cibuild: run checks on unchanged trees via CHECK_EPOCH (closes #89)

A bare `docker build .` keyed `make fmt-check-go`, `make lint`, the
prettier check, and `make test` on the build context, so on an unchanged
tree every check layer was a cache hit: the build exited 0 in under a
second having run none of them.

Add `ARG CHECK_EPOCH` immediately above the first check RUN in all three
check stages (lint, mdfmt, builder), and have script/cibuild pass a fresh
`--build-arg CHECK_EPOCH` each run. The changing value busts the cache from
that point down, while `go mod download` and `yarn install` above it stay
cached, so the build does not regress to cold. The false claim in
script/cibuild's header comment is corrected.

Running the checks for real surfaces the pre-existing intermittent
internal/cli test timeout (the gpg-subprocess flake in #62 / #67); that
defect is out of scope here.

Model: opus-4-8

.dockerignore

@@ -1,4 +1,64 @@
+# .dockerignore does NOT use .gitignore semantics. Docker matches with
+# moby/patternmatcher: filepath.Match plus `**`, so `*` does not cross
+# `/` and an unprefixed pattern is anchored at the context root. Every
+# depth-independent pattern therefore needs `**/`, or `config/.env` and
+# `certs/server.key` still ship while this file reads as solved. Only
+# genuinely root-anchored entries go unprefixed. Never transplant these
+# into .gitignore, where `**/` is wrong.
+#
+# Matching is case-sensitive, so secrets use character ranges rather
+# than an ALL-CAPS twin, which would still miss `Server.Key`.
+#
+# Extend with this repo's own host-built artifacts, written anchored:
+# `/myapp`, never `**/myapp`, which also matches `cmd/myapp/` and
+# deletes the package directory from the context.
+
+# .git is sent without its config. Without a VERSION build argument the
+# stage that compiles runs `git describe --tags --always` on .git, which
+# does not need .git/config; that file can hold a credential, such as a
+# password in a remote URL or the token the CI checkout step stores there.
+.git/config
+
+# Agent scratch: one full checkout of the repo per in-flight agent.
+# Anchored because it occurs once where agents run at the repo root.
+# KNOWN GAP: a repo running agents in subdirectories still ships
+# `services/api/.claude/` and must add its own anchored entry.
+.claude
+
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Re-include a committed template with a negation if the
+# build needs one: `!docs/example.env`.
+**/*.[eE][nN][vV]
+**/.[eE][nN][vV].*
+**/.[eE][nN][vV][rR][cC]
+
+# Private keys and the bundles carrying them. Public certificates
+# (*.crt, *.cer) are deliberately absent: they are legitimate inputs.
+**/*.[pP][eE][mM]
+**/*.[kK][eE][yY]
+**/*.[pP]12
+**/*.[pP][fF][xX]
+**/[iI][dD]_[rR][sS][aA]
+**/[iI][dD]_[dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]
+**/[iI][dD]_[eE][dD]25519
+
+# Dependencies: restored inside the image, never copied in.
+**/node_modules
+
+# OS metadata.
+**/.DS_Store
+**/Thumbs.db
+
+# Editor state: never a build input, and it churns COPY.
+**/*.swp
+**/*.swo
+**/*~
+**/*.bak
+**/.idea
+**/.vscode
+**/*.sublime-*
+
+# This repo's own host-built archives (Makefile).
 *.tmp
 *.dockerimage
-.git
-node_modules

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[Makefile]
+indent_style = tab

.gitignore

@@ -10,5 +10,24 @@ modcache.tzst
 # Generated manifest files
 .index.mf
 
-# Stale files
+# Secrets
-.drone.yml
+.env
+.env.*
+*.key
+*.pem
+
+# OS files
+.DS_Store
+Thumbs.db
+
+# Editor files
+*.swp
+*.swo
+*~
+.idea/
+.vscode/
+
+# Go build artifacts
+*.log
+*.out
+*.test

