From fa0162eff20c5ff5ed61bb27dd95faa51cc96a01 Mon Sep 17 00:00:00 2001
From: root <root@alltheacronyms.com>
Date: Fri, 1 May 2026 04:53:52 +0000
Subject: [PATCH] Verify build menu checkout freshness

---
 contrib/agrarian-build-menu.sh | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/contrib/agrarian-build-menu.sh b/contrib/agrarian-build-menu.sh
index 86cbddb6..f1a549f9 100755
--- a/contrib/agrarian-build-menu.sh
+++ b/contrib/agrarian-build-menu.sh
@@ -263,6 +263,8 @@ install_bootstrap_packages() {
 }
 
 ensure_repo() {
+  local head remote_head
+
   if [[ "${AGRARIAN_PROMPTS_DONE:-0}" != "1" ]]; then
     WORKDIR="$(prompt "Repository directory" "$WORKDIR")"
     JOBS="$(prompt "Parallel build jobs" "$JOBS")"
@@ -270,7 +272,7 @@ ensure_repo() {
 
   if [[ -d "$WORKDIR/.git" ]]; then
     ROOT="$WORKDIR"
-    run_step 25 "Fetching existing Agrarian checkout" git -C "$ROOT" fetch origin
+    run_step 25 "Fetching existing Agrarian checkout" git -C "$ROOT" fetch origin "$BRANCH"
     run_step 30 "Checking out $BRANCH" git -C "$ROOT" checkout "$BRANCH"
     run_step 35 "Fast-forwarding $BRANCH" git -C "$ROOT" pull --ff-only origin "$BRANCH"
   else
@@ -279,6 +281,13 @@ ensure_repo() {
     ROOT="$WORKDIR"
   fi
 
+  head="$(git -C "$ROOT" rev-parse --short HEAD)"
+  remote_head="$(git -C "$ROOT" rev-parse --short "origin/$BRANCH" 2>/dev/null || true)"
+  if [[ -n "$remote_head" && "$head" != "$remote_head" ]]; then
+    fail "Checkout is at $head but origin/$BRANCH is $remote_head. Refusing to build an outdated checkout."
+  fi
+  echo "Using Agrarian $BRANCH at commit $head"
+
   cd "$ROOT"
 }