Disable the deprecated gomodguard linter (closes #116)

golangci-lint v2.12 deprecates gomodguard in favour of gomodguard_v2.
With `default: all` both ran, and every lint run printed the
deprecation warning. Disable the old name, the same way wsl is
disabled for wsl_v5; gomodguard_v2 stays enabled. The old linter had
no settings here, so there is nothing to carry over.

Model: opus-5-5

.gitignore

@@ -8,7 +8,7 @@ vendor.tzst
 modcache.tzst
 
 # Generated manifest files
-/index.mf
+.index.mf
 
 # Secrets
 .env

.golangci.yml

@@ -16,6 +16,7 @@ linters:
     - depguard         # Dependency allow/block lists
     - godot            # Requires comments to end with periods
     - wsl              # Deprecated, replaced by wsl_v5
+    - gomodguard       # Deprecated, replaced by gomodguard_v2
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
   settings:

Dockerfile

@@ -8,6 +8,9 @@ RUN go mod download
 
 COPY . .
 
+# Touch .pb.go so make does not try to regenerate via protoc (file is committed)
+RUN touch mfer/mf.pb.go
+
 # Go half of fmt-check only: this image has no node, so no prettier. The
 # markdown half runs in the mdfmt stage below.
 RUN make fmt-check-go
@@ -43,6 +46,9 @@ RUN go mod download
 
 COPY . .
 
+# Touch .pb.go so make does not try to regenerate via protoc (file is committed)
+RUN touch mfer/mf.pb.go
+
 RUN make test
 
 # A build context sent as a tar archive, as upaas sends it, keeps its files'
@@ -69,7 +75,5 @@ RUN version="${VERSION:-$(git describe --tags --always)}"; \
 RUN ldd /mfer 2>&1 | grep -q 'not a dynamic executable'
 
 FROM scratch
-# scratch has no CA certificates; fetch needs them to verify HTTPS servers.
-COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=builder /mfer /mfer
 ENTRYPOINT ["/mfer"]

FORMAT.md

@@ -49,9 +49,7 @@ The `innerMessage` field is compressed with
 enforce a decompression size limit to prevent decompression bombs. The reference
 implementation limits decompressed size to 256 MB. It writes zstd frames with a
 window of at most 8 MiB, the largest window the zstd format recommends decoders
-support, and refuses frames that ask for a larger one. It also refuses an inner
-message whose file entries, hashes, timestamps and MIME types, counted at 160,
-112, 64 and 16 bytes each, add up to more than 8 times its size.
+support, and refuses frames that ask for a larger one.
 
 ## Inner Message (`MFFile`)
 

Makefile

@@ -2,6 +2,7 @@ export DOCKER_BUILDKIT := 1
 export PROGRESS_NO_TRUNC := 1
 GOPATH := $(shell go env GOPATH)
 export PATH := $(PATH):$(GOPATH)/bin
+PROTOC_GEN_GO := $(GOPATH)/bin/protoc-gen-go
 SOURCEFILES := mfer/*.go mfer/*.proto internal/*/*.go cmd/*/*.go go.mod go.sum
 ARCH := $(shell uname -m)
 GITREV_BUILD := $(shell bash $(PWD)/bin/gitrev.sh 2>/dev/null || echo unknown)
@@ -12,7 +13,7 @@ GOLDFLAGS += -X main.Version=$(VERSION)
 GOLDFLAGS += -X main.Gitrev=$(GITREV_BUILD)
 GOFLAGS := -ldflags "$(GOLDFLAGS)"
 
-.PHONY: bootstrap setup docker default run ci test fuzz check lint fmt fmt-check fmt-check-go fmt-check-md hooks fixme generate
+.PHONY: bootstrap setup docker default run ci test fuzz check lint fmt fmt-check fmt-check-go fmt-check-md hooks fixme
 
 default: fmt test
 
@@ -34,6 +35,9 @@ test:
 fuzz:
 	@script/fuzz
 
+$(PROTOC_GEN_GO):
+	test -e $(PROTOC_GEN_GO) || go install -v google.golang.org/protobuf/cmd/protoc-gen-go@v1.28.1
+
 fixme:
 	@grep -nir fixme . | grep -v Makefile
 
@@ -54,14 +58,15 @@ fmt-check-md:
 hooks:
 	@script/install-precommit
 
-generate:
-	@script/generate
+mfer/mf.pb.go: mfer/mf.proto
+	cd mfer && go generate .
 
