2026-04-21 - 2026-10-21
Overview
4 Releases published by 1 user
Published
v1.0.0-rc4
Published
v1.0.0-rc3
Published
v1.0.0-rc2
Published
v1.0.0-rc1
84 Pull requests merged by 2 users
Merged
#238 Export the loaded manifest type as Manifest (closes #236)
Merged
#237 Drop mimeType and ctime from the manifest format (closes #235)
Merged
#234 Never list index.mf at the top of the tree in gen and freshen (closes #233)
Merged
#232 Never report index.mf at the top of the base as unlisted in check (closes #229)
Merged
#231 Describe releases as SemVer git tags in the README (closes #226)
Merged
#230 Refuse a manifest entry whose mode is above 0777 on load (closes #225)
Merged
#227 Load the manifest check downloads from memory, not a temp file (closes #223)
Merged
#228 Require a SHA-256 hash in every manifest entry (closes #224)
Merged
#222 Return the context's error when it ends during a fetch request (closes #221)
Merged
#220 Sign or timestamp an unchanged tree's manifest in freshen (closes #190)
Merged
#217 Finish docs/FORMAT.md as a specification with a test vector (closes #84)
Merged
#218 Refuse a file whose size changed between freshen's scan and hash (closes #207)
Merged
#216 Refuse an empty --require-signature or --sign-key (closes #205)
Merged
#215 Send fetch progress at most once per second (closes #206)
Merged
#214 Refuse a path with a . segment (closes #208)
Merged
#213 Refuse a signature made when its key was not valid (closes #209)
Merged
#212 Report only symlinks to regular files as extra files in check (closes #192)
Merged
#211 Read a path or URL named help or h as an argument (closes #198)
Merged
#204 Take the version from the git tag, not a constant (closes #80)
Merged
#203 Refuse to freshen a signed manifest without --sign-key (closes #191)
Merged
#219 Hold runMu in internal/cli tests that log outside a CLI run (closes #210)
Merged
#201 Refuse an expired signature whose key has expired too (closes #193)
Merged
#202 Refuse a file entry with no hash when loading a manifest (closes #194)
Merged
#200 Log failed files at error level so check -q shows them (closes #195)
Merged
#199 Read only regular files in gen, freshen and check (closes #189)
Merged
#188 Describe the signature scheme in docs/FORMAT.md as the code builds it (closes #187)
Merged
#197 Read options after the path or URL and refuse a second argument (closes #196)
Merged
#183 Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)
Merged
#184 List a file given to Scanner.EnumeratePath by its name (closes #182)
Merged
#186 List a directory named through a symlink in gen and freshen (closes #185)
Merged
#180 Write gen DIR's manifest to DIR/index.mf (closes #178)
Merged
#179 Resolve check and freshen paths against the manifest's directory (closes #177)
Merged
#176 Make error message wording consistent (closes #165)
Merged
#175 Link docs/FORMAT.md as the format specification in the README (closes #166)
Merged
#174 Refuse a path listed twice in a manifest (closes #170)
Merged
#173 Refuse a manifest whose inner message version is not one (closes #169)
Merged
#172 Limit how much fetch and check read for a manifest or a file (closes #168)
Merged
#171 Compare --require-signature with the key that signed (closes #167)
Merged
#164 Raise Go to the latest release, update dependencies, use the standard library uuid, add a vulnerability check (closes #102)
Merged
#163 Record file mode in the manifest, 0000 unless asked (closes #161)
Merged
#162 Re-vendor the canonical files from sneak/prompts dd4027b (closes #159, closes #116)
