now skips all but regular files

Makefile

@@ -1,7 +1,24 @@
+TESTDIR := $(HOME)/Documents/_SYSADMIN/cyberdyne
+
 default: test
 
 test:
-	go test ./... -v
+	@go test ./... -v
+
+build: clean
+	@go build .
+
+clean:
+	@rm -f attrsum
+
+try: build
+	./attrsum sum add -v $(TESTDIR)
+	./attrsum check -v $(TESTDIR)
+	./attrsum clear -v $(TESTDIR)
+	-./attrsum check -v $(TESTDIR)
+	./attrsum sum add -v $(TESTDIR)
+	./attrsum check -v $(TESTDIR)
+	touch $(TESTDIR)/*
+	./attrsum sum update -v $(TESTDIR)
+	./attrsum check -v $(TESTDIR)
 
-build:
-	go build .

attrsum.go

@@ -9,34 +9,42 @@ import (
     "log"
     "os"
     "path/filepath"
+    "strings"
     "time"
 
     base58 "github.com/mr-tron/base58/base58"
+    "github.com/bmatcuk/doublestar/v4"
     "github.com/multiformats/go-multihash"
     "github.com/pkg/xattr"
     "github.com/spf13/cobra"
 )
 
 const (
-	// Extended-attribute keys
     checksumKey = "berlin.sneak.app.attrsum.checksum"
     sumTimeKey  = "berlin.sneak.app.attrsum.sumtime"
 )
 
-var verbose bool
+var (
+    verbose         bool
+    excludePatterns []string
+    excludeDotfiles bool
+)
 
 func main() {
     rootCmd := &cobra.Command{
         Use:   "attrsum",
         Short: "Compute and verify file checksums via xattrs",
     }
+    rootCmd.SilenceUsage = true
+    rootCmd.SilenceErrors = true
 
-	rootCmd.PersistentFlags().BoolVarP(
+    rootCmd.PersistentFlags().BoolVarP(&verbose, "verbose", "v", false, "enable verbose output")
-		&verbose, "verbose", "v", false, "enable verbose output",
+    rootCmd.PersistentFlags().StringArrayVar(&excludePatterns, "exclude", nil, "exclude files/directories matching pattern (rsync-style, repeatable)")
-	)
+    rootCmd.PersistentFlags().BoolVar(&excludeDotfiles, "exclude-dotfiles", false, "exclude any file or directory whose name starts with '.'")
 
     rootCmd.AddCommand(newSumCmd())
     rootCmd.AddCommand(newCheckCmd())
+    rootCmd.AddCommand(newClearCmd())
 
     if err := rootCmd.Execute(); err != nil {
         log.Fatal(err)
@@ -44,7 +52,7 @@ func main() {
 }
 
 ///////////////////////////////////////////////////////////////////////////////
-// Sum operations
+// Sum commands
 ///////////////////////////////////////////////////////////////////////////////
 
 func newSumCmd() *cobra.Command {
@@ -53,55 +61,33 @@ func newSumCmd() *cobra.Command {
         Short: "Checksum maintenance operations",
     }
 
-	addCmd := &cobra.Command{
+    add := &cobra.Command{
-		Use:   "add <directory>",
+        Use:   "add <dir>",
         Short: "Write checksums for files missing them",
         Args:  cobra.ExactArgs(1),
-		RunE: func(_ *cobra.Command, args []string) error {
+        RunE: func(_ *cobra.Command, a []string) error { return ProcessSumAdd(a[0]) },
-			return ProcessSumAdd(args[0])
-		},
     }
 
-	updateCmd := &cobra.Command{
+    upd := &cobra.Command{
-		Use:   "update <directory>",
+        Use:   "update <dir>",
-		Short: "Refresh checksums when file modified",
+        Short: "Recalculate checksum when file newer than stored sumtime",
         Args:  cobra.ExactArgs(1),
-		RunE: func(_ *cobra.Command, args []string) error {
+        RunE: func(_ *cobra.Command, a []string) error { return ProcessSumUpdate(a[0]) },
-			return ProcessSumUpdate(args[0])
-		},
     }
 