-bin/mfer: $(SOURCEFILES)
+bin/mfer: $(SOURCEFILES) mfer/mf.pb.go
+	protoc --version
 	cd cmd/mfer && go build -tags urfave_cli_no_docs -o ../../bin/mfer $(GOFLAGS) .
 
 clean:
-	rm -rfv bin/mfer cmd/mfer/mfer *.dockerimage
+	rm -rfv mfer/*.pb.go bin/mfer cmd/mfer/mfer *.dockerimage
 
 fmt:
 	@script/fmt

README.md

@@ -36,12 +36,12 @@ Generate a manifest for a directory tree, verify it later, and fetch a published
 tree by URL:
 
 ```sh
-# Write index.mf, a manifest of the files under the current directory.
+# Write .index.mf, a manifest of the files under the current directory.
 bin/mfer gen .
 
 # Verify the files on disk against the manifest. Exits nonzero if any file
-# it lists is missing or corrupted; warns about files it does not list.
-bin/mfer check index.mf
+# is missing or corrupted.
+bin/mfer check .index.mf
 
 # Download and cryptographically verify a tree published over HTTP: mfer
 # fetches <url>/index.mf, then downloads every file it lists.
@@ -72,19 +72,8 @@ provide:
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (`mfer`); used by other scripts
   such as `script/docker`
-- `script/test` — run the test suite (`go test`); one test fails when
-  `mfer/mf.proto` no longer matches the hash `script/generate` recorded
-- `script/generate` (`make generate`) — regenerate `mfer/mf.pb.go` from
-  `mfer/mf.proto` and record the hash of that `mfer/mf.proto` in
-  `mfer/mf.proto.sha256`; the only thing that regenerates the committed
-  `mfer/mf.pb.go`. It needs the exact versions that wrote the committed file,
-  and refuses to run with any other: `protoc` 33.4 (unpack
-  `protoc-33.4-<platform>.zip` from
-  [its release](https://github.com/protocolbuffers/protobuf/releases/tag/v33.4)
-  and put its `bin/protoc` on `PATH`) and `protoc-gen-go` v1.36.11
-  (`go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.11`, which
-  installs it in `$(go env GOPATH)/bin`; `make generate` adds that directory to
-  `PATH`)
+- `script/test` — run the test suite (`go test`), regenerating the protobuf code
+  first if it is stale
 - `script/fuzz` — fuzz the manifest parser for one minute; run by hand
   (`make fuzz`), never by CI, while `script/test` runs its committed seed corpus
   as ordinary tests
@@ -251,9 +240,6 @@ are now tracked only in the [issues](https://git.eeqj.de/sneak/mfer/issues).
 - `mfer check` / `mfer check .`
     - verifies checksums of all files in manifest, displaying error and exiting
       nonzero if any files are missing or corrupted
-    - warns about each file under the base directory that the manifest does not
-      list, hidden files included; with `--no-extra-files` each one is a failure
-      instead
 - `mfer fetch https://example.com/stuff/`
     - fetches `/stuff/index.mf` and downloads all files listed in manifest,
       optionally resuming any that already exist locally, and assures

go.mod

@@ -12,13 +12,13 @@ require (
 	github.com/pterm/pterm v0.12.35
 	github.com/spf13/afero v1.8.0
 	github.com/stretchr/testify v1.8.1
-	github.com/urfave/cli/v2 v2.27.7
+	github.com/urfave/cli/v2 v2.23.6
 	google.golang.org/protobuf v1.28.1
 )
 
 require (
 	github.com/atomicgo/cursor v0.0.1 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
 	github.com/fatih/color v1.7.0 // indirect
 	github.com/gookit/color v1.4.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.0.9 // indirect
@@ -34,7 +34,7 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
-	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
+	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
 	golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e // indirect
 	golang.org/x/sys v0.1.0 // indirect
 	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect

go.sum

@@ -61,8 +61,8 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
-github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
+github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
+github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -231,12 +231,12 @@ github.com/tj/go-buffer v1.1.0/go.mod h1:iyiJpfFcR2B9sXu7KvjbT9fpM4mOelRSDTbntVj
 github.com/tj/go-elastic v0.0.0-20171221160941-36157cbbebc2/go.mod h1:WjeM0Oo1eNAjXGDx2yma7uG2XoyRZTq1uv3M/o7imD0=