Dockerfile

@@ -60,7 +60,26 @@ RUN touch mfer/mf.pb.go
 ARG CHECK_EPOCH
 
 RUN make test
-RUN cd cmd/mfer && go build -tags urfave_cli_no_docs -o /mfer .
+
+# A build context sent as a tar archive, as upaas sends it, keeps its files'
+# owners, and git refuses to read a checkout owned by another user.
+RUN git config --system --add safe.directory /src
+
+# The revision `mfer version` prints, stamped into main.Gitrev: the VERSION
+# build argument when one is given (script/docker passes one), otherwise
+# `git describe --tags --always` of the .git the build context carries: the
+# tag on a tagged commit, tag-N-gHASH on a commit after one, the short commit
+# when no tag is reachable. git ships in this base image. A context that
+# carries .git and still yields no version fails the build.
+ARG VERSION
+RUN version="${VERSION:-$(git describe --tags --always)}"; \
+    if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
+        [ "$version" = unknown ]; }; then \
+        echo "no version could be derived although the build context carries .git" >&2; \
+        exit 1; \
+    fi; \
+    cd cmd/mfer && \
+    go build -tags urfave_cli_no_docs -ldflags "-X main.Gitrev=$version" -o /mfer .
 
 FROM scratch
 COPY --from=builder /mfer /mfer

TODO.md

@@ -26,6 +26,20 @@ only thing left of the `chore/align-repo-policies` branch is the list below.
 
 - 2026-09-21: made `script/cibuild` re-run the checks on an unchanged tree via a
   changing `CHECK_EPOCH` build arg in each Dockerfile check stage (#89)
+- 2026-10-02: a plain `docker build .` of a clone now stamps the tag or short
+  commit into `mfer version` instead of nothing: `.dockerignore` sends `.git`
+  (not `.git/config`), and the build stage takes the `VERSION` build argument,
+  otherwise `git describe --tags --always`, failing if `.git` is present and no
+  version comes out. `script/docker` is the canonical copy, which passes
+  `VERSION`; `bin/gitrev.sh` uses `--tags` too (#112)
+- 2026-09-21: validate manifest entry paths on deserialize so untrusted `.mf`
+  files cannot make `Checker` stat or read outside `basePath` (#61)
+- 2026-09-21: rewrote `script/test` to the canonical pattern (30s timeout,
+  `-race -cover`, quiet-first with verbose-on-failure rerun) and fixed the
+  process-global logger data race it surfaced (#67)
+- 2026-09-21: added the canonical `.editorconfig`, made `.gitignore` cover
+  secrets, OS, editor, and Go artifacts, and removed the dead Drone CI
+  references from `.gitignore` and `bin/gitrev.sh` (#72)
 - 2026-08-09: added `.prettierrc`/`.prettierignore`, gave `script/fmt` and
   `script/fmt-check` one shared prettier file set via `script/prettier`, dropped
   the `|| true` that hid prettier failures, and added a node-based Dockerfile
@@ -64,7 +78,6 @@ only thing left of the `chore/align-repo-policies` branch is the list below.
     - Move FORMAT.md from repo root to docs/ and update the AGENTS.md reference
     - Pin Makefile-installed Go tools (`protoc-gen-go@v1.28.1`,
       `golangci-lint@v2.12.2`) by module hash, not mutable tag
-    - Set `make test` timeout to 30s (currently 10s)
     - Add explicit README "Rationale" heading (content exists under other
       names); name the author in the README Description first line
     - Reconcile root-level AGENTS.md with directory-hygiene policy (keep or

bin/gitrev.sh

@@ -1,12 +1,7 @@
 #!/bin/bash
 #
-if [[ ! -z "$DRONE_COMMIT_SHA" ]]; then
-    echo "${DRONE_COMMIT_SHA:0:7}"
-    exit 0
-fi
-
 if [[ ! -z "$GITREV" ]]; then
     echo $GITREV
 else
-    git describe --always --dirty=-dirty
+    git describe --tags --always --dirty=-dirty
 fi

internal/cli/entry_test.go

@@ -679,11 +679,13 @@ func TestCheckDetectsManifestCorruption(t *testing.T) {
 	fs := afero.NewMemMapFs()
 	rng := rand.New(rand.NewSource(42)) //nolint:gosec // deterministic test data
 
