733cmd_rollback() {
734    need_root rollback
735    out_dir="$CUSTOMOS_VB_DIR"
736    img=$(img_of "$out_dir"); hashdev=$(hash_of "$out_dir"); rhfile=$(rh_of "$out_dir")
737    [ -f "$img.prev" ] && [ -f "$hashdev.prev" ] && [ -f "$rhfile.prev" ] \
738        || die "no complete previous slot in $out_dir -- nothing to roll back to"
739    # Swap current <-> prev file by file (rename only). If the current slot is
740    # incomplete (an interrupted rebuild), prev simply becomes current.
741    for _f in "$img" "$hashdev" "$rhfile"; do
742        if [ -f "$_f" ]; then
743            mv -f "$_f" "$_f.swap.$$"       || die "could not stage $_f for the swap"
744            mv -f "$_f.prev" "$_f"          || die "could not promote $_f.prev"
745            mv -f "$_f.swap.$$" "$_f.prev"  || die "could not demote the old $_f"
746        else
747            mv -f "$_f.prev" "$_f"          || die "could not promote $_f.prev"
748        fi
749    done

1# name  version  kind  url  sha256  license — consumed only by customos-fetch.sh (fail-closed)
19vscodium        1.135.06055 deb  https://github.com/VSCodium/vscodium/releases/…/codium_1.135.06055_amd64.deb
                  5f5c00a9da9d232e4c84e9eee68bbdeb4d8737462022626ce3bdb6948f3d8649  MIT
28element-desktop 1.12.30     deb  https://packages.element.io/debian/pool/main/e/element-desktop/…_amd64.deb
                  8db1b7bb53e96b31f77d3684776efa302cd3c518e54fece603a1f085e2c4cd93  AGPL-3.0-only

1#!/usr/bin/env bash
2# Tests for the IDE + opt-in AI assistants (THREAT_MODEL §2.20), WITHOUT network,
3# root or a real VSCodium:
4#   1) iso/third-party.lock parses: 6 fields, 64-hex sha256, https URL per entry.
5#   2) customos-fetch.sh: a wrong sha256 is REJECTED and the file deleted (mutation
6#      test on a file:// fixture); the right one is accepted and cached.
9#   3) build wiring: the .deb goes through fetch/verify before 'apt-get install',
10#      a mismatch aborts (fail), the vendor apt source/key are removed.