Merged
#160 Drop atime from the format spec and pin the file entry fields (closes #158)
Merged
#157 fetch refuses a manifest whose paths differ only in letter case (closes #154)
Merged
#156 Move the CLI to urfave/cli v3 (closes #110)
Merged
#155 Pin the remaining developer tool installs (closes #68)
Merged
#153 fetch refuses a manifest that lists another file's temp name (closes #151)
Merged
#152 Makefile: thin shims only, add make build (closes #73)
Merged
#150 fetch: destination directory, skip files already present, save the manifest, require a signer (closes #101)
Merged
#149 Check Go formatting with gofumpt, as make fmt writes it (closes #70)
Merged
#146 check always warns about files the manifest does not list (closes #103)
Merged
#148 Move FORMAT.md to docs/ and contrib/ to bin/, fix bash script style (closes #74)
Merged
#145 End-to-end tests for freshen and fetch (closes #66)
Merged
#141 Move internal/log from apex/log to log/slog (closes #77)
Merged
#144 Set go_package to the sneak.berlin/go/mfer module path (closes #79)
Merged
#142 fetch: client timeout, retry with backoff, url.JoinPath (closes #63)
Merged
#143 check waits for its progress output before the summary (closes #140)
Merged
#139 AddFileWithHash rejects hashes that are not multihashes (closes #129)
Merged
#136 Default the manifest to index.mf and keep it out of its own listing (closes #100)
Merged
#138 Never regenerate mf.pb.go during checks; fail when it is stale (closes #71)
Merged
#137 NewChecker takes CheckerOptions instead of positional arguments (closes #78)
Merged
#128 Reject manifests whose file entries decode far larger than their bytes (closes #123)
Merged
#134 Count -v once and document -v -v for debug output (closes #125)
Merged
#133 Give the image CA certificates so fetch works over HTTPS (closes #131)
Merged
#132 Scanner status tests no longer depend on a 100 ms timer (closes #124)
Merged
#127 Run all linting in Docker via the Dockerfile lint stage (closes #90)
Merged
#130 Build a static binary so the scratch image runs (closes #126)
Merged
#105 Add the required README sections (closes #75)
Merged
#107 Give -v to verbose, move --version to -V (closes #64)
Merged
#120 Fuzz NewManifestFromReader and cap the zstd decoder (closes #65)
Merged
#119 Enforce real timeouts on gpg subprocess calls (closes #62)
Merged
#122 Remove TODO.md; track open work in the issues (closes #76)
Merged
#117 Pin CLI error messages by driving their real call sites (closes #87)
Merged
#106 cibuild: build with --no-cache like script/docker (closes #89)
Merged
#118 Never write fetch's temp file into an existing file (closes #115)
Merged
#114 Refuse fetch writes through a symlink in the destination (closes #86)
Merged
#113 Stamp the tag or short commit in a plain docker build (closes #112)
Merged
#108 Validate manifest entry paths on deserialize (closes #61)
Merged
#109 Rewrite script/test to the canonical race-enabled pattern (closes #67)
Merged
#104 Add .editorconfig, broaden .gitignore, drop dead Drone refs (closes #72)
Merged
#88 Configure prettier and make fmt-check cover markdown (closes #69)
Merged
#59 Update golangci-lint to v2.12.2 with canonical config (closes #60)
Merged
#58 scripts-to-rule-them-all
Merged
#57 TODO
Merged
#56 move to standardized repo policies
1 Pull request proposed by 1 user
Proposed
#92 1.0.0 milestone
94 Issues closed from 1 user
Closed
#236 Export the loaded manifest type as Manifest, or an interface in front of it?
