From 68ce3e5a3b86a34973ee16958098cabcb515f08f Mon Sep 17 00:00:00 2001
From: Eric Rakestraw <eric@rakestraw.us>
Date: Wed, 4 Nov 2026 01:21:58 +0000
Subject: [PATCH] Verify cross built workflow assets

---
 .../multi_module_woodpecker_test.go           | 22 ++++++++++++++++---
 docs/roadmap/remediation.md                   |  2 ++
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/cmd/releasekit/multi_module_woodpecker_test.go b/cmd/releasekit/multi_module_woodpecker_test.go
index f6eebef..995178f 100644
--- a/cmd/releasekit/multi_module_woodpecker_test.go
+++ b/cmd/releasekit/multi_module_woodpecker_test.go
@@ -1,6 +1,8 @@
 package main
 
 import (
+	"bytes"
+	"debug/elf"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -11,6 +13,7 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"sync"
 	"testing"
@@ -78,11 +81,15 @@ func TestMultiModuleWoodpeckerDelivery(t *testing.T) {
 
 	t.Run("binary delivery from physical major module", func(t *testing.T) {
 		const tag = "integrations/core/v2.1.0"
+		arch, machine := "arm64", elf.EM_AARCH64
+		if runtime.GOOS == "linux" && runtime.GOARCH == arch {
+			arch, machine = "amd64", elf.EM_X86_64
+		}
 		delivery := newMappedDeliveryFixture(t, tag)
 		repository := newWorkflowRepository(t, example)
 		writeMappedProfile(t, repository, "releasekit-core-v2.json", cli.Settings{
 			Product: "Example Consumer Core v2", ModuleDir: "integrations/core/v2",
-			Build:    &cli.BuildSettings{MainPackage: ".", BinaryName: "core", Targets: []string{"linux/amd64"}},
+			Build:    &cli.BuildSettings{MainPackage: ".", BinaryName: "core", Targets: []string{"linux/" + arch}},
 			Delivery: workflowDeliverySettings(delivery.snapshot().URL),
 		})
 		writeRepositoryFile(t, repository, "integrations/core/v2/docs/releases/v2.1.0.md", "# Example Consumer Core v2 v2.1.0\n\nTagged core note.\n")
@@ -98,8 +105,17 @@ func TestMultiModuleWoodpeckerDelivery(t *testing.T) {
 		if observed.creates != 1 || observed.uploads != 2 || observed.tag != tag {
 			t.Fatalf("binary delivery fixture = %#v", observed)
 		}
-		if _, ok := observed.assets["core-v2.1.0-linux-amd64"]; !ok {
-			t.Fatalf("binary asset missing: %#v", observed.assets)
+		name := "core-v2.1.0-linux-" + arch
+		asset, ok := observed.assets[name]
+		if !ok {
+			t.Fatalf("binary asset %q missing", name)
+		}
+		binary, err := elf.NewFile(bytes.NewReader(asset))
+		if err != nil {
+			t.Fatalf("read uploaded %s as ELF: %v", name, err)
+		}
+		if binary.Machine != machine {
+			t.Fatalf("uploaded %s machine = %s, want %s", name, binary.Machine, machine)
 		}
 		if _, ok := observed.assets["SHA256SUMS"]; !ok {
 			t.Fatalf("checksum asset missing: %#v", observed.assets)
diff --git a/docs/roadmap/remediation.md b/docs/roadmap/remediation.md
index c6ff9c1..d7abace 100644
--- a/docs/roadmap/remediation.md
+++ b/docs/roadmap/remediation.md
@@ -46,6 +46,8 @@ paste the command.
 
 ## Exercise a profile target that differs from the launcher host
 
+**Completed.** The binary delivery fixture selects a non-host Linux target and checks the uploaded ELF machine as well as the filename.
+
 **Evidence:** The binary-delivery case in
 [`TestMultiModuleWoodpeckerDelivery`](../../cmd/releasekit/multi_module_woodpecker_test.go)
 supplies a foreign target to the workflow and checks the uploaded