-	cmd.AddCommand(addCmd, updateCmd)
+    cmd.AddCommand(add, upd)
     return cmd
 }
 
-// ProcessSumAdd writes checksum & sumtime only when checksum is absent.
 func ProcessSumAdd(dir string) error {
-	return walkAndProcess(dir, func(path string, info os.FileInfo) error {
+    return walkAndProcess(dir, func(p string, _ os.FileInfo) error { return writeChecksumAndTime(p) })
-		if hasXattr(path, checksumKey) {
-			if verbose {
-				log.Printf("skip existing %s", path)
-			}
-			return nil
-		}
-		return writeChecksumAndTime(path)
-	})
 }
 
-// ProcessSumUpdate recalculates checksum when file mtime exceeds stored
-// sumtime (or when attributes are missing / malformed).
 func ProcessSumUpdate(dir string) error {
-	return walkAndProcess(dir, func(path string, info os.FileInfo) error {
+    return walkAndProcess(dir, func(p string, info os.FileInfo) error {
-		needUpdate := false
+        t, err := readSumTime(p)
-		t, err := readSumTime(path)
         if err != nil || info.ModTime().After(t) {
-			needUpdate = true
+            return writeChecksumAndTime(p)
-		}
-		if needUpdate {
-			if verbose {
-				log.Printf("update %s", path)
-			}
-			return writeChecksumAndTime(path)
         }
         return nil
     })
@@ -115,10 +101,17 @@ func writeChecksumAndTime(path string) error {
     if err := xattr.Set(path, checksumKey, hash); err != nil {
         return fmt.Errorf("set checksum attr: %w", err)
     }
-	nowStr := time.Now().UTC().Format(time.RFC3339Nano)
+    if verbose {
-	if err := xattr.Set(path, sumTimeKey, []byte(nowStr)); err != nil {
+        fmt.Printf("%s %s written\n", path, hash)
+    }
+
+    ts := time.Now().UTC().Format(time.RFC3339Nano)
+    if err := xattr.Set(path, sumTimeKey, []byte(ts)); err != nil {
         return fmt.Errorf("set sumtime attr: %w", err)
     }
+    if verbose {
+        fmt.Printf("%s %s written\n", path, ts)
+    }
     return nil
 }
 
@@ -131,68 +124,105 @@ func readSumTime(path string) (time.Time, error) {
 }
 
 ///////////////////////////////////////////////////////////////////////////////
-// Check operation
+// Clear command
+///////////////////////////////////////////////////////////////////////////////
+
+func newClearCmd() *cobra.Command {
+    return &cobra.Command{
+        Use:   "clear <dir>",
+        Short: "Remove checksum xattrs from tree",
+        Args:  cobra.ExactArgs(1),
+        RunE: func(_ *cobra.Command, a []string) error { return ProcessClear(a[0]) },
+    }
+}
+
+func ProcessClear(dir string) error {
+    return walkAndProcess(dir, func(p string, _ os.FileInfo) error {
+        for _, k := range []string{checksumKey, sumTimeKey} {
+            v, err := xattr.Get(p, k)
+            if err != nil {
+                if errors.Is(err, xattr.ENOATTR) {
+                    continue
+                }
+                return err
+            }
+            if verbose {
+                fmt.Printf("%s %s removed\n", p, string(v))
+            }
+            if err := xattr.Remove(p, k); err != nil {
+                return err
+            }
+        }
+        return nil
+    })
+}
+
+///////////////////////////////////////////////////////////////////////////////
+// Check command
 ///////////////////////////////////////////////////////////////////////////////
 
