4 Commits

Include renames

Author	SHA1	Message	Date
clawbot	0baf83deb6	Sign or timestamp an unchanged tree's manifest in freshen (closes #190) ... freshen skipped the write whenever no file was added, changed or removed, so --sign-key and --include-timestamps on an unchanged tree did nothing. It now skips only when the manifest would come out the same: nothing in the tree changed, the manifest is signed by the --sign-key key (unsigned without one), and it has a createdAt timestamp exactly when --include-timestamps asks for one. A file whose recorded mode is not what --include-permissions asks for already counts as changed. Deviation: the mfer package gains SecretKeyFingerprint and a loaded manifest's CreatedAt, which the comparison needs. Model: opus-5-5	2026-10-14 00:42:44 +02:00
clawbot	6540e5f285	Refuse an empty --require-signature or --sign-key (closes #205) ... check, fetch, gen and freshen took --require-signature or --sign-key given an empty value, on the command line or through MFER_REQUIRE_SIGNATURE or MFER_SIGN_KEY, as the flag not given, so an unset shell variable skipped the signature check or the signing. Each now asks whether the flag was given, as gen's --output does. An empty fingerprint is refused as one of the wrong length, by fetch before it requests anything; an empty --sign-key is refused, naming the flag, before any file is read. Model: opus-5-5	2026-10-14 00:01:30 +02:00
clawbot	60dbcc03bc	Refuse to freshen a signed manifest without --sign-key (closes #191) ... freshen built the new manifest from its flags alone, so a signed manifest freshened without --sign-key came out unsigned while the log said its signature verified. freshen now stops after loading such a manifest, before scanning, with an error naming the signer's fingerprint and --sign-key, and leaves the manifest as it was. With --sign-key it rewrites and signs as before. The library gains Signer() on the loaded manifest: the signing key's fingerprint, or nil when the manifest is unsigned, as Checker.Signer gives it. Model: opus-5-5	2026-10-14 00:00:27 +02:00
clawbot	0fbb3da0a5	Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181) ... mfer ran the gpg binary to sign, export keys and verify, so it failed wherever gpg is missing. It now uses github.com/ProtonMail/go-crypto/openpgp. --sign-key and MFER_SIGN_KEY name a file holding one version 4 OpenPGP secret key; a protected key's passphrase comes from MFER_SIGN_KEY_PASSPHRASE or a terminal prompt. gen and freshen check that the key can sign before they read any file. Verification keeps the rules of the --require-signature fix: one primary key in the embedded block, counted from its packets, exactly one signature, made by that key or a subkey, and signer equal to its fingerprint. The embedded block may hold no DSA key and no secret key, and an armored field must be one well-formed block. Model: opus-5-5	2026-10-08 09:42:45 +02:00