7 Commits

Include renames

Author	SHA1	Message	Date
clawbot	51f69c960d	Enforce real timeouts on gpg subprocess calls (closes #62) ... Every gpg run now has a one-minute deadline (gpgTimeout) on top of its caller's context and is killed when either ends. A timeout is reported as "gpg timed out" under the failing operation instead of "signal: killed". Only gpg itself is killed; WaitDelay (one second) stops the run from waiting on a process gpg left behind that still holds its output, such as a wrapper script that does not exec the real gpg. Builder.Build and Checker.ExtractEmbeddedSigningKeyFP take a context, so ToManifest's context now reaches signing and the contextcheck suppression calling signing non-cancellable is gone. Manifest loading takes no context, so its signature check is bounded by the timeout alone. Model: opus-5-5	2026-10-04 04:31:53 +02:00
clawbot	de476708e9	Update golangci-lint to v2.12.2 with canonical config (closes #60) ... Adopts golangci-lint v2.12.2 and the canonical .golangci.yml (default: all), and fixes all resulting findings across the tree. Two intended behavior changes: absent MFFilePath.Mtime is handled explicitly in freshen, list and export rather than dereferenced (main panicked); gpg positional key IDs now follow an explicit -- end-of-options marker. All twelve reworded user-visible error messages restored to byte-identical parity with main and pinned by tests.	2026-08-10 16:06:12 +02:00
clawbot	43916c7746	1.0 quality polish — code review, tests, bug fixes, documentation (#32) ... Comprehensive quality pass targeting 1.0 release: - Code review and refactoring - Fix open bugs (#14, #16, #23) - Expand test coverage - Lint clean - README update with build instructions (#9) - Documentation improvements Branched from `next` (active dev branch). Reviewed-on: #32 Co-authored-by: clawbot <clawbot@noreply.example.org> Co-committed-by: clawbot <clawbot@noreply.example.org>	2026-03-01 23:58:37 +01:00
clawbot	2adc275278	feat: add --seed flag for deterministic manifest UUID ... Adds a --seed CLI flag to 'generate' that derives a deterministic UUID from the seed value by hashing it 1,000,000,000 times with SHA-256. This makes manifest generation fully reproducible when the same seed and input files are provided. - Builder.SetSeed(seed) method for programmatic use - deriveSeedUUID() extracted for testability - MFER_SEED env var also supported - Test with reduced iteration count for speed	2026-02-20 03:05:16 -08:00
clawbot	f6478858d7	fix: IsHiddenPath returns false for "." and "/" (current dir/root are not hidden) ... path.Clean(".") returns "." which starts with a dot, causing IsHiddenPath to incorrectly treat the current directory as hidden. Add explicit checks for "." and "/" before the dot-prefix check. Fixed in both mfer/scanner.go and internal/scanner/scanner.go.	2026-02-19 23:36:42 -08:00
sneak	778999a285	Add GPG signing support for manifest generation ... - Add --sign-key flag and MFER_SIGN_KEY env var to gen and freshen commands - Sign inner message multihash with GPG detached signature - Include signer fingerprint and public key in outer wrapper - Add comprehensive tests with temporary GPG keyring - Increase test timeout to 10s for GPG key generation	2025-12-18 02:12:54 -08:00
sneak	dc115c5ba2	Add custom types for type safety throughout codebase ... - Add FileCount, FileSize, RelFilePath, AbsFilePath, ModTime, Multihash types - Add UnixSeconds and UnixNanos types for timestamp handling - Add URL types (ManifestURL, FileURL, BaseURL) with safe path joining - Consolidate scanner package into mfer package - Update checker to use custom types in Result and CheckStatus - Add ModTime.Timestamp() method for protobuf conversion - Update all tests to use proper custom types	2025-12-18 01:01:18 -08:00