Add checksum support for Platform RPMs

docs/itential_platform_guide.md

@@ -71,10 +71,21 @@ These variables will effect how the installation occurs.
 | `repository_username` | `platform` | String | The username for authentication of the repository. | N/A |
 | `repository_password` | `platform` | String | The password for authentication of the repository. | N/A |
 | `repository_api_key` | `platform` | String | The API for authentication of the repository. Can be used instead of username/password for authentication.| N/A |
+| `platform_package_checksums` | `platform` | Dictionary | Optional per-URL checksums for `platform_packages` entries downloaded via repository. Keys are the download URL (must match the `platform_packages` entry exactly); values are in the format Ansible's `get_url` module expects, e.g. `sha256:<hash>`. URLs with no matching key are downloaded without checksum verification. | `{}` |
 
 If `platform_packages` contains URLs, either `repository_api_key` or `repository_username` and
 `repository_password` must be defined.
 
+To validate a downloaded RPM's checksum, add an entry to `platform_package_checksums` keyed by
+that RPM's exact download URL:
+
+```yaml
+platform_packages:
+  - https://registry.aws.itential.com/repository/PLATFORM/Platform%206/Platform%206.5.1/itential-platform-6.5.1-1.noarch.rpm
+platform_package_checksums:
+  "https://registry.aws.itential.com/repository/PLATFORM/Platform%206/Platform%206.5.1/itential-platform-6.5.1-1.noarch.rpm": "sha256:440353320215dcc737184744579362d78400da0bc46839fa4f6d220129843531"
+```
+
 #### Authentication Variables
 
 These variables control authentication and user session behaviors. The following table lists the

roles/platform/CLAUDE.md

@@ -49,6 +49,7 @@ Installs and configures Itential Platform (IAP). Handles OS user/directory setup
 | `platform_package_dependencies` | `glibc-common`, `openldap`, `openldap-clients`, `openssl`, `git` | OS packages required before Platform RPM |
 | `platform_encryption_key` | (required) | 64-char hex string (256-bit AES key); generate with `openssl rand -hex 32` |
 | `platform_packages` | (required) | List of RPM package names or download URLs |
+| `platform_package_checksums` | `{}` | Optional dict mapping a `platform_packages` download URL to its expected `get_url`-format checksum (e.g. `sha256:<hash>`); URLs with no entry are downloaded without verification |
 | `platform_app_artifacts_enabled` | `false` | Install app artifacts |
 | `platform_start_service` | `true` | Start the service after install |
 | `platform_upload_using_rsync` | `false` | Use rsync for artifact upload |

roles/platform/defaults/main/platform.yml

@@ -54,3 +54,10 @@ platform_start_service: true
 # Default location for the certification report files
 platform_certify_report_dir_remote: /var/tmp/itential-reports/platform
 platform_certify_report_dir_local: /tmp/itential-reports/platform
+
+# Optional per-URL checksums for platform_packages entries downloaded via repository
+# (get_url), for customers who require validated downloads. Keys are the download URL
+# (must match the platform_packages entry exactly); values are in the format Ansible's
+# get_url module expects, e.g. "sha256:<hash>". Entries with no matching key are
+# downloaded without checksum verification (today's default behavior).
+platform_package_checksums: {}

roles/platform/tasks/download-platform-archive-from-repo.yml

@@ -24,5 +24,9 @@
     url_username: "{{ repository_username | default(omit) }}"
     url_password: "{{ repository_password | default(omit) }}"
     validate_certs: true
+    # Optional per-URL checksum (e.g. "sha256:abcdef...") for customers who require
+    # validated downloads. Omitted (no verification) when this URL has no entry in
+    # platform_package_checksums.
+    checksum: "{{ platform_package_checksums[artifact] | default(omit) }}"
   register: platform_package_download_result
   changed_when: false