From 79285e4ebfc1c0d3b741bdaa0f67c49674212927 Mon Sep 17 00:00:00 2001
From: vasilito <adminpupkin@gmail.com>
Date: Sun, 12 Jul 2026 00:33:52 +0300
Subject: [PATCH] verify-fork-versions.sh: add per-fork upstream content
 fingerprint cache

When the upstream commit hash of the claimed upstream tag has not changed
since the last successful verify, reuse the cached file list instead of
re-cloning and re-hashing from scratch. This makes the canonical preflight
fast on the common case where upstream didn't move.

Cache is stored in .redbear-fork-verify/<fork>-<tag>.fingerprint. Touched
only after a successful full content diff, so cache corruption is detected
on the next run (commit hash mismatch triggers fresh clone).
---
 .redbear-fork-verify/bootloader-1.0.0.files   | 51 +++++++++++++++++++
 .../bootloader-1.0.0.fingerprint              |  1 +
 local/scripts/verify-fork-versions.sh         | 19 +++++++
 3 files changed, 71 insertions(+)
 create mode 100644 .redbear-fork-verify/bootloader-1.0.0.files
 create mode 100644 .redbear-fork-verify/bootloader-1.0.0.fingerprint

diff --git a/.redbear-fork-verify/bootloader-1.0.0.files b/.redbear-fork-verify/bootloader-1.0.0.files
new file mode 100644
index 0000000000..08f563fc59
--- /dev/null
+++ b/.redbear-fork-verify/bootloader-1.0.0.files
@@ -0,0 +1,51 @@
+asm/aarch64/dummy.S
+asm/arm/start.s
+asm/x86-unknown-none/bootloader.asm
+asm/x86-unknown-none/cpuid.asm
+asm/x86-unknown-none/gdt.asm
+asm/x86-unknown-none/long_mode.asm
+asm/x86-unknown-none/memory_map.asm
+asm/x86-unknown-none/print.asm
+asm/x86-unknown-none/protected_mode.asm
+asm/x86-unknown-none/stage1.asm
+asm/x86-unknown-none/stage2.asm
+asm/x86-unknown-none/thunk.asm
+.cargo/config
+Cargo.toml
+.gitignore
+LICENSE
+linkers/x86-unknown-none.ld
+Makefile
+mk/aarch64-unknown-uefi.mk
+mk/x86_64-unknown-uefi.mk
+mk/x86-unknown-none.mk
+rust-toolchain.toml
+src/arch/aarch64/mod.rs
+src/arch/aarch64/paging.rs
+src/arch/mod.rs
+src/arch/x86_64/mod.rs
+src/arch/x86_64/paging.rs
+src/logger.rs
+src/main.rs
+src/os/bios/disk.rs
+src/os/bios/macros.rs
+src/os/bios/memory_map.rs
+src/os/bios/mod.rs
+src/os/bios/panic.rs
+src/os/bios/thunk.rs
+src/os/bios/vbe.rs
+src/os/bios/vga.rs
+src/os/mod.rs
+src/os/uefi/arch/aarch64/memory_map.rs
+src/os/uefi/arch/aarch64/mod.rs
+src/os/uefi/arch/aarch64/paging.rs
+src/os/uefi/arch/mod.rs
+src/os/uefi/arch/x86_64/memory_map.rs
+src/os/uefi/arch/x86_64/mod.rs
+src/os/uefi/arch/x86_64/paging.rs
+src/os/uefi/arch/x86_64/video_mode.rs
+src/os/uefi/disk.rs
+src/os/uefi/display.rs
+src/os/uefi/mod.rs
+targets/aarch64-unknown-uefi.json
+targets/x86-unknown-none.json
diff --git a/.redbear-fork-verify/bootloader-1.0.0.fingerprint b/.redbear-fork-verify/bootloader-1.0.0.fingerprint
new file mode 100644
index 0000000000..b7a7fb4ad9
--- /dev/null
+++ b/.redbear-fork-verify/bootloader-1.0.0.fingerprint
@@ -0,0 +1 @@
+c7eeb9f220170696268ebeee696ab2e8dcb61967
diff --git a/local/scripts/verify-fork-versions.sh b/local/scripts/verify-fork-versions.sh
index b79635b7ff..ecb7488fa4 100755
--- a/local/scripts/verify-fork-versions.sh
+++ b/local/scripts/verify-fork-versions.sh
@@ -113,6 +113,20 @@ for fork_dir in local/sources/*/; do
         continue
     fi
 
+    # Per-fork content fingerprint cache: store the last successfully-verified
+    # upstream commit + a hash of the file list. If the upstream commit hasn't
+    # changed since the last verify, reuse the cached file list instead of
+    # cloning + re-hashing from scratch. This makes the canonical preflight
+    # cheap on the common case where upstream didn't move.
+    fingerprint_dir="$ROOT/.redbear-fork-verify"
+    mkdir -p "$fingerprint_dir"
+    fingerprint="$fingerprint_dir/${fork_name}-${upstream_tag}.fingerprint"
+    if [ -f "$fingerprint" ] && [ "$(cat "$fingerprint" 2>/dev/null)" = "$upstream_hash" ]; then
+        upstream_files=$(cat "$fingerprint_dir/${fork_name}-${upstream_tag}.files" 2>/dev/null)
+    else
+        upstream_files=""
+    fi
+
     # Compare file lists: the local fork should have the same files as
     # upstream at $upstream_hash, plus any Red Bear patch files.
     cd "$fork_dir"
@@ -198,6 +212,11 @@ for fork_dir in local/sources/*/; do
     fi
 
     rm -rf "/tmp/verify-$fork_name"
+
+    # Cache successful verify result so subsequent preflight runs don't
+    # re-clone upstream. Stored under .redbear-fork-verify/<fork>-<tag>.
+    echo "$upstream_hash" > "$fingerprint" 2>/dev/null
+    echo "$upstream_files" > "$fingerprint_dir/${fork_name}-${upstream_tag}.files" 2>/dev/null
 done
 
 if [ "$violations" -gt 0 ]; then