-	// Create many small files with random names to generate a ~1MB manifest
+	// Create many small files with random names so the manifest has many
-	// Each manifest entry is roughly 50-60 bytes, so we need ~20000 files
+	// entries and random single-byte flips land at varied offsets. Each
+	// manifest entry is roughly 50-60 bytes. Kept modest so the suite stays
+	// within its wall-clock budget under -race.
 	require.NoError(t, fs.MkdirAll(testDir, 0o755))
 
-	numFiles := 20000
+	numFiles := 1500
 	for range numFiles {
 		// Generate random filename
 		filename := fmt.Sprintf("/testdir/%08x%08x%08x.dat",
@@ -699,11 +701,11 @@ func TestCheckDetectsManifestCorruption(t *testing.T) {
 	exitCode := runCLI(opts)
 	require.Equal(t, 0, exitCode, "generate should succeed")
 
-	// Read the valid manifest and verify it's approximately 1MB
+	// Read the valid manifest and verify it has real size.
 	validManifest, err := afero.ReadFile(fs, testManifest)
 	require.NoError(t, err)
-	require.GreaterOrEqual(t, len(validManifest), 1024*1024,
+	require.GreaterOrEqual(t, len(validManifest), 64*1024,
-		"manifest should be at least 1MB, got %d bytes", len(validManifest))
+		"manifest should be at least 64KB, got %d bytes", len(validManifest))
 	t.Logf("manifest size: %d bytes (%d files)", len(validManifest), numFiles)
 
 	// First corruption: truncate the manifest
@@ -726,8 +728,8 @@ func TestCheckDetectsManifestCorruption(t *testing.T) {
 	exitCode = runCLI(opts)
 	require.Equal(t, 0, exitCode, "check should pass with valid manifest")
 
-	// Now do 500 random corruption iterations
+	// Now do 100 random corruption iterations
-	for i := range 500 {
+	for i := range 100 {
 		// Corrupt: write a random byte at a random offset
 		corrupted := make([]byte, len(validManifest))
 		copy(corrupted, validManifest)

internal/cli/mfer.go

@@ -357,6 +357,6 @@ func (mfa *CLIApp) run(args []string) {
 	if err != nil {
 		mfa.exitCode = 1
 
-		log.WithError(err).Debugf("exiting")
+		log.Errorf("%s", err)
 	}
 }

internal/log/log.go

@@ -112,13 +112,16 @@ func DisableStyling() {
 }
 
 // Init initializes the logger with the CLI handler and default log level.
+//
+// It reconfigures the process-global apex/log logger under the write lock so
+// the global is never mutated while another goroutine holds the read lock to
+// read it in emit. Without this, parallel callers (e.g. the test suite) race
+// Init's SetLevel/SetHandler against concurrent log calls.
 func Init() {
-	mu.RLock()
+	mu.Lock()
+	defer mu.Unlock()
 
-	w := stderr
+	log.SetHandler(acli.New(stderr))
-
-	mu.RUnlock()
-	log.SetHandler(acli.New(w))
 	log.SetLevel(log.DebugLevel) // Let apex/log pass everything; we filter ourselves
 }
 
@@ -130,74 +133,66 @@ func isEnabled(l Level) bool {
 	return l >= currentLevel
 }
 
