Ensure cryptographic hashes of system files match vendor values

# rpm -Va flags file changes; '5' in col-3 = hash mismatch. Ignore config (c)
# and documentation, and missing files. Any hash-mismatch on a non-config
# file is a finding.
bad=$(rpm -Va --nomtime --nosize --nolinkto 2>/dev/null | awk '$1 ~ /^..5/ && $2 != "c" {print}' | head -5)
if [ -n "$bad" ]; then
  echo "FAIL: system files with hash mismatch:"; echo "$bad"
  exit 1
fi
echo "OK: no unexpected file-hash mismatches"
exit 0

expected_exit:

0

note:

Investigate each rpm -Va hash mismatch; reinstall the affected package (dnf reinstall <pkg>) after confirming it is not an authorized change.