 func newCheckCmd() *cobra.Command {
     var cont bool
-
     cmd := &cobra.Command{
-		Use:   "check <directory>",
+        Use:   "check <dir>",
-		Short: "Verify stored checksums against file contents",
+        Short: "Verify stored checksums",
         Args:  cobra.ExactArgs(1),
-		RunE: func(_ *cobra.Command, args []string) error {
+        RunE: func(_ *cobra.Command, a []string) error { return ProcessCheck(a[0], cont) },
-			return ProcessCheck(args[0], cont)
-		},
     }
-
+    cmd.Flags().BoolVar(&cont, "continue", false, "continue after errors and report each file")
-	cmd.Flags().BoolVar(&cont, "continue", false,
-		"continue after errors and report each file")
     return cmd
 }
 
-// ProcessCheck verifies checksums and exits non-zero on first error unless
-// --continue is supplied.
 func ProcessCheck(dir string, cont bool) error {
-	exitErr := errors.New("verification failed")
+    fail := errors.New("verification failed")
+    bad := false
 
-	err := walkAndProcess(dir, func(path string, info os.FileInfo) error {
+    err := walkAndProcess(dir, func(p string, _ os.FileInfo) error {
-		exp, err := xattr.Get(path, checksumKey)
+        exp, err := xattr.Get(p, checksumKey)
         if err != nil {
             if errors.Is(err, xattr.ENOATTR) {
-				log.Printf("ERROR missing xattr %s", path)
+                bad = true
+                if verbose {
+                    fmt.Printf("%s <none> ERROR\n", p)
+                }
                 if cont {
                     return nil
                 }
-				return exitErr
+                return fail
             }
             return err
         }
 
-		act, err := fileMultihash(path)
+        act, err := fileMultihash(p)
         if err != nil {
             return err
         }
-
+        ok := bytes.Equal(exp, act)
-		if !bytes.Equal(exp, act) {
+        if !ok {
-			log.Printf("ERROR checksum mismatch %s", path)
+            bad = true
-			if cont {
-				return nil
         }
-			return exitErr
+        if verbose {
+            status := "OK"
+            if !ok {
+                status = "ERROR"
             }
-		if cont {
+            fmt.Printf("%s %s %s\n", p, act, status)
-			fmt.Printf("OK %s\n", path)
+        }
+        if !ok && !cont {
+            return fail
         }
         return nil
     })
 
     if err != nil {
-		if errors.Is(err, exitErr) {
+        if errors.Is(err, fail) {
-			return exitErr
+            return fail
         }
         return err
     }
+    if bad {
+        return fail
+    }
     return nil
 }
 
@@ -201,23 +231,68 @@ func ProcessCheck(dir string, cont bool) error {
 ///////////////////////////////////////////////////////////////////////////////
 
 func walkAndProcess(root string, fn func(string, os.FileInfo) error) error {
-	return filepath.Walk(root, func(path string, info os.FileInfo, err error) error {
+    root = filepath.Clean(root)
+    return filepath.Walk(root, func(p string, info os.FileInfo, err error) error {
         if err != nil {
             return err
         }
+
+        // skip symlinks entirely
+        if info.Mode()&os.ModeSymlink != 0 {
+            if verbose {
+                log.Printf("skip symlink %s", p)
+            }
+            if info.IsDir() {
+                return filepath.SkipDir
+            }
+            return nil
+        }
+
+        rel, _ := filepath.Rel(root, p)
+        if shouldExclude(rel, info) {
+            if info.IsDir() {
+                return filepath.SkipDir
+            }
+            return nil
+        }
+
         if info.IsDir() {
             return nil
         }
-		return fn(path, info)
+        if !info.Mode().IsRegular() {
+            if verbose {
+                log.Printf("skip non-regular %s", p)
+            }
+            return nil
+        }
+        return fn(p, info)
     })
 }
 