 github.com/tj/go-kinesis v0.0.0-20171128231115-08b17f58cb1b/go.mod h1:/yhzCV0xPfx6jb1bBgRFjl5lytqVqZXEaeqWP8lTEao=
 github.com/tj/go-spin v1.1.0/go.mod h1:Mg1mzmePZm4dva8Qz60H2lHwmJ2loum4VIrLgVnKwh4=
-github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
-github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
+github.com/urfave/cli/v2 v2.23.6 h1:iWmtKD+prGo1nKUtLO0Wg4z9esfBM4rAV4QRLQiEmJ4=
+github.com/urfave/cli/v2 v2.23.6/go.mod h1:GHupkWPMM0M/sj1a2b4wUrWBPzazNrIjouW6fmdJLxc=
 github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 h1:QldyIu/L63oPpyvQmHgvgickp1Yw510KJOqX7H24mg8=
 github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778/go.mod h1:2MuV+tbUrU1zIOPMxZ5EncGwgmMJsa+9ucAQZXxsObs=
-github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
-github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
+github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
+github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=

internal/cli/check.go

@@ -11,7 +11,6 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
-	"sync"
 	"time"
 
 	"github.com/dustin/go-humanize"
@@ -76,22 +75,25 @@ func safeRateUint64(rate float64) uint64 {
 	return uint64(rate)
 }
 
-// findManifest returns the path of the manifest with the default name in
-// dir, or an error if there is none.
+// findManifest looks for a manifest file in the given directory.
+// It checks for index.mf and .index.mf, returning the first one found.
 func findManifest(fs afero.Fs, dir string) (string, error) {
-	path := filepath.Join(dir, defaultManifestName)
+	candidates := []string{"index.mf", ".index.mf"}
+	for _, name := range candidates {
+		path := filepath.Join(dir, name)
 
 		exists, err := afero.Exists(fs, path)
 		if err != nil {
 			return "", err
 		}
 
-	if !exists {
-		return "", fmt.Errorf("%w in %s (looked for %s)",
-			errNoManifestFound, dir, defaultManifestName)
+		if exists {
+			return path, nil
+		}
 	}
 
-	return path, nil
+	return "", fmt.Errorf(
+		"%w in %s (looked for index.mf and .index.mf)", errNoManifestFound, dir)
 }
 
 // fetchManifestToTemp downloads a manifest URL to a temporary file and
@@ -164,9 +166,7 @@ func verifyRequiredSigner(
 }
 
 // reportCheckProgress renders progress updates until the channel closes.
-func reportCheckProgress(progress <-chan mfer.CheckStatus, wg *sync.WaitGroup) {
-	defer wg.Done()
-
+func reportCheckProgress(progress <-chan mfer.CheckStatus) {
 	for status := range progress {
 		if status.ETA > 0 {
 			log.Progressf("Checking: %d/%d files, %s/s, ETA %s, %d failures",
@@ -206,33 +206,28 @@ func countCheckFailures(
 }
 
 // findExtraFiles reports files present on disk but absent from the
-// manifest: each is a failure under --no-extra-files, otherwise a warning.
+// manifest, counting each as a failure.
 func findExtraFiles(ctx *cli.Context, chk *mfer.Checker, failures *int64) error {
 	extraResults := make(chan mfer.Result, 1)
 	extraDone := make(chan struct{})
 
 	go func() {
 		for result := range extraResults {
-			if ctx.Bool("no-extra-files") {
 			*failures++
 
 			log.Infof("%s: %s (%s)", result.Status, result.Path, result.Message)
-			} else {
-				log.Warnf("%s: %s (%s)", result.Status, result.Path, result.Message)
-			}
 		}
 
 		close(extraDone)
 	}()
 
 	err := chk.FindExtraFiles(ctx.Context, extraResults)
-
-	<-extraDone
-
 	if err != nil {
 		return fmt.Errorf("failed to check for extra files: %w", err)
 	}
 
+	<-extraDone
+
 	return nil
 }
 
@@ -243,17 +238,11 @@ func runCheck(ctx *cli.Context, chk *mfer.Checker, showProgress bool) (int64, er
 	results := make(chan mfer.Result, 1)
 
 	// Set up progress channel
-	var (
-		progress   chan mfer.CheckStatus
-		progressWg sync.WaitGroup
-	)
-
+	var progress chan mfer.CheckStatus
 	if showProgress {
 		progress = make(chan mfer.CheckStatus, 1)
 
-		progressWg.Add(1)
-
-		go reportCheckProgress(progress, &progressWg)
+		go reportCheckProgress(progress)
 	}
 
 	// Process results in a goroutine
@@ -265,9 +254,6 @@ func runCheck(ctx *cli.Context, chk *mfer.Checker, showProgress bool) (int64, er
 
 	// Run check
 	err := chk.Check(ctx.Context, results, progress)
-
-	progressWg.Wait()