+// emit calls fn while holding the read lock if messages at level l are
+// enabled. Holding the read lock across the apex/log call keeps the global
+// logger from being read while Init reconfigures it under the write lock.
+func emit(l Level, fn func()) {
+	mu.RLock()
+	defer mu.RUnlock()
+
+	if l >= currentLevel {
+		fn()
+	}
+}
+
 // Fatalf logs a formatted message at fatal level.
 func Fatalf(format string, args ...any) {
-	if isEnabled(FatalLevel) {
+	emit(FatalLevel, func() { log.Fatalf(format, args...) })
-		log.Fatalf(format, args...)
-	}
 }
 
 // Fatal logs a message at fatal level.
 func Fatal(arg string) {
-	if isEnabled(FatalLevel) {
+	emit(FatalLevel, func() { log.Fatal(arg) })
-		log.Fatal(arg)
-	}
 }
 
 // Errorf logs a formatted message at error level.
 func Errorf(format string, args ...any) {
-	if isEnabled(ErrorLevel) {
+	emit(ErrorLevel, func() { log.Errorf(format, args...) })
-		log.Errorf(format, args...)
-	}
 }
 
 // Error logs a message at error level.
 func Error(arg string) {
-	if isEnabled(ErrorLevel) {
+	emit(ErrorLevel, func() { log.Error(arg) })
-		log.Error(arg)
-	}
 }
 
 // Warnf logs a formatted message at warn level.
 func Warnf(format string, args ...any) {
-	if isEnabled(WarnLevel) {
+	emit(WarnLevel, func() { log.Warnf(format, args...) })
-		log.Warnf(format, args...)
-	}
 }
 
 // Warn logs a message at warn level.
 func Warn(arg string) {
-	if isEnabled(WarnLevel) {
+	emit(WarnLevel, func() { log.Warn(arg) })
-		log.Warn(arg)
-	}
 }
 
 // Infof logs a formatted message at info level.
 func Infof(format string, args ...any) {
-	if isEnabled(InfoLevel) {
+	emit(InfoLevel, func() { log.Infof(format, args...) })
-		log.Infof(format, args...)
-	}
 }
 
 // Info logs a message at info level.
 func Info(arg string) {
-	if isEnabled(InfoLevel) {
+	emit(InfoLevel, func() { log.Info(arg) })
-		log.Info(arg)
-	}
 }
 
 // Verbosef logs a formatted message at verbose level.
 func Verbosef(format string, args ...any) {
-	if isEnabled(VerboseLevel) {
+	emit(VerboseLevel, func() { log.Infof(format, args...) })
-		log.Infof(format, args...)
-	}
 }
 
 // Verbose logs a message at verbose level.
 func Verbose(arg string) {
-	if isEnabled(VerboseLevel) {
+	emit(VerboseLevel, func() { log.Info(arg) })
-		log.Info(arg)
-	}
 }
 
 // Debugf logs a formatted message at debug level with caller location.
@@ -216,7 +211,10 @@ func Debug(arg string) {
 
 // DebugReal logs at debug level with caller info from the specified stack depth.
 func DebugReal(arg string, cs int) {
-	if !isEnabled(DebugLevel) {
+	mu.RLock()
+	defer mu.RUnlock()
+
+	if DebugLevel < currentLevel {
 		return
 	}
 
@@ -275,11 +273,6 @@ func GetLevel() Level {
 	return currentLevel
 }
 
-// WithError returns a log entry with the error attached.
-func WithError(e error) *log.Entry {
-	return log.Log.WithError(e)
-}
-
 // Progressf prints a progress message that overwrites the current line.
 // Use ProgressDone() when progress is complete to move to the next line.
 func Progressf(format string, args ...any) {

mfer/checker.go

@@ -312,6 +312,10 @@ func (c *Checker) FindExtraFiles(ctx context.Context, results chan<- Result) err
 }
 
 func (c *Checker) checkFile(entry *MFFilePath, checkedBytes *FileSize) Result {
+	// entry.GetPath() is safe to join here: a manifest's entry paths are
+	// validated against the path invariants when it is loaded (see
+	// deserializeInner) or built (see Builder.AddFile), so a traversal or
+	// absolute path can never reach this point.
 	absPath := filepath.Join(string(c.basePath), entry.GetPath())
 	relPath := RelFilePath(entry.GetPath())
 

