From 4971445f67deba8729ebb6f79389be6a589dd4d4 Mon Sep 17 00:00:00 2001
From: Markus Rudy <mr@edgeless.systems>
Date: Wed, 29 Apr 2026 15:55:13 +0200
Subject: [PATCH] runtime-rs: don't modify initdata from annotation

The initdata is currently being decoded, and then re-encoded with the
to_string function. This will usually not preserve the original initdata
document, and thus the initdata hash will differ between the annotation
and the block device.

This commit changes the logic to only decode the base64, but keep the
initdata document intact. Since the error message is now nested, adjust
the tests to look for the expected error in the chain.

Fixes: #12951

Signed-off-by: Markus Rudy <mr@edgeless.systems>
---
 src/libs/kata-types/src/initdata.rs | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/src/libs/kata-types/src/initdata.rs b/src/libs/kata-types/src/initdata.rs
index efa7b502a8..c6841e1c28 100644
--- a/src/libs/kata-types/src/initdata.rs
+++ b/src/libs/kata-types/src/initdata.rs
@@ -246,7 +246,7 @@ pub fn add_hypervisor_initdata_overrides(initdata_annotation: &str) -> Result<St
         return Ok("".to_string());
     }
 
-    decode_initdata(initdata_annotation)?.to_string()
+    decode_raw_initdata(initdata_annotation).context("decoding initdata annotation failed")
 }
 
 use std::io::Write;
@@ -335,7 +335,9 @@ url = 'http://kbs-service.xxx.cluster.local:8080'
         assert!(result.is_err());
 
         let error = result.unwrap_err();
-        assert!(error.to_string().contains("base64 decode"));
+        assert!(error
+            .chain()
+            .any(|e| e.to_string().contains("base64 decode")));
     }
 
     #[test]
@@ -348,7 +350,9 @@ url = 'http://kbs-service.xxx.cluster.local:8080'
         assert!(result.is_err());
 
         let error = result.unwrap_err();
-        assert!(error.to_string().contains("gz decoder failed"));
+        assert!(error
+            .chain()
+            .any(|e| e.to_string().contains("gz decoder failed")));
     }
 
     #[test]