Closed
#147 DECISION: mfer does not import simplelog
Closed
#235 Drop mimeType and ctime from the format: 1.0 writes neither
Closed
#83 DECISION: public API surface and determinism defaults for 1.0
Closed
#81 DECISION: wire format questions blocking the 1.0 format freeze
Closed
#233 gen and freshen list an index.mf at the top of the tree when writing the manifest elsewhere, and fetch then refuses the manifest
Closed
#229 check given a URL reports the index.mf that fetch saved as an extra file, so a fetched tree fails --no-extra-files
Closed
#226 README says the project is pre-1.0 with no versioned release, in the tree v1.0.0 is tagged from
Closed
#225 A manifest recording a mode above 0777 loads; check then fails every such file as MODE_MISMATCH
Closed
#223 mfer check given a URL fails in the Docker image: the scratch image has no /tmp and check writes the downloaded manifest to a temp file
Closed
#224 An entry whose hashes hold no SHA-256 multihash loads, and check and fetch then report the intact file as a hash mismatch
Closed
#221 next is intermittently red: TestGetStopsWaitingWhenCanceled gets the 503 instead of the deadline when a request outlasts it
Closed
#190 freshen --sign-key leaves the manifest unsigned when no file changed
Closed
#84 Make docs/FORMAT.md a complete, independently-implementable specification
Closed
#207 freshen records a file's size from the scan with the hash of what it reads later, so a file that changes in between gets an entry check can never pass
Closed
#205 An empty --require-signature or --sign-key value is taken as the flag not given, so check --require-signature "" passes an unsigned manifest
Closed
#206 fetch prints a progress line for every 32 KiB it downloads
Closed
#208 A path with a . segment loads, so check reports the file it names as an extra file
Closed
#209 A signature made after its key expired, or before the key was made, is accepted
Closed
#192 check reports symlinks gen never lists as extra files, so --no-extra-files cannot pass on a tree with a directory symlink
Closed
#198 A path named help or h runs the help instead of the command, so check help --require-signature FPR passes
Closed
#80 Release mechanics for v1.0.0: version single-sourcing and tag
Closed
#191 freshen rewrites a signed manifest unsigned when --sign-key is not given
Closed
#210 next is red: TestCheckQuietShowsFailedFiles catches log lines from tests running outside runMu
Closed
#193 An expired signature is accepted when its signing key has expired too
Closed
#194 Loading accepts a file entry with no hashes
Closed
#195 check -q hides which files failed
Closed
#189 gen and freshen hang forever on a named pipe inside the tree
Closed
#187 Describe the signature scheme in docs/FORMAT.md as the code builds it
Closed
#196 Options after the path or URL are ignored, so check DIR --require-signature FPR passes an unsigned manifest
Closed
#181 Sign and verify manifests in Go with OpenPGP instead of running gpg
Closed
#182 Scanner.EnumeratePath given a file lists it under an empty path
Closed
#185 gen and freshen list no files when the directory is reached through a symlink
Closed
#178 DECISION: where gen DIR writes its manifest and how it lists the files
Closed
#82 DECISION: signature scheme questions blocking 1.0
Closed
#177 check and freshen resolve a manifest's paths against the current directory, not the manifest's
Closed
#165 Make error message wording consistent across mfer/ and internal/cli/
Closed
#166 README links mf.proto as the format specification instead of docs/FORMAT.md
Closed
#170 A manifest can list the same path twice
Closed
#169 Loading a manifest ignores the inner message version
Closed
#168 Nothing limits how much fetch and check read from a server for a manifest or a file
Closed
#167 --require-signature accepts a manifest signed by a key other than the required one
Closed
#102 Raise Go to the latest release, update dependencies, use the standard library UUID, add a vulnerability check
Closed
#161 Record file mode in the manifest: 0000 by default, real permissions on request
Closed
#116 golangci-lint warns that gomodguard is deprecated in favour of gomodguard_v2
Closed