mfer/deserialize.go

@@ -25,6 +25,7 @@ var (
 	errDecompressedTooLarge = errors.New("decompressed data exceeds maximum allowed size")
 	errUUIDMismatch         = errors.New("outer and inner UUID mismatch")
 	errInvalidFileFormat    = errors.New("invalid file format")
+	errInvalidManifestPath  = errors.New("manifest contains invalid path")
 )
 
 // validateUUID checks that the byte slice is a valid UUID (16 bytes, parseable).
@@ -181,6 +182,19 @@ func (m *manifest) deserializeInner() error {
 		return errUUIDMismatch
 	}
 
+	// Enforce the manifest path invariants on every entry as it is loaded,
+	// so that no consumer of a manifest — Checker today, any restore or
+	// extract path tomorrow — acts on a traversal or absolute path from an
+	// untrusted .mf. Reject loudly on the first offender rather than
+	// dropping entries, which would let a hostile manifest hide files from a
+	// check.
+	for _, f := range m.pbInner.GetFiles() {
+		err = ValidatePath(f.GetPath())
+		if err != nil {
+			return fmt.Errorf("%w: %w", errInvalidManifestPath, err)
+		}
+	}
+
 	log.Infof("loaded manifest with %d files", len(m.pbInner.GetFiles()))
 