-
 	if err != nil {
 		return 0, fmt.Errorf("check failed: %w", err)
 	}
@@ -275,15 +261,12 @@ func runCheck(ctx *cli.Context, chk *mfer.Checker, showProgress bool) (int64, er
 	// Wait for results processing to complete
 	<-done
 
-	// Without --no-extra-files the result depends only on the files the
-	// manifest lists, so failing to look for others is only a warning.
+	// Check for extra files if requested
+	if ctx.Bool("no-extra-files") {
 		err = findExtraFiles(ctx, chk, &failures)
 		if err != nil {
-		if ctx.Bool("no-extra-files") {
 			return 0, err
 		}
-
-		log.Warn(err.Error())
 	}
 
 	return failures, nil
@@ -315,11 +298,7 @@ func (mfa *CLIApp) checkManifestOperation(ctx *cli.Context) error {
 	log.Infof("checking manifest %s with base %s", manifestPath, basePath)
 
 	// Create checker
-	chk, err := mfer.NewChecker(&mfer.CheckerOptions{
-		ManifestPath: manifestPath,
-		BasePath:     basePath,
-		Fs:           mfa.Fs,
-	})
+	chk, err := mfer.NewChecker(manifestPath, basePath, mfa.Fs)
 	if err != nil {
 		return fmt.Errorf("failed to load manifest: %w", err)
 	}

internal/cli/entry_test.go

@@ -8,12 +8,8 @@ import (
 	"io"
 	"math/rand"
 	"os"
-	"path/filepath"
-	"slices"
-	"strings"
 	"sync"
 	"testing"
-	"time"
 
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
@@ -29,11 +25,11 @@ const (
 	testFile1       = "/testdir/file1.txt"
 	testMF          = "/testdir/test.mf"
 	testOutput      = "/output.mf"
+	testOutputTmp   = "/output.mf.tmp"
 	testManifest    = "/manifest.mf"
 	testFlagBase    = "--base"
 	testFlagNoExtra = "--no-extra-files"
 	testFlagVersion = "--version"
-	testFlagVerbose = "--verbose"
 )
 
 var errSimulatedWrite = errors.New("simulated write failure")
@@ -46,32 +42,20 @@ var errSimulatedWrite = errors.New("simulated write failure")
 var runMu sync.Mutex
 
 // runCLI invokes RunWithOptions while holding runMu so parallel tests
-// capture their own output, and returns its exit code.
+// capture their own output. Before releasing the lock it points the
+// process-global logger at io.Discard: other tests log outside the lock
+// (manifest loads, scans), and those lines must not land in this run's
+// buffers once it has returned and its test is reading them.
 func runCLI(opts *RunOptions) int {
-	exitCode, _ := runCLIWithLevel(opts)
-
-	return exitCode
-}
-
-// runCLIWithLevel is runCLI that also returns the log level the run left
-// set, read while runMu still keeps other runs from changing it. Each run
-// starts at the default level, as a new process does. Before releasing the
-// lock it points the process-global logger at io.Discard: other tests log
-// outside the lock (manifest loads, scans), and those lines must not land in
-// this run's buffers once it has returned and its test is reading them.
-func runCLIWithLevel(opts *RunOptions) (int, log.Level) {
 	runMu.Lock()
 	defer runMu.Unlock()
 
-	log.SetLevel(log.InfoLevel)
-
 	exitCode := RunWithOptions(opts)
-	level := log.GetLevel()
 
 	log.SetOutput(io.Discard, io.Discard)
 	log.Init()
 
-	return exitCode, level
+	return exitCode
 }
 
 func TestMain(m *testing.M) {
@@ -251,90 +235,6 @@ func TestRootVerbosityFlags(t *testing.T) {
 	})
 }
 
-// commandsTakingVerbose returns the command lines -v can follow: the root and
-// the generate, check, freshen and fetch subcommands.
-func commandsTakingVerbose() [][]string {
-	return [][]string{
-		{testApp},
-		{testApp, cmdGenerate},
-		{testApp, cmdCheck},
-		{testApp, cmdFreshen},
-		{testApp, cmdFetch},
-	}
-}
-
-// TestVerboseCount asserts that one -v or --verbose gives verbose output and
-// two -v give debug output (issue #125). urfave/cli before v2.25.5 counted a
-// flag given by its alias twice, so one -v gave debug output.
-func TestVerboseCount(t *testing.T) {
-	t.Parallel()
-
-	cases := []struct {
-		flags []string
-		want  log.Level
-	}{
-		{[]string{"-v"}, log.VerboseLevel},
-		{[]string{testFlagVerbose}, log.VerboseLevel},
-		{[]string{"-v", "-v"}, log.DebugLevel},
-	}
-
-	for _, command := range commandsTakingVerbose() {
-		for _, tc := range cases {
-			args := slices.Concat(command, tc.flags)
-
-			t.Run(strings.Join(args, " "), func(t *testing.T) {