+func shouldExclude(rel string, info os.FileInfo) bool {
+    if rel == "." || rel == "" {
+        return false
+    }
+    if excludeDotfiles {
+        for _, part := range strings.Split(rel, string(os.PathSeparator)) {
+            if strings.HasPrefix(part, ".") {
+                return true
+            }
+        }
+    }
+    for _, pat := range excludePatterns {
+        if ok, _ := doublestar.PathMatch(pat, rel); ok {
+            return true
+        }
+    }
+    return false
+}
+
 func hasXattr(path, key string) bool {
     _, err := xattr.Get(path, key)
     return err == nil
 }
 
-// fileMultihash returns the base58-encoded SHA-2-256 multihash of the file.
 func fileMultihash(path string) ([]byte, error) {
     f, err := os.Open(path)
     if err != nil {
@@ -229,7 +304,6 @@ func fileMultihash(path string) ([]byte, error) {
     if _, err := io.Copy(h, f); err != nil {
         return nil, err
     }
-
     mh, err := multihash.Encode(h.Sum(nil), multihash.SHA2_256)
     if err != nil {
         return nil, err

attrsum_test.go

@@ -10,7 +10,6 @@ import (
 	"github.com/pkg/xattr"
 )
 
-// skipIfNoXattr skips tests when the underlying FS lacks xattr support.
 func skipIfNoXattr(t *testing.T, path string) {
 	if err := xattr.Set(path, "user.test", []byte("1")); err != nil {
 		t.Skipf("skipping: xattr not supported: %v", err)
@@ -21,14 +20,14 @@ func skipIfNoXattr(t *testing.T, path string) {
 
 func writeFile(t *testing.T, root, name, content string) string {
 	t.Helper()
-	path := filepath.Join(root, name)
+	p := filepath.Join(root, name)
-	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(p), 0o755); err != nil {
 		t.Fatalf("mkdir: %v", err)
 	}
-	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+	if err := os.WriteFile(p, []byte(content), 0o644); err != nil {
 		t.Fatalf("write: %v", err)
 	}
-	return path
+	return p
 }
 
 func TestSumAddAndUpdate(t *testing.T) {
@@ -37,29 +36,19 @@ func TestSumAddAndUpdate(t *testing.T) {
 
 	f := writeFile(t, dir, "a.txt", "hello")
 
-	// Add: write missing checksum.
 	if err := ProcessSumAdd(dir); err != nil {
 		t.Fatalf("add: %v", err)
 	}
-
-	// Attributes should exist.
 	if _, err := xattr.Get(f, checksumKey); err != nil {
 		t.Fatalf("checksum missing: %v", err)
 	}
-	tsb, err := xattr.Get(f, sumTimeKey)
+	tsb, _ := xattr.Get(f, sumTimeKey)
-	if err != nil {
-		t.Fatalf("sumtime missing: %v", err)
-	}
 	origTime, _ := time.Parse(time.RFC3339Nano, string(tsb))
 
-	// Modify file and bump mtime.
+	os.WriteFile(f, []byte(strings.ToUpper("hello")), 0o644)
-	if err := os.WriteFile(f, []byte(strings.ToUpper("hello")), 0o644); err != nil {
-		t.Fatalf("rewrite: %v", err)
-	}
 	now := time.Now().Add(2 * time.Second)
 	os.Chtimes(f, now, now)
 
-	// Update should refresh checksum and time.
 	if err := ProcessSumUpdate(dir); err != nil {
 		t.Fatalf("update: %v", err)
 	}
@@ -78,12 +67,10 @@ func TestProcessCheckIntegration(t *testing.T) {
 	if err := ProcessSumAdd(dir); err != nil {
 		t.Fatalf("add: %v", err)
 	}
-
 	if err := ProcessCheck(dir, false); err != nil {
 		t.Fatalf("check ok: %v", err)
 	}
 
-	// Corrupt file contents should produce an error.
 	f := filepath.Join(dir, "b.txt")
 	os.WriteFile(f, []byte("corrupt"), 0o644)
 
