Record WSA runtime check tools in manifest

Author: Ognisty321

docs/WSA_KNOWN_GOOD_ARCHIVE.md

@@ -12,8 +12,10 @@ The WSA kernel release is reproducible only when the full runtime bundle is capt
 8. Clang, LLD, Rust and Cargo versions.
 9. ReSukiSU Manager version, release `ksud` SHA256 and confirmation that `libksud.so` contains the x86_64 `ksud kpm` path.
 10. SHA256 of `KernelSU/scripts/check-manager-kpm-x86.sh`, `KernelSU/scripts/check-kpm-module-x86.sh`, `KernelSU/scripts/fuzz-kpm-x86-smoke.sh` and `KernelSU/tools/kpm-x86-fuzz/kpm_elf_fuzz.c`.
-11. `scripts/wsa-verify-release-manifest.sh` result for the exact manifest and kernel artifact.
-12. Boot smoke result and dmesg scan result.
+11. SHA256 of `scripts/wsa-verify-release-manifest.sh` and `scripts/wsa-check-runtime-ksud.sh`.
+12. `scripts/wsa-verify-release-manifest.sh` result for the exact manifest and kernel artifact.
+13. `scripts/wsa-check-runtime-ksud.sh` result for the booted WSA instance.
+14. Boot smoke result and dmesg scan result.
 
 Use `scripts/wsa-release-manifest.sh arch/x86/boot/bzImage` after a build. Store its output next to the kernel binary and paste the SHA256 into the release notes.
 

scripts/wsa-release-manifest.sh

@@ -98,6 +98,18 @@ if [ -f .config ]; then
 	grep -E '^CONFIG_(LOCALVERSION|KSU|KPM|KALLSYMS|DEBUG_WX|KASAN|KCSAN|KFENCE|PROVE_LOCKING)=' .config | sort
 fi
 
+if [ -f scripts/wsa-verify-release-manifest.sh ]; then
+	kv wsa_manifest_verify_script "scripts/wsa-verify-release-manifest.sh"
+	kv wsa_manifest_verify_script_sha256 \
+		"$(sha256sum scripts/wsa-verify-release-manifest.sh | awk '{print $1}')"
+fi
+
+if [ -f scripts/wsa-check-runtime-ksud.sh ]; then
+	kv wsa_runtime_ksud_check_script "scripts/wsa-check-runtime-ksud.sh"
+	kv wsa_runtime_ksud_check_script_sha256 \
+		"$(sha256sum scripts/wsa-check-runtime-ksud.sh | awk '{print $1}')"
+fi
+
 kv clang "$({ clang --version 2>/dev/null || true; } | sed -n '1p')"
 kv ld_lld "$({ ld.lld --version 2>/dev/null || true; } | sed -n '1p')"
 kv rustc "$({ rustc --version 2>/dev/null || true; } | sed -n '1p')"

scripts/wsa-verify-release-manifest.sh

@@ -160,6 +160,8 @@ check_file_hash manager_x86_64_check_script manager_x86_64_check_script_sha256
 check_file_hash kpm_x86_64_module_check_script kpm_x86_64_module_check_script_sha256
 check_file_hash kpm_x86_64_fuzz_smoke_script kpm_x86_64_fuzz_smoke_script_sha256
 check_file_hash kpm_x86_64_fuzz_harness kpm_x86_64_fuzz_harness_sha256
+check_file_hash wsa_manifest_verify_script wsa_manifest_verify_script_sha256
+check_file_hash wsa_runtime_ksud_check_script wsa_runtime_ksud_check_script_sha256
 
 if [ "$failures" -ne 0 ]; then
 	exit 1