-				t.Parallel()
-
-				_, level := runCLIWithLevel(testOpts(args, afero.NewMemMapFs()))
-				assert.Equal(t, tc.want, level)
-			})
-		}
-	}
-}
-
-// TestCombinedShortVerboseRefused asserts that -vv is refused (issue #125):
-// single-letter flags do not combine, so the -v help text says -v -v.
-func TestCombinedShortVerboseRefused(t *testing.T) {
-	t.Parallel()
-
-	for _, command := range commandsTakingVerbose() {
-		args := slices.Concat(command, []string{"-vv"})
-
-		t.Run(strings.Join(args, " "), func(t *testing.T) {
-			t.Parallel()
-
-			opts := testOpts(args, afero.NewMemMapFs())
-			exitCode, level := runCLIWithLevel(opts)
-
-			assert.Equal(t, 1, exitCode)
-			assert.Contains(t, testStderr(t, opts), "flag provided but not defined: -vv")
-			assert.Equal(t, log.InfoLevel, level)
-		})
-	}
-}
-
-// TestShortAndLongVerboseRefused asserts that -v and --verbose given together
-// are refused (issue #125): urfave/cli v2 refuses a flag given under two of its
-// names, and one flag with an alias keeps help and parsing simple.
-func TestShortAndLongVerboseRefused(t *testing.T) {
-	t.Parallel()
-
-	for _, command := range commandsTakingVerbose() {
-		args := slices.Concat(command, []string{"-v", testFlagVerbose})
-
-		t.Run(strings.Join(args, " "), func(t *testing.T) {
-			t.Parallel()
-
-			opts := testOpts(args, afero.NewMemMapFs())
-			exitCode, level := runCLIWithLevel(opts)
-
-			assert.Equal(t, 1, exitCode)
-			assert.Contains(t, testStderr(t, opts), "Cannot use two forms of the same flag")
-			assert.Equal(t, log.InfoLevel, level)
-		})
-	}
-}
-
 func TestHelpCommand(t *testing.T) {
 	t.Parallel()
 
@@ -394,67 +294,6 @@ func TestGenerateAndCheckCommand(t *testing.T) {
 	assert.Equal(t, 0, exitCode, "check failed: %s", testStderr(t, opts))
 }
 
-// sharedWriter appends to a buffer shared with other sharedWriters, so
-// output written to stdout and stderr is kept in the order it was written.
-// Each write first waits for delay.
-type sharedWriter struct {
-	mu    *sync.Mutex
-	buf   *bytes.Buffer
-	delay time.Duration
-}
-
-func (w sharedWriter) Write(p []byte) (int, error) {
-	time.Sleep(w.delay)
-
-	w.mu.Lock()
-	defer w.mu.Unlock()
-
-	return w.buf.Write(p)
-}
-
-// TestCheckClearsProgressBeforeSummary asserts that check --progress writes
-// its last progress line and clears it before it logs the summary. Progress
-// writes are slowed down, so a progress goroutine that check did not wait for
-// would write after the summary, or after the run has returned.
-func TestCheckClearsProgressBeforeSummary(t *testing.T) {
-	t.Parallel()
-
-	fs := afero.NewMemMapFs()
-	require.NoError(t, fs.MkdirAll(testDir, 0o755))
-	writeTestFile(t, fs, testFile1, "hello world")
-
-	opts := testOpts([]string{testApp, cmdGenerate, "-q", "-o", testMF, testDir}, fs)
-	require.Equal(t, 0, runCLI(opts), "generate failed: %s", testStderr(t, opts))
-
-	var (
-		mu     sync.Mutex
-		output bytes.Buffer
-	)
-
-	opts = testOpts([]string{
-		testApp, cmdCheck, "--progress", testFlagBase, testDir, testMF,
-	}, fs)
-	opts.Stdout = sharedWriter{mu: &mu, buf: &output, delay: 100 * time.Millisecond}
-	opts.Stderr = sharedWriter{mu: &mu, buf: &output}
-	require.Equal(t, 0, runCLI(opts))
-
-	mu.Lock()
-	got := output.String()
-	mu.Unlock()
-
-	lastProgress := strings.Index(got, "Checking: 1/1 files")
-	progressDone := strings.Index(got, "\r\033[K")
-	summary := strings.Index(got, "checked 1 files")
-
-	require.NotEqual(t, -1, lastProgress, "no last progress line in %q", got)
-	require.NotEqual(t, -1, progressDone, "progress line never cleared in %q", got)
-	require.NotEqual(t, -1, summary, "no summary in %q", got)
-	assert.Less(t, lastProgress, progressDone,
-		"progress cleared before its last line in %q", got)
-	assert.Less(t, progressDone, summary,
-		"summary logged before progress was cleared in %q", got)
-}
-
 func TestCheckCommandWithMissingFile(t *testing.T) {
 	t.Parallel()
 
@@ -566,10 +405,7 @@ func TestGenerateExcludesDotfilesByDefault(t *testing.T) {
 	assert.True(t, exists)
 
 	// Verify manifest only has 1 file (the non-dotfile)
-	manifest, err := mfer.NewManifestFromFile(&mfer.ManifestFromFileOptions{
-		Path: testMF,
