process does not verify any of the checksums currently in the sumfile.
 If the checksum file does not exist the process shall exit immediately with an
 error.
 
+If the checksum file exists the process shall obtain a lock on it, if this is
+not possible the process shall exit immediately. Otherwise the file could be
+changed during the verification process resulting in a potential mismatch
+between verification outcome and sumfile content.
+
 If the checksum file exists the process shall read and parse it fully. If this
 fails the process shall exit immediately. Else it shall recompute the checksums
 (see [Computing Checksums]) for all actions in the target (see [Collecting

internal/ghasum/atoms.go

@@ -203,17 +203,6 @@ func open(base string) (*os.File, error) {
 	return file, nil
 }
 
-func read(repo fs.FS) ([]byte, error) {
-	raw, err := fs.ReadFile(repo, ghasumPath)
-	if errors.Is(err, fs.ErrNotExist) {
-		return nil, ErrNotInitialized
-	} else if err != nil {
-		return nil, errors.Join(ErrSumfileRead, err)
-	}
-
-	return raw, nil
-}
-
 func remove(base string) error {
 	fullGhasumPath := path.Join(base, ghasumPath)
 	if err := os.Remove(fullGhasumPath); err != nil {

internal/ghasum/operations.go

@@ -187,11 +187,21 @@ func Update(cfg *Config, force bool) error {
 // Verification report checksums that do not match and checksums that are
 // missing. It does not report checksums that are not used.
 func Verify(cfg *Config) ([]Problem, error) {
-	raw, err := read(cfg.Repo)
+	file, err := open(cfg.Path)
 	if err != nil {
 		return nil, err
 	}
 
+	defer func() {
+		_ = unlock(cfg.Path)
+		_ = file.Close()
+	}()
+
+	raw, err := io.ReadAll(file)
+	if err != nil {
+		return nil, errors.Join(ErrSumfileRead, err)
+	}
+
 	stored, err := decode(raw)
 	if err != nil {
 		return nil, err
@@ -208,5 +218,9 @@ func Verify(cfg *Config) ([]Problem, error) {
 	}
 
 	result := compare(fresh, stored)
+	if err := unlock(cfg.Path); err != nil {
+		return nil, err
+	}
+
 	return result, nil
 }