#159 Re-vendor the canonical files from sneak/prompts at dd4027b
Closed
#158 Drop atime from the format (ruling on question 3 of the wire format decisions)
Closed
#154 fetch: two listed files whose names differ only in letter case replace each other on a case-insensitive filesystem
Closed
#110 Move the CLI from urfave/cli v2 to v3
Closed
#68 Pin every developer tool install by hash; make local lint match CI
Closed
#151 fetch: a listed file at another listed file's temp name is deleted, and fetch still exits 0
Closed
#73 Clean up the Makefile: add make build, remove superseded targets
Closed
#101 fetch: destination directory, skip files already present, save the manifest, require a signer
Closed
#121 Decide whether AGENTS.md may stay in the repo root
Closed
#70 Verify Go formatting with gofumpt, not gofmt, so fmt and check agree
Closed
#103 check: always warn about files on disk that are not in the manifest, dotfiles included
Closed
#74 Repo root hygiene: move FORMAT.md to docs/, contrib/ to bin/, fix bash script style
Closed
#66 Add real end-to-end tests for the freshen and fetch commands
Closed
#77 Migrate internal/log from apex/log to log/slog
Closed
#79 DECISION: canonical Go module path for 1.0
Closed
#63 Harden fetch: client timeout, retry with backoff, url.JoinPath
Closed
#140 mfer check exits without waiting for its progress output
Closed
#129 Builder.AddFileWithHash accepts a hash that is not a multihash
Closed
#100 Default manifest filename is index.mf; the scanner excludes the output file (sneak: option A)
Closed
#71 make check must not modify tracked files (ensure_pb regenerates mf.pb.go on mtime)
Closed
#78 Change NewChecker to take a Params struct instead of positional arguments
Closed
#123 Decoding file entries can allocate about 60 times MaxDecompressedSize
Closed
#125 -vv is refused although the -v help text promises it
Closed
#131 The Docker image has no CA certificates, so fetch over HTTPS fails
Closed
#124 Scanner status tests fail under host load on a 100 ms timer
Closed
#90 Run all linting in Docker via Dockerfile.lint + script/lint
Closed
#126 The Docker image cannot run: its binary is dynamically linked in a scratch image
Closed
#75 Add the required README sections (Getting Started, Rationale, Design, Author)
Closed
#64 Fix -v flag collision between --verbose and --version
Closed
#65 Add fuzz coverage for NewManifestFromReader
Closed
#62 Enforce real timeouts on gpg subprocess calls
Closed
#76 Rewrite the stale TODO tracking in README.md and TODO.md to match reality
Closed
#87 Pin CLI error messages through their real call sites, not reconstructed format strings
Closed
#89 script/cibuild reports a green it did not earn: make check is served from Docker cache
Closed
#115 fetch: a hard link at the temp file's name lets fetch overwrite a file outside the destination
Closed
#86 fetch: sanitizePath is purely lexical and does not prevent symlink escape
Closed
#85 Stale branch cleanup: three unmerged branches, none worth keeping as-is
Closed
#93 Gitea Actions runner is not picking up jobs: every run since 2026-08-09 is stuck "Waiting to run"
Closed
#112 docker build . stamps dev, not the git tag or short commit
Closed
#111 Run every build, test and lint step in the Dockerfiles at nice -n 19
Closed
#61 Validate manifest paths on read, not only on write (path traversal in Checker)
Closed
#67 Rewrite script/test to the canonical pattern (30s timeout, -race -cover, conditional verbose rerun)
Closed
#72 Add .editorconfig and make .gitignore comprehensive
Closed
#98 script/cibuild header comment claims the Dockerfile runs make check; it does not
Closed
#94 AGENTS.md does not document the next-branch workflow, so every agent defaults to branching off main
Closed
#97 script/docker and make docker still bare-build, so they can serve cached checks
Closed
#91 TOP PRIORITY: consolidate all open PRs onto one next branch, one PR
Closed
#69 Add .prettierrc/.prettierignore, stop reformatting REPO_POLICIES.md, and make fmt-check cover markdown
Closed
#60 Adopt golangci-lint v2.12.2 and the canonical .golangci.yml
95 Issues created by 1 user
Opened
#60 Adopt golangci-lint v2.12.2 and the canonical .golangci.yml
