3 Commits

Include renames

Author	SHA1	Message	Date
clawbot	c0b099cc48	Make error message wording consistent (closes #165) ... Error messages in mfer/ and internal/cli/ are lowercase except names and acronyms, carry no "failed to" or command-name prefix, and each wrap names only the operation and thing the wrapped error does not already name, so a stacked message names what failed once. Wraps around errors that already name their operation and path (os and afero path errors, url.Error, the builder's path errors, the gpg helpers' own errors) are dropped. gpg's stderr is appended to a gpg failure, and to the error for a signing key gpg did not report, only when gpg wrote some. errHTTPStatus reads "unexpected HTTP status"; both inner-not-set sentinels read "inner message not set". No sentinel, errors.Is result or exit status changes. Model: opus-5-5	2026-10-07 17:25:41 +02:00
clawbot	01ff67a38e	Refuse a manifest whose inner message version is not one (closes #169) ... Loading a manifest checked only the outer message's version, so an inner message of version 0 or a later version loaded as if it were version one, although docs/FORMAT.md requires VERSION_ONE in both. deserializeInner now refuses any other inner version with the same error as an unknown outer version. Two existing tests built inner messages with no version and expected them to load; they now write version one. Model: opus-5-5	2026-10-07 15:25:47 +02:00
clawbot	f663f4242d	Limit how much fetch and check read for a manifest or a file (closes #168) ... NewManifestFromReader reads at most one byte past MaxManifestSize, a new constant of 258 MiB: the 256 MiB decompressed limit grown by zstd's worst case of 1/256, plus 1 MiB for the signature, the signing key and the other outer fields. It refuses a larger manifest. fetch, and check given a URL, stop downloading a manifest one byte past the same size and report it as too large; tests lower that size to keep their memory small. fetch stops reading a file one byte past its listed size, so a longer body ends in the size mismatch at once instead of filling the disk. docs/FORMAT.md states the limit and gives the decompressed limit as 256 MiB, the size the code uses. Model: opus-5-5	2026-10-07 14:25:45 +02:00