ptool, CI: deterministic GPT artifacts and pinned checksum check

.github/workflows/build.yml

@@ -25,9 +25,21 @@ jobs:
           pip install -e .
 
       - name: Build all platforms and run tests
+        env:
+          PTOOL_SEED: qcom-ptool-ci
         run: |
           make lint
-          make all integration
+          make all integration check-checksums
+
+      - name: Verify checksum manifest is up to date
+        env:
+          PTOOL_SEED: qcom-ptool-ci
+        run: |
+          make generate-checksums
+          if ! git diff --exit-code tests/integration/checksums.sha256; then
+            echo "::error::tests/integration/checksums.sha256 is out of date; run 'make generate-checksums' locally and commit the result"
+            exit 1
+          fi
 
       - name: Run cargo
         run: |

Makefile

@@ -12,7 +12,7 @@ QCOM_PTOOL ?= qcom-ptool
 # optional build_id for Axiom contents.xml files
 BUILD_ID ?=
 
-.PHONY: all check clean lint integration install
+.PHONY: all check check-checksums clean generate-checksums install lint integration
 
 all: $(PLATFORMS) $(PARTITIONS_XML) $(CONTENTS_XML)
 
@@ -33,6 +33,19 @@ integration: all
 	# make sure generated output has created expected files
 	tests/integration/check-missing-files platforms/*/*/*.xml
 
+check-checksums: all
+	# verify generated artifacts match tests/integration/checksums.sha256
+	# (requires PTOOL_SEED to match the seed used to produce the manifest)
+	tests/integration/check-checksums
+
+generate-checksums: all
+	# regenerate tests/integration/checksums.sha256 from current artifacts
+	# (run with the same PTOOL_SEED that CI uses, otherwise the manifest
+	# will not match CI builds)
+	LC_ALL=C find platforms -type f \( -name '*.bin' -o -name '*.xml' \) \
+	  ! -name '*.xml.in' -print0 | LC_ALL=C sort -z | xargs -0 sha256sum \
+	  > tests/integration/checksums.sha256
+
 check: lint integration
 
 install:

qcom_ptool/ptool.py

@@ -3515,6 +3515,14 @@ def find_file(filename, search_paths):
 if XMLFile is None:
     PrintBigError("ERROR: Could not find file")
 
+# If PTOOL_SEED is set in the environment, seed the RNG with it so
+# DiskGUID and any random UniquePartitionGUIDs become reproducible
+# across runs. Intended for CI builds that want to compare artifacts
+# by checksum; left unset for normal use, preserving random GUIDs.
+_seed = os.environ.get("PTOOL_SEED")
+if _seed:
+    random.seed(_seed)
+
 ParseXML(XMLFile)  # parses XMLFile, discovers if GPT or MBR
 
 PrintBanner("OutputToCreate ===> '%s'" % OutputToCreate)

tests/integration/check-checksums

@@ -0,0 +1,17 @@
+#!/bin/sh
+# Copyright (c) 2026 Qualcomm Innovation Center, Inc. All rights reserved.
+# SPDX-License-Identifier: BSD-3-Clause-Clear
+
+# Verify generated artifacts match the pinned checksums in
+# tests/integration/checksums.sha256.
+
+set -eu
+
+manifest="tests/integration/checksums.sha256"
+
+if [ ! -r "${manifest}" ]; then
+    echo "Missing manifest: ${manifest}" >&2
+    exit 1
+fi
+
+sha256sum --quiet --check "${manifest}"