Reuse raw builder exports only with matching verified provenance

hydra/build.py

@@ -426,14 +426,36 @@ fi'''
         if self.complete('rootfs'):
             return
         source_inputs = image.source_identity(self.source_dir)
-        self.record('rootfs', complete=False)
+        previous = self.manifest().get('rootfs', {})
+        inputs = self.input_id()
+        inventory_checksum = image.digest(self.work / 'artifacts/packages.json')
+        if inventory_checksum != self.manifest().get('packages', {}).get('inventory_sha256'):
+            raise BuildError('Package inventory changed before rootfs export')
         original = self.work / 'artifacts/builder-rootfs.tar'
         if original.is_symlink() or not original.parent.resolve().is_relative_to(self.work):
             raise BuildError('Raw export output must remain inside the dedicated work directory')
+        if original.exists() and (not original.is_file() or original.stat().st_nlink != 1):
+            raise BuildError('Raw export output must be a singly linked regular file')
+        snapshot = None
+        previous_artifacts = previous.get('artifacts', {})
+        if (previous.get('complete') is True and previous.get('inputs') == inputs
+                and isinstance(previous_artifacts, dict)
+                and previous_artifacts.get('packages.json') == inventory_checksum
+                and isinstance(previous.get('snapshot_sha256'), str)
+                and re.fullmatch('[a-f0-9]{64}', previous['snapshot_sha256'])
+                and original.is_file()):
+            try:
+                if image.digest(original) == previous['snapshot_sha256']:
+                    snapshot = previous['snapshot_sha256']
+            except OSError:
+                pass  # Unreadable cache is never trusted; attempt an ordinary export.
+        # Preserve the prior completed provenance until the cache decision is made.
+        self.record('rootfs', complete=False)
         original.touch(mode=0o600, exist_ok=True)
         original.chmod(0o600)  # The unsanitized intermediate can contain builder-private trust.
-        self.pod('export', '--output', str(original), self.name)
-        snapshot = image.digest(original)
+        if snapshot is None:
+            self.pod('export', '--output', str(original), self.name)
+            snapshot = image.digest(original)
         assembler = self.assembly(snapshot)
         commit = self.run(['git', '-C', str(self.source_dir), 'rev-parse', 'HEAD'], capture=True).stdout.strip()
         script = 'root=/hydra-output/rootfs\n' + rootfs_retry_guard_script() + r"""mkdir -p "$root"