-		Fs:   fs,
-	})
+	manifest, err := mfer.NewManifestFromFile(fs, testMF)
 	require.NoError(t, err)
 	assert.Len(t, manifest.Files(), 1)
 	assert.Equal(t, "file1.txt", manifest.Files()[0].GetPath())
@@ -593,10 +429,7 @@ func TestGenerateWithIncludeDotfiles(t *testing.T) {
 	require.Equal(t, 0, exitCode)
 
 	// Verify manifest has 2 files (including dotfile)
-	manifest, err := mfer.NewManifestFromFile(&mfer.ManifestFromFileOptions{
-		Path: testMF,
-		Fs:   fs,
-	})
+	manifest, err := mfer.NewManifestFromFile(fs, testMF)
 	require.NoError(t, err)
 	assert.Len(t, manifest.Files(), 2)
 }
@@ -698,150 +531,30 @@ func TestNoExtraFilesWithSubdirectory(t *testing.T) {
 		"check should fail when extra files exist in subdirectory")
 }
 
-// TestCheckWarnsAboutUnlistedFiles adds one file the manifest does not list
-// to a tree that had none: it gets one warning and the check passes, unless
-// --no-extra-files makes it a failure. --quiet hides the warning, not the
-// failure.
-func TestCheckWarnsAboutUnlistedFiles(t *testing.T) {
-	t.Parallel()
-
-	for name, unlisted := range map[string]string{
-		"regular file":             "extra.txt",
-		"dotfile":                  ".hidden",
-		"file in hidden directory": ".git/config",
-	} {
-		t.Run(name, func(t *testing.T) {
+func TestCheckWithoutNoExtraFilesIgnoresExtra(t *testing.T) {
 	t.Parallel()
 
 	fs := afero.NewMemMapFs()
+
+	// Create test file
 	require.NoError(t, fs.MkdirAll(testDir, 0o755))
 	writeTestFile(t, fs, testFile1, "hello")
 
-			opts := testOpts([]string{
-				testApp, cmdGenerate, "-q", "-o", testManifest, testDir,
-			}, fs)
-			require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
+	// Generate manifest
+	opts := testOpts([]string{testApp, cmdGenerate, "-q", "-o", testManifest, testDir}, fs)
+	exitCode := runCLI(opts)
+	require.Equal(t, 0, exitCode)
 
-			check := func(flags ...string) (int, string) {
-				args := append([]string{testApp, cmdCheck, testFlagBase, testDir}, flags...)
-				opts := testOpts(append(args, testManifest), fs)
+	// Add extra file
+	writeTestFile(t, fs, "/testdir/extra.txt", "extra")
 
-				return runCLI(opts), testStderr(t, opts)
-			}
-
-			exitCode, stderr := check()
-			assert.Equal(t, 0, exitCode, "stderr: %s", stderr)
-			assert.NotContains(t, stderr, "not in manifest")
-
-			writeTestFile(t, fs, filepath.Join(testDir, unlisted), "unlisted")
-
-			exitCode, stderr = check()
-			assert.Equal(t, 0, exitCode, "stderr: %s", stderr)
-			assert.Equal(t, 1, strings.Count(stderr, "not in manifest"), stderr)
-			assert.Contains(t, stderr, unlisted)
-
-			exitCode, stderr = check("-q")
-			assert.Equal(t, 0, exitCode, "stderr: %s", stderr)
-			assert.NotContains(t, stderr, "not in manifest")
-
-			exitCode, stderr = check(testFlagNoExtra)
-			assert.Equal(t, 1, exitCode, "stderr: %s", stderr)
-			assert.Contains(t, stderr, unlisted)
-
-			exitCode, _ = check("-q", testFlagNoExtra)
-			assert.Equal(t, 1, exitCode)
-		})
-	}
-}
-
-// TestCheckNeverReportsManifest keeps the manifest inside the checked tree,
-// under several names and path spellings, and names the tree both directly
-// and through a symlink: the manifest is never reported, even under
-// --no-extra-files. The manifest is recognized by file identity, which needs
-// the real filesystem.
-func TestCheckNeverReportsManifest(t *testing.T) {
-	t.Parallel()
-
-	// Manifest paths are relative to the checked tree.
-	for name, manifest := range map[string]string{
-		"default name":                 defaultManifestName,
-		"hidden name":                  ".index.mf",
-		"other name in a subdirectory": "sub/listing.mf",
-		"path spelled through ..":      "sub/../index.mf",
-	} {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			// A temp dir holding data/tree and link, a symlink to data.
-			root := t.TempDir()
-			tree := filepath.Join(root, "data", "tree")
-			// Not filepath.Join, which would clean away a "..".
-			manifestPath := tree + "/" + manifest
-
-			fs := afero.NewOsFs()
-			require.NoError(t, fs.MkdirAll(filepath.Join(tree, "sub"), 0o750))
-			require.NoError(t,
-				os.Symlink(filepath.Join(root, "data"), filepath.Join(root, "link")))
