AddFileWithHash rejects hashes that are not multihashes (closes #129)

AddFileWithHash took any non-empty bytes as a hash, so the builder could
write a manifest that mfer refuses to load. It now decodes the hash with
go-multihash and also requires a digest of at least 32 bytes, the SHA-256
length the reader's decoding-cost limit assumes: a valid but shorter
multihash, such as an empty identity hash or SHA-1, still makes a
manifest of one-character paths too costly to load. When mfer freshen
meets such a hash in an existing manifest, its error names the manifest
entry and says to regenerate the manifest with mfer generate. Test
fixtures whose stand-in hashes were not valid multihashes now use a
SHA-256 multihash.

Model: opus-5-5

mfer/builder_test.go

@@ -4,12 +4,14 @@ package mfer
 import (
 	"bytes"
 	"context"
+	"crypto/sha256"
 	"fmt"
 	"path/filepath"
 	"strings"
 	"testing"
 	"time"
 
+	"github.com/multiformats/go-multihash"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -44,9 +46,10 @@ func TestBuilderAddFileWithHash(t *testing.T) {
 	t.Parallel()
 
 	b := NewBuilder()
-	hash := make([]byte, 34) // SHA256 multihash is 34 bytes
+	hash, err := multihash.Encode(make([]byte, sha256.Size), multihash.SHA2_256)
+	require.NoError(t, err)
 
-	err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), hash)
+	err = b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), hash)
 	require.NoError(t, err)
 	assert.Equal(t, 1, b.FileCount())
 }
@@ -54,12 +57,14 @@ func TestBuilderAddFileWithHash(t *testing.T) {
 func TestBuilderAddFileWithHashValidation(t *testing.T) {
 	t.Parallel()
 
+	sha256Hash, err := multihash.Encode(make([]byte, sha256.Size), multihash.SHA2_256)
+	require.NoError(t, err)
+
 	t.Run("empty path", func(t *testing.T) {
 		t.Parallel()
 
 		b := NewBuilder()
-		hash := make([]byte, 34)
-		err := b.AddFileWithHash("", 100, ModTime(time.Now()), hash)
+		err := b.AddFileWithHash("", 100, ModTime(time.Now()), sha256Hash)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "path")
 	})
@@ -68,41 +73,58 @@ func TestBuilderAddFileWithHashValidation(t *testing.T) {
 		t.Parallel()
 
 		b := NewBuilder()
-		hash := make([]byte, 34)
-		err := b.AddFileWithHash("test.txt", -1, ModTime(time.Now()), hash)
+		err := b.AddFileWithHash("test.txt", -1, ModTime(time.Now()), sha256Hash)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "size")
 	})
 
-	t.Run("nil hash", func(t *testing.T) {
-		t.Parallel()
-
-		b := NewBuilder()
-		err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), nil)
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), "hash")
-	})
-
-	t.Run("empty hash", func(t *testing.T) {
-		t.Parallel()
-
-		b := NewBuilder()
-		err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), []byte{})
-		require.Error(t, err)
-		assert.Contains(t, err.Error(), "hash")
-	})
-
 	t.Run("valid inputs", func(t *testing.T) {
 		t.Parallel()
 
 		b := NewBuilder()
-		hash := make([]byte, 34)
-		err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), hash)
+		err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), sha256Hash)
 		require.NoError(t, err)
 		assert.Equal(t, 1, b.FileCount())
 	})
 }
 
+func TestBuilderAddFileWithHashRejectsBadHashes(t *testing.T) {
+	t.Parallel()
+
+	sha1Hash, err := multihash.Encode(make([]byte, 20), multihash.SHA1)
+	require.NoError(t, err)
+
+	truncatedHash, err := multihash.Encode(make([]byte, sha256.Size-1), multihash.SHA2_256)
+	require.NoError(t, err)
+
+	tests := []struct {
+		name string
+		hash Multihash
+		want error
+	}{
+		{"nil hash", nil, errHashNotMultihash},
+		{"empty hash", []byte{}, errHashNotMultihash},
+		{"one-byte hash", []byte{0x12}, errHashNotMultihash},
+		// A SHA-256 code and 32-byte length, then only two bytes of digest.
+		{"malformed multihash", []byte{0x12, 0x20, 0x01, 0x02}, errHashNotMultihash},
+		// A valid multihash, but its 20-byte SHA-1 digest is too short.
+		{"SHA-1 multihash", sha1Hash, errHashTooShort},
+		// A valid multihash whose 31-byte digest is one byte short.
+		{"31-byte digest", truncatedHash, errHashTooShort},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			b := NewBuilder()
+			err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), tt.hash)
+			require.ErrorIs(t, err, tt.want)
+			assert.Equal(t, 0, b.FileCount())
+		})
+	}
+}
+
 func TestBuilderBuild(t *testing.T) {
 	t.Parallel()
 
@@ -358,7 +380,8 @@ func TestBuilderBuildRoundTrip(t *testing.T) {
 func TestBuilderBuildRoundTripLargeManifest(t *testing.T) {
 	t.Parallel()
 
-	hash := make([]byte, 34) // multihash: 2-byte prefix + 32-byte SHA-256
+	hash, err := multihash.Encode(make([]byte, sha256.Size), multihash.SHA2_256)
+	require.NoError(t, err)
 
 	b := NewBuilder()