Opened
#61 Validate manifest paths on read, not only on write (path traversal in Checker)
Opened
#62 Enforce real timeouts on gpg subprocess calls
Opened
#63 Harden fetch: client timeout, retry with backoff, url.JoinPath
Opened
#64 Fix -v flag collision between --verbose and --version
Opened
#65 Add fuzz coverage for NewManifestFromReader
Opened
#66 Add real end-to-end tests for the freshen and fetch commands
Opened
#67 Rewrite script/test to the canonical pattern (30s timeout, -race -cover, conditional verbose rerun)
Opened
#68 Pin every developer tool install by hash; make local lint match CI
Opened
#69 Add .prettierrc/.prettierignore, stop reformatting REPO_POLICIES.md, and make fmt-check cover markdown
Opened
#70 Verify Go formatting with gofumpt, not gofmt, so fmt and check agree
Opened
#71 make check must not modify tracked files (ensure_pb regenerates mf.pb.go on mtime)
Opened
#72 Add .editorconfig and make .gitignore comprehensive
Opened
#73 Clean up the Makefile: add make build, remove superseded targets
Opened
#74 Repo root hygiene: move FORMAT.md to docs/, contrib/ to bin/, fix bash script style
Opened
#75 Add the required README sections (Getting Started, Rationale, Design, Author)
Opened
#76 Rewrite the stale TODO tracking in README.md and TODO.md to match reality
Opened
#77 Migrate internal/log from apex/log to log/slog
Opened
#78 Change NewChecker to take a Params struct instead of positional arguments
Opened
#79 DECISION: canonical Go module path for 1.0
Opened
#80 Release mechanics for v1.0.0: version single-sourcing and tag
Opened
#81 DECISION: wire format questions blocking the 1.0 format freeze
Opened
#82 DECISION: signature scheme questions blocking 1.0
Opened
#83 DECISION: public API surface and determinism defaults for 1.0
Opened
#84 Make docs/FORMAT.md a complete, independently-implementable specification
Opened
#85 Stale branch cleanup: three unmerged branches, none worth keeping as-is
Opened
#86 fetch: sanitizePath is purely lexical and does not prevent symlink escape
Opened
#87 Pin CLI error messages through their real call sites, not reconstructed format strings
Opened
#89 script/cibuild reports a green it did not earn: make check is served from Docker cache
Opened
#90 Run all linting in Docker via Dockerfile.lint + script/lint
Opened
#91 TOP PRIORITY: consolidate all open PRs onto one next branch, one PR
Opened
#93 Gitea Actions runner is not picking up jobs: every run since 2026-08-09 is stuck "Waiting to run"
Opened
#94 AGENTS.md does not document the next-branch workflow, so every agent defaults to branching off main
Opened
#97 script/docker and make docker still bare-build, so they can serve cached checks
Opened
#98 script/cibuild header comment claims the Dockerfile runs make check; it does not
Opened
#99 Review toward 1.0: identify and file all next steps
Opened
#100 Default manifest filename is index.mf; the scanner excludes the output file (sneak: option A)
Opened
#101 fetch: destination directory, skip files already present, save the manifest, require a signer
Opened
#102 Raise Go to the latest release, update dependencies, use the standard library UUID, add a vulnerability check
Opened
#103 check: always warn about files on disk that are not in the manifest, dotfiles included
Opened
#110 Move the CLI from urfave/cli v2 to v3
Opened
#111 Run every build, test and lint step in the Dockerfiles at nice -n 19
Opened
#112 docker build . stamps dev, not the git tag or short commit
Opened
#115 fetch: a hard link at the temp file's name lets fetch overwrite a file outside the destination
Opened
#116 golangci-lint warns that gomodguard is deprecated in favour of gomodguard_v2
Opened
#121 Decide whether AGENTS.md may stay in the repo root
Opened
#123 Decoding file entries can allocate about 60 times MaxDecompressedSize
Opened
#124 Scanner status tests fail under host load on a 100 ms timer
Opened
#125 -vv is refused although the -v help text promises it
Opened
#126 The Docker image cannot run: its binary is dynamically linked in a scratch image
Opened
#129 Builder.AddFileWithHash accepts a hash that is not a multihash
Opened
#131 The Docker image has no CA certificates, so fetch over HTTPS fails