-			writeTestFile(t, fs, filepath.Join(tree, testFileTxt), "hello")
-
-			opts := testOpts([]string{
-				testApp, cmdGenerate, "-q", "-o", manifestPath, tree,
-			}, fs)
-			require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
-
-			for _, base := range []string{tree, filepath.Join(root, "link", "tree")} {
+	// Check WITHOUT --no-extra-files (should pass - extra files ignored)
 	opts = testOpts([]string{
-					testApp, cmdCheck, testFlagNoExtra, testFlagBase, base, manifestPath,
+		testApp, cmdCheck, "-q", testFlagBase, testDir, testManifest,
 	}, fs)
-				assert.Equal(t, 0, runCLI(opts),
-					"base %s, stderr: %s", base, testStderr(t, opts))
-				assert.NotContains(t, testStderr(t, opts), "not in manifest")
-			}
-		})
-	}
-}
-
-// unlistableDirFs is a filesystem on which one directory cannot be listed.
-type unlistableDirFs struct {
-	afero.Fs
-
-	dir string
-}
-
-//nolint:ireturn // Open must return afero.File to satisfy afero.Fs.
-func (f unlistableDirFs) Open(name string) (afero.File, error) {
-	if name == f.dir {
-		return nil, os.ErrPermission
-	}
-
-	return f.Fs.Open(name)
-}
-
-// TestCheckWithUnlistableDirectory has a directory under the base that
-// cannot be listed: the check still passes, with a warning, unless
-// --no-extra-files is given.
-func TestCheckWithUnlistableDirectory(t *testing.T) {
-	t.Parallel()
-
-	mem := afero.NewMemMapFs()
-	require.NoError(t, mem.MkdirAll("/testdir/locked", 0o755))
-	writeTestFile(t, mem, testFile1, "hello")
-
-	opts := testOpts([]string{
-		testApp, cmdGenerate, "-q", "-o", testManifest, testDir,
-	}, mem)
-	require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
-
-	fs := unlistableDirFs{Fs: mem, dir: "/testdir/locked"}
-
-	opts = testOpts([]string{testApp, cmdCheck, testFlagBase, testDir, testManifest}, fs)
-	assert.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
-	assert.Contains(t, testStderr(t, opts), os.ErrPermission.Error())
-
-	opts = testOpts([]string{
-		testApp, cmdCheck, testFlagNoExtra, testFlagBase, testDir, testManifest,
-	}, fs)
-	assert.Equal(t, 1, runCLI(opts), "stderr: %s", testStderr(t, opts))
+	exitCode = runCLI(opts)
+	assert.Equal(t, 0, exitCode,
+		"check without --no-extra-files should ignore extra files")
 }
 
 func TestGenerateAtomicWriteNoTempFileOnSuccess(t *testing.T) {
@@ -864,7 +577,7 @@ func TestGenerateAtomicWriteNoTempFileOnSuccess(t *testing.T) {
 	assert.True(t, exists, "output file should exist")
 
 	// Verify temp file does NOT exist
-	tmpExists, err := afero.Exists(fs, manifestTempPath(testOutput))
+	tmpExists, err := afero.Exists(fs, testOutputTmp)
 	require.NoError(t, err)
 	assert.False(t, tmpExists,
 		"temp file should not exist after successful generation")
@@ -896,7 +609,7 @@ func TestGenerateAtomicWriteOverwriteWithForce(t *testing.T) {
 		"manifest should be overwritten")
 
 	// Verify temp file does NOT exist
-	tmpExists, err := afero.Exists(fs, manifestTempPath(testOutput))
+	tmpExists, err := afero.Exists(fs, testOutputTmp)
 	require.NoError(t, err)
 	assert.False(t, tmpExists,
 		"temp file should not exist after successful generation")
@@ -925,102 +638,6 @@ func TestGenerateFailsWithoutForceWhenOutputExists(t *testing.T) {
 	assert.Equal(t, "existing", string(content), "original file should be preserved")
 }
 
-// manifestPaths returns the file paths listed by the manifest at path.
-func manifestPaths(t *testing.T, fs afero.Fs, path string) []string {
-	t.Helper()
-
-	manifest, err := mfer.NewManifestFromFile(&mfer.ManifestFromFileOptions{
-		Path: path,
-		Fs:   fs,
-	})
-	require.NoError(t, err)
-
-	paths := make([]string, 0, len(manifest.Files()))
-	for _, f := range manifest.Files() {
-		paths = append(paths, f.GetPath())
-	}
-
-	return paths
-}
-
-// TestGenerateLeavesOutputOutOfListing overwrites an output file inside the
-// scanned tree with --force: the old file is not listed, even when the tree
-// is named through a symlink, while a file named index.mf in a subdirectory
-// still is. The output file is recognized by file identity, which needs
-// the real filesystem.
-func TestGenerateLeavesOutputOutOfListing(t *testing.T) {
-	t.Parallel()
-
-	// Paths are relative to a temp dir holding data/tree and link, a