@@ -92,6 +79,74 @@ func TestProcessCheckIntegration(t *testing.T) {
 	}
 }
 
+func TestClearRemovesAttrs(t *testing.T) {
+	dir := t.TempDir()
+	skipIfNoXattr(t, dir)
+
+	f := writeFile(t, dir, "c.txt", "data")
+	if err := ProcessSumAdd(dir); err != nil {
+		t.Fatalf("add: %v", err)
+	}
+
+	if err := ProcessClear(dir); err != nil {
+		t.Fatalf("clear: %v", err)
+	}
+	if _, err := xattr.Get(f, checksumKey); err == nil {
+		t.Fatalf("checksum still present after clear")
+	}
+	if _, err := xattr.Get(f, sumTimeKey); err == nil {
+		t.Fatalf("sumtime still present after clear")
+	}
+}
+
+func TestExcludeDotfilesAndPatterns(t *testing.T) {
+	dir := t.TempDir()
+	skipIfNoXattr(t, dir)
+
+	hidden := writeFile(t, dir, ".hidden", "dot")
+	keep := writeFile(t, dir, "keep.txt", "keep")
+	skip := writeFile(t, dir, "skip.me", "skip")
+
+	oldDot := excludeDotfiles
+	oldPat := excludePatterns
+	excludeDotfiles = true
+	excludePatterns = []string{"*.me"}
+	defer func() { excludeDotfiles, excludePatterns = oldDot, oldPat }()
+
+	if err := ProcessSumAdd(dir); err != nil {
+		t.Fatalf("add with excludes: %v", err)
+	}
+
+	if _, err := xattr.Get(keep, checksumKey); err != nil {
+		t.Fatalf("expected xattr on keep.txt: %v", err)
+	}
+	if _, err := xattr.Get(hidden, checksumKey); err == nil {
+		t.Fatalf(".hidden should have been excluded")
+	}
+	if _, err := xattr.Get(skip, checksumKey); err == nil {
+		t.Fatalf("skip.me should have been excluded")
+	}
+}
+
+func TestSkipBrokenSymlink(t *testing.T) {
+	dir := t.TempDir()
+	skipIfNoXattr(t, dir)
+
+	// Create a dangling symlink
+	link := filepath.Join(dir, "dangling.lnk")
+	if err := os.Symlink(filepath.Join(dir, "nonexistent.txt"), link); err != nil {
+		t.Fatalf("symlink: %v", err)
+	}
+
+	// Should not error and should not create xattrs on link
+	if err := ProcessSumAdd(dir); err != nil {
+		t.Fatalf("ProcessSumAdd with symlink: %v", err)
+	}
+	if _, err := xattr.Get(link, checksumKey); err == nil {
+		t.Fatalf("symlink should not have xattr")
+	}
+}
+
 func TestPermissionErrors(t *testing.T) {
 	dir := t.TempDir()
 	skipIfNoXattr(t, dir)

go.mod

@@ -3,6 +3,8 @@ module git.eeqj.de/sneak/attrsum
 go 1.24.1
 
 require (
+	github.com/bmatcuk/doublestar/v4 v4.8.1
+	github.com/mr-tron/base58 v1.2.0
 	github.com/multiformats/go-multihash v0.2.3
 	github.com/pkg/xattr v0.4.10
 	github.com/spf13/cobra v1.9.1
@@ -12,7 +14,6 @@ require (
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/klauspost/cpuid/v2 v2.0.9 // indirect
 	github.com/minio/sha256-simd v1.0.0 // indirect
-	github.com/mr-tron/base58 v1.2.0 // indirect
 	github.com/multiformats/go-varint v0.0.6 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.6 // indirect

go.sum

@@ -1,3 +1,5 @@
+github.com/bmatcuk/doublestar/v4 v4.8.1 h1:54Bopc5c2cAvhLRAzqOGCYHYyhcDHsFF4wWIR5wKP38=
+github.com/bmatcuk/doublestar/v4 v4.8.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=