fix(auth): harden restore verification transaction

tools/tht/internal/backup/restore_host.go

@@ -11,6 +11,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"regexp"
 	"strconv"
 	"strings"
 	"time"
@@ -420,9 +421,10 @@ func verifyRestoreWorkspace(ctx context.Context, installation config.Installatio
 		return errors.New("restored workspace registry returned an invalid result")
 	}
 	var payload struct {
-		Ready      bool   `json:"ready"`
-		State      string `json:"state"`
-		Workspaces int    `json:"workspaces"`
+		Ready       bool   `json:"ready"`
+		State       string `json:"state"`
+		Workspaces  int    `json:"workspaces"`
+		Fingerprint string `json:"fingerprint"`
 	}
 	decoder := json.NewDecoder(strings.NewReader(result.Stdout))
 	decoder.DisallowUnknownFields()
@@ -434,6 +436,7 @@ func verifyRestoreWorkspace(ctx context.Context, installation config.Installatio
 		return errors.New("restored workspace registry returned an invalid result")
 	}
 	if !payload.Ready || payload.Workspaces < 0 ||
+		!regexp.MustCompile(`^sha256:[0-9a-f]{64}$`).MatchString(payload.Fingerprint) ||
 		(payload.State != "active" && payload.State != "uninitialized") ||
 		(payload.State == "uninitialized" && payload.Workspaces != 0) {
 		return errors.New("restored workspace registry did not pass integrity validation")