Snapshot verified references for extraction

internal/fileops/fileops_test.go

@@ -1,6 +1,8 @@
 package fileops
 
 import (
+	"crypto/sha256"
+	"encoding/hex"
 	"errors"
 	"io"
 	"os"
@@ -74,6 +76,28 @@ func TestCopyFileAtomicWithChecksumMatchesDestination(t *testing.T) {
 	assertNoMatchingTempFiles(t, filepath.Dir(dst), ".copied.txt.tmp-")
 }
 
+func TestWriteReaderAtomicWithChecksumMatchesDestination(t *testing.T) {
+	root := t.TempDir()
+	dst := filepath.Join(root, "nested", "snapshot.yml")
+	payload := "verified reference bytes\n"
+
+	checksum, err := WriteReaderAtomicWithChecksum(dst, strings.NewReader(payload), WorkspaceFileMode)
+	if err != nil {
+		t.Fatalf("WriteReaderAtomicWithChecksum() error = %v", err)
+	}
+	wantChecksum := sha256.Sum256([]byte(payload))
+	if checksum != hex.EncodeToString(wantChecksum[:]) {
+		t.Fatalf("checksum = %q, want %q", checksum, hex.EncodeToString(wantChecksum[:]))
+	}
+	data, err := os.ReadFile(dst)
+	if err != nil {
+		t.Fatalf("ReadFile() error = %v", err)
+	}
+	if string(data) != payload {
+		t.Fatalf("destination = %q, want %q", data, payload)
+	}
+}
+
 func TestCopyFileAtomicCleansTempFileOnInstallFailure(t *testing.T) {
 	root := t.TempDir()
 	src := filepath.Join(root, "source.txt")