feat: bind each node to the binary it runs at its first handshake; refuse changes that are not in a CI-signed manifest [CI]

packaging/update/tests/feed-test.sh

@@ -111,4 +111,22 @@ expect "first install: wrong signing key is refused" "REFUSED" "$(resolve "$T/c.
 expect "first install: manifest for another component is refused" "REFUSED" "$(resolve "$T/b.pem" probe "$REPO")"
 expect "first install: manifest naming another repository is refused" "REFUSED" "$(resolve "$T/b.pem" agent "registry.evil/moshiro-dev/moshiro-agent")"
 
+# --- 第一次部署：正在跑的镜像就是清单里的这个 digest → 记成已安装（不当作有更新），并把验过的清单交给节点握手时带上
+sed -i '/^FEED=off/d' "$T/conf/agent.conf"
+rm -f "$T/state/agent.installed" "$T/state/agent.installed.manifest" "$T/state/agent.installed.sig" "$T/data/update-status/installed."* "$T/data/update/offer."*
+printf 'IMAGE=%s@%s\n' "$REPO" "$DIGEST" > "$T/env"
+publish "$T/b.pem" 50
+expect "first deploy: the running image is already up to date" "up_to_date|" "$(check)"
+if [ "$(sed -n 2p "$T/state/agent.installed" 2>/dev/null)" = "$DIGEST" ]; then echo "ok   first deploy: install record seeded from the running image"; else echo "FAIL first deploy: no install record"; fail=1; fi
+label="$(cat "$T/feed/$REF_KEY")"
+if [ "$(cat "$T/data/update-status/installed.manifest" 2>/dev/null | base64 -w0)" = "${label%%|*}" ] && [ "$(cat "$T/data/update-status/installed.sig" 2>/dev/null)" = "${label#*|}" ]; then
+  echo "ok   the verified manifest is left for the node to present at its handshake"
+else
+  echo "FAIL installed.manifest / installed.sig missing or different"; fail=1
+fi
+# 老版本的更新器没写过：同一份（seq 相同）下次检查补上
+rm -f "$T/data/update-status/installed."* "$T/state/agent.installed.manifest" "$T/state/agent.installed.sig"
+expect "already installed: still up to date" "up_to_date|" "$(check)"
+if [ -s "$T/data/update-status/installed.manifest" ] && [ -s "$T/data/update-status/installed.sig" ]; then echo "ok   a missing copy is written again for the node"; else echo "FAIL the copy was not written again"; fail=1; fi
+
 exit "$fail"