Bind delivered binaries to verified build source

internal/build/build.go

@@ -47,6 +47,7 @@ type Artifact struct {
 type Result struct {
 	RepositoryDir   string
 	CandidateCommit string
+	SourceVerified  bool
 	Version         string
 	MainPackage     string
 	BinaryName      string
@@ -95,6 +96,10 @@ func Build(ctx context.Context, request Request) (Result, error) {
 		return result, err
 	}
 	result.CandidateCommit = commit
+	cleanBefore, err := cleanSource(ctx, repositoryDir)
+	if err != nil {
+		return result, err
+	}
 
 	if len(result.Targets) == 0 {
 		result.OutputDir = resolvedOutputDir(repositoryDir, request.OutputDir)
@@ -177,6 +182,15 @@ func Build(ctx context.Context, request Request) (Result, error) {
 	if err := checkVersion(ctx, smokePath, request.Spec.BinaryName, request.Version); err != nil {
 		return result, err
 	}
+	commitAfter, err := gitCommit(ctx, repositoryDir)
+	if err != nil {
+		return result, err
+	}
+	cleanAfter, err := cleanSource(ctx, repositoryDir)
+	if err != nil {
+		return result, err
+	}
+	result.SourceVerified = cleanBefore && cleanAfter && commitAfter == commit
 	return result, nil
 }
 
@@ -330,3 +344,12 @@ func checkVersion(ctx context.Context, binaryPath, binaryName, version string) e
 	}
 	return nil
 }
+
+func cleanSource(ctx context.Context, repositoryDir string) (bool, error) {
+	command := exec.CommandContext(ctx, "git", "-C", repositoryDir, "status", "--porcelain", "--untracked-files=all")
+	output, err := command.Output()
+	if err != nil {
+		return false, fmt.Errorf("inspect build source: %w", err)
+	}
+	return len(output) == 0, nil
+}

internal/delivery/delivery.go

@@ -26,6 +26,7 @@ const (
 type BuildIdentity struct {
 	RepositoryDir   string
 	CandidateCommit string
+	SourceVerified  bool
 	Version         string
 	MainPackage     string
 	BinaryName      string
@@ -139,6 +140,9 @@ func validateBuild(repositoryDir, commit, version string, build *BuildIdentity,
 		}
 		return nil
 	}
+	if !build.SourceVerified {
+		return errors.New("build source was not verified as clean and unchanged during compilation")
+	}
 	buildRepository, err := filepath.Abs(build.RepositoryDir)
 	if err != nil {
 		return fmt.Errorf("resolve build repository: %w", err)