7 Commits

Include renames

Author	SHA1	Message	Date
clawbot	51f69c960d	Enforce real timeouts on gpg subprocess calls (closes #62) ... Every gpg run now has a one-minute deadline (gpgTimeout) on top of its caller's context and is killed when either ends. A timeout is reported as "gpg timed out" under the failing operation instead of "signal: killed". Only gpg itself is killed; WaitDelay (one second) stops the run from waiting on a process gpg left behind that still holds its output, such as a wrapper script that does not exec the real gpg. Builder.Build and Checker.ExtractEmbeddedSigningKeyFP take a context, so ToManifest's context now reaches signing and the contextcheck suppression calling signing non-cancellable is gone. Manifest loading takes no context, so its signature check is bounded by the timeout alone. Model: opus-5-5	2026-10-04 04:31:53 +02:00
clawbot	de476708e9	Update golangci-lint to v2.12.2 with canonical config (closes #60) ... Adopts golangci-lint v2.12.2 and the canonical .golangci.yml (default: all), and fixes all resulting findings across the tree. Two intended behavior changes: absent MFFilePath.Mtime is handled explicitly in freshen, list and export rather than dereferenced (main panicked); gpg positional key IDs now follow an explicit -- end-of-options marker. All twelve reworded user-visible error messages restored to byte-identical parity with main and pinned by tests.	2026-08-10 16:06:12 +02:00
clawbot	43916c7746	1.0 quality polish — code review, tests, bug fixes, documentation (#32) ... Comprehensive quality pass targeting 1.0 release: - Code review and refactoring - Fix open bugs (#14, #16, #23) - Expand test coverage - Lint clean - README update with build instructions (#9) - Documentation improvements Branched from `next` (active dev branch). Reviewed-on: #32 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-01 23:58:37 +01:00
clawbot	8c7eef6240	fix: handle errcheck warnings in gpg.go and gpg_test.go, fix gofmt	2026-02-19 23:40:50 -08:00
sneak	5ab092098b	progress	2026-02-08 09:25:58 -08:00
sneak	4a2060087d	Add GPG signature verification on manifest load ... - Implement gpgVerify function that creates a temporary keyring to verify detached signatures against embedded public keys - Signature verification happens during deserialization after hash validation but before decompression - Extract signatureString() as a method on manifest for generating the canonical signature string (MAGIC-UUID-MULTIHASH) - Add --require-signature flag to check command to mandate signature from a specific GPG key ID - Expose IsSigned() and Signer() methods on Checker for signature status	2025-12-18 05:56:16 -08:00
sneak	778999a285	Add GPG signing support for manifest generation ... - Add --sign-key flag and MFER_SIGN_KEY env var to gen and freshen commands - Sign inner message multihash with GPG detached signature - Include signer fingerprint and public key in outer wrapper - Add comprehensive tests with temporary GPG keyring - Increase test timeout to 10s for GPG key generation	2025-12-18 02:12:54 -08:00