verify-disc

name	verify-disc
description	Use when the user wants to confirm a freshly-burned disc actually matches the source — sha256-compares every file on the disc against the source manifest.

Verify Disc

Mount the just-burned disc read-only and verify every file's sha256 matches the source. Slow but conclusive — recommend running on the first copy of each batch only.

When to use

• Right after burn-disc completes, especially for the first copy of a batch.
• When the user wants confidence the burn is sound before discarding the source.

Inputs to gather

• Disc number (to locate the batch filelist).
• Device — auto-detect via lsblk -nro NAME,TYPE | awk '$2=="rom"{print "/dev/"$1}' | head -1. Allow override.
• Or, alternatively, an ISO path to verify by loop-mounting.

Procedure

1. Print time estimate: ~30 min per 25 GB disc (read speed limited). Confirm before starting.
2. Mount:
   • Physical disc: udisksctl mount -b <device> and capture the mountpoint from the output.
   • ISO: mount -o ro,loop <iso> <mountpoint> (requires sudo) or udisksctl loop-setup -f <iso> then mount.
3. Load $WORKSPACE/batches/disc-NN/filelist.txt (and graftpoints map for the on-disc path).
4. For each file: compute sha256sum of the on-disc copy and the source file; record pass/fail and both hashes.
5. Write $WORKSPACE/logs/disc-NN-verify.json with per-file results plus aggregate (passed, failed, missing).
6. Unmount: udisksctl unmount -b <device> (or umount for loop). Eject if physical.
7. Print summary; non-zero failures must be loud.

Output / side effects

• $WORKSPACE/logs/disc-NN-verify.json.
• Stdout pass/fail summary.

Safety / constraints

• Mount strictly read-only — never write back to the disc.
• A single hash mismatch means the disc is bad; recommend reburning that copy.