 	return nil

mfer/deserialize_path_test.go

@@ -0,0 +1,145 @@
+//nolint:testpackage // white-box tests exercise unexported internals
+package mfer
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"fmt"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/klauspost/compress/zstd"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/encoding/protowire"
+	"google.golang.org/protobuf/proto"
+)
+
+// craftInnerBytes builds the wire bytes of an inner MFFile holding a single
+// file entry whose path is exactly pathBytes. It writes the wire form by hand
+// so a hostile path — including one that is not valid UTF-8 — can be embedded
+// without proto.Marshal's own UTF-8 enforcement rejecting it first.
+func craftInnerBytes(id uuid.UUID, pathBytes string) []byte {
+	entry := protowire.AppendTag(nil, 1, protowire.BytesType) // MFFilePath.path
+	entry = protowire.AppendString(entry, pathBytes)
+
+	inner := protowire.AppendTag(nil, 100, protowire.VarintType) // MFFile.version
+	inner = protowire.AppendVarint(inner, uint64(MFFile_VERSION_ONE))
+	inner = protowire.AppendTag(inner, 101, protowire.BytesType) // MFFile.files
+	inner = protowire.AppendBytes(inner, entry)
+	inner = protowire.AppendTag(inner, 102, protowire.BytesType) // MFFile.uuid
+	inner = protowire.AppendBytes(inner, id[:])
+
+	return inner
+}
+
+// wrapInner wraps inner MFFile wire bytes in a complete, well-formed .mf
+// envelope (magic prefix, zstd-compressed payload, matching hash and UUID) so
+// that deserialization reaches path validation rather than failing earlier on
+// an integrity check.
+func wrapInner(t *testing.T, id uuid.UUID, innerData []byte) []byte {
+	t.Helper()
+
+	var cbuf bytes.Buffer
+
+	zw, err := zstd.NewWriter(&cbuf, zstd.WithEncoderLevel(zstd.SpeedBestCompression))
+	require.NoError(t, err)
+
+	_, err = zw.Write(innerData)
+	require.NoError(t, err)
+	require.NoError(t, zw.Close())
+
+	compressed := cbuf.Bytes()
+	sum := sha256.Sum256(compressed)
+
+	outer := &MFFileOuter{
+		InnerMessage:    compressed,
+		Size:            int64(len(innerData)),
+		Sha256:          sum[:],
+		Uuid:            id[:],
+		Version:         MFFileOuter_VERSION_ONE,
+		CompressionType: MFFileOuter_COMPRESSION_ZSTD,
+	}
+
+	ob, err := proto.Marshal(outer)
+	require.NoError(t, err)
+
+	return append([]byte(MAGIC), ob...)
+}
+
+func TestDeserializeRejectsInvalidEntryPaths(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		path string
+	}{
+		{"parent traversal", "../escape"},
+		{"interior traversal", "a/../../escape"},
+		{"absolute path", "/etc/passwd"},
+		{"backslash path", `a\b`},
+		{"double slash", "a//b"},
+		{"empty path", ""},
+		{"invalid utf-8", "abc\xff"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			id := uuid.New()
+			data := wrapInner(t, id, craftInnerBytes(id, tt.path))
+
+			_, err := NewManifestFromReader(bytes.NewReader(data))
+			require.Error(t, err)
+
+			if tt.path == "abc\xff" {
+				// A path that is not valid UTF-8 cannot survive the proto3
+				// string decoder, which rejects it before path validation
+				// runs; the manifest is still refused at load time.
+				return
+			}
+
+			require.ErrorIs(t, err, errInvalidManifestPath)
+
+			if tt.path != "" {
+				// ValidatePath quotes the path with %q; assert against the
+				// same rendering so escaped characters (e.g. a backslash)
+				// still match.
+				assert.Contains(t, err.Error(), fmt.Sprintf("%q", tt.path),
+					"error must name the offending path")
+			}
+		})
+	}
+}
+
+func TestDeserializeValidManifestRoundTrips(t *testing.T) {
+	t.Parallel()
+
+	hash := make([]byte, 34) // multihash: 2-byte prefix + 32-byte SHA-256
+
+	b := NewBuilder()
+	require.NoError(t, b.AddFileWithHash("dir/file.txt", 123, ModTime{}, hash))
+
+	var buf bytes.Buffer
+	require.NoError(t, b.Build(&buf))
+
+	m, err := NewManifestFromReader(bytes.NewReader(buf.Bytes()))
+	require.NoError(t, err)
+
+	files := m.Files()
+	require.Len(t, files, 1)
+	assert.Equal(t, "dir/file.txt", files[0].GetPath())
+	assert.Equal(t, int64(123), files[0].GetSize())
+}
+
+// TestValidatePathRejectsInvalidUTF8 pins the ValidatePath rule that a manifest
+// path must be valid UTF-8, independent of the proto decoder that also enforces
+// it on the wire.
+func TestValidatePathRejectsInvalidUTF8(t *testing.T) {
+	t.Parallel()
+
+	err := ValidatePath("abc\xff")
+	require.ErrorIs(t, err, errPathNotUTF8)
+	assert.Contains(t, err.Error(), "UTF-8")
+}

script/docker

@@ -1,7 +1,8 @@
 #!/bin/sh
 # script/docker: build the Docker image tagged with the project name.
 # Identical in all repos; the tag comes from script/projectname.
-# Generic: needs no adaptation.
+# --no-cache because the gate phases the final stage depends on are RUN
+# steps, and a cached one is a check that did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -9,7 +10,15 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    docker build -t "$("$SCRIPT_DIR/projectname")" .
+    # Own line: a failing command substitution inside an argument does
+    # not trip `set -e`, so the inline form degrades silently to an
+    # empty constant. The VERSION build argument takes precedence over
+    # the version a build stage derives from the .git in the context.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$("$SCRIPT_DIR/projectname")" .
 }
 
 main "$@"

script/test

@@ -17,7 +17,12 @@ ensure_pb() {
 main() {
     cd "$ROOT"
     ensure_pb
-    go test -v --timeout 10s ./...
+    go test -timeout 30s -race -cover ./... ||
+        {
+            echo "--- Rerunning with -v for details ---"
+            go test -timeout 30s -race -v ./...
+            exit 1
+        }
 }
 
 main "$@"