Opened
#140 mfer check exits without waiting for its progress output
Opened
#147 DECISION: mfer does not import simplelog
Opened
#151 fetch: a listed file at another listed file's temp name is deleted, and fetch still exits 0
Opened
#154 fetch: two listed files whose names differ only in letter case replace each other on a case-insensitive filesystem
Opened
#158 Drop atime from the format (ruling on question 3 of the wire format decisions)
Opened
#159 Re-vendor the canonical files from sneak/prompts at dd4027b
Opened
#161 Record file mode in the manifest: 0000 by default, real permissions on request
Opened
#165 Make error message wording consistent across mfer/ and internal/cli/
Opened
#166 README links mf.proto as the format specification instead of docs/FORMAT.md
Opened
#167 --require-signature accepts a manifest signed by a key other than the required one
Opened
#168 Nothing limits how much fetch and check read from a server for a manifest or a file
Opened
#169 Loading a manifest ignores the inner message version
Opened
#170 A manifest can list the same path twice
Opened
#177 check and freshen resolve a manifest's paths against the current directory, not the manifest's
Opened
#178 DECISION: where gen DIR writes its manifest and how it lists the files
Opened
#181 Sign and verify manifests in Go with OpenPGP instead of running gpg
Opened
#182 Scanner.EnumeratePath given a file lists it under an empty path
Opened
#185 gen and freshen list no files when the directory is reached through a symlink
Opened
#187 Describe the signature scheme in docs/FORMAT.md as the code builds it
Opened
#189 gen and freshen hang forever on a named pipe inside the tree
Opened
#190 freshen --sign-key leaves the manifest unsigned when no file changed
Opened
#191 freshen rewrites a signed manifest unsigned when --sign-key is not given
Opened
#192 check reports symlinks gen never lists as extra files, so --no-extra-files cannot pass on a tree with a directory symlink
Opened
#193 An expired signature is accepted when its signing key has expired too
Opened
#194 Loading accepts a file entry with no hashes
Opened
#195 check -q hides which files failed
Opened
#196 Options after the path or URL are ignored, so check DIR --require-signature FPR passes an unsigned manifest
Opened
#198 A path named help or h runs the help instead of the command, so check help --require-signature FPR passes
Opened
#208 A path with a . segment loads, so check reports the file it names as an extra file
Opened
#207 freshen records a file's size from the scan with the hash of what it reads later, so a file that changes in between gets an entry check can never pass
Opened
#206 fetch prints a progress line for every 32 KiB it downloads
Opened
#205 An empty --require-signature or --sign-key value is taken as the flag not given, so check --require-signature "" passes an unsigned manifest
Opened
#209 A signature made after its key expired, or before the key was made, is accepted
Opened
#210 next is red: TestCheckQuietShowsFailedFiles catches log lines from tests running outside runMu
Opened
#221 next is intermittently red: TestGetStopsWaitingWhenCanceled gets the 503 instead of the deadline when a request outlasts it
Opened
#223 mfer check given a URL fails in the Docker image: the scratch image has no /tmp and check writes the downloaded manifest to a temp file
Opened
#224 An entry whose hashes hold no SHA-256 multihash loads, and check and fetch then report the intact file as a hash mismatch
Opened
#225 A manifest recording a mode above 0777 loads; check then fails every such file as MODE_MISMATCH
Opened
#226 README says the project is pre-1.0 with no versioned release, in the tree v1.0.0 is tagged from
Opened
#229 check given a URL reports the index.mf that fetch saved as an extra file, so a fetched tree fails --no-extra-files
Opened
#233 gen and freshen list an index.mf at the top of the tree when writing the manifest elsewhere, and fetch then refuses the manifest
Opened
#235 Drop mimeType and ctime from the format: 1.0 writes neither
Opened
#236 Export the loaded manifest type as Manifest, or an interface in front of it?