-	// symlink to data.
-	for name, tc := range map[string]struct{ input, output string }{
-		"default name":                 {"data/tree", "data/tree/index.mf"},
-		"other name in a subdirectory": {"data/tree", "data/tree/sub/listing.mf"},
-		"tree named through a symlink": {"link/tree", "data/tree/index.mf"},
-	} {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			root := t.TempDir()
-			tree := filepath.Join(root, "data", "tree")
-			output := filepath.Join(root, tc.output)
-
-			fs := afero.NewOsFs()
-			require.NoError(t, fs.MkdirAll(filepath.Join(tree, "sub"), 0o750))
-			require.NoError(t,
-				os.Symlink(filepath.Join(root, "data"), filepath.Join(root, "link")))
-			writeTestFile(t, fs, filepath.Join(tree, testFileTxt), "hello")
-			writeTestFile(t, fs, filepath.Join(tree, "sub", "index.mf"), "an ordinary file")
-			writeTestFile(t, fs, output, "previous manifest")
-
-			opts := testOpts([]string{
-				testApp, cmdGenerate, "-q", "--force", "-o", output, filepath.Join(root, tc.input),
-			}, fs)
-			require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
-
-			assert.ElementsMatch(t, []string{testFileTxt, "sub/index.mf"},
-				manifestPaths(t, fs, output))
-		})
-	}
-}
-
-// TestGenerateDefaultOutputLeftOutOfListing runs gen with --force and no
-// other arguments, so it scans the current directory and writes the
-// relative path index.mf: the index.mf already there is not listed.
-//
-//nolint:paralleltest // changes the process-global working directory
-func TestGenerateDefaultOutputLeftOutOfListing(t *testing.T) {
-	chdirTemp(t)
-
-	fs := afero.NewOsFs()
-	writeTestFile(t, fs, testFileTxt, "hello")
-	writeTestFile(t, fs, "index.mf", "previous manifest")
-
-	opts := testOpts([]string{testApp, cmdGenerate, "-q", "--force"}, fs)
-	require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
-
-	assert.Equal(t, []string{testFileTxt}, manifestPaths(t, fs, "index.mf"))
-}
-
-// TestGenerateLeavesLeftoverTempFileOutOfListing runs gen where an
-// interrupted run left its temp file beside the output: the leftover is
-// not listed, and gen does not fail when it overwrites it.
-func TestGenerateLeavesLeftoverTempFileOutOfListing(t *testing.T) {
-	t.Parallel()
-
-	root := t.TempDir()
-	output := filepath.Join(root, "index.mf")
-
-	fs := afero.NewOsFs()
-	writeTestFile(t, fs, filepath.Join(root, testFileTxt), "hello")
-	writeTestFile(t, fs, manifestTempPath(output), "part of a manifest")
-
-	opts := testOpts([]string{testApp, cmdGenerate, "-q", "-o", output, root}, fs)
-	require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
-
-	assert.Equal(t, []string{testFileTxt}, manifestPaths(t, fs, output))
-}
-
 func TestGenerateAtomicWriteUsesTemp(t *testing.T) {
 	t.Parallel()
 
@@ -1043,7 +660,7 @@ func TestGenerateAtomicWriteUsesTemp(t *testing.T) {
 	exists, _ := afero.Exists(fs, testOutput)
 	assert.True(t, exists, "output file should exist")
 
-	tmpExists, _ := afero.Exists(fs, manifestTempPath(testOutput))
+	tmpExists, _ := afero.Exists(fs, testOutputTmp)
 	assert.False(t, tmpExists, "temp file should be cleaned up")
 
 	// Verify manifest is valid (not empty)
@@ -1109,7 +726,7 @@ func TestGenerateAtomicWriteCleansUpOnError(t *testing.T) {
 		"output file should not exist after failed generation (atomic write)")
 
 	// Temp file should also not exist
-	tmpExists, _ := afero.Exists(baseFs, manifestTempPath(testOutput))
+	tmpExists, _ := afero.Exists(baseFs, testOutputTmp)
 	assert.False(t, tmpExists,
 		"temp file should be cleaned up after failed generation")
 }

internal/cli/errmsg_test.go

@@ -61,11 +61,7 @@ func unsignedChecker(t *testing.T) *mfer.Checker {
 	require.NoError(t, s.ToManifest(context.Background(), &buf, nil))
 	require.NoError(t, afero.WriteFile(fs, "/d/index.mf", buf.Bytes(), 0o644))
 
-	chk, err := mfer.NewChecker(&mfer.CheckerOptions{
-		ManifestPath: "/d/index.mf",
-		BasePath:     "/d",
-		Fs:           fs,
-	})
+	chk, err := mfer.NewChecker("/d/index.mf", "/d", fs)
 	require.NoError(t, err)
 	require.False(t, chk.IsSigned())
 
@@ -78,7 +74,7 @@ func TestNoManifestFoundMessage(t *testing.T) {
 	_, err := findManifest(afero.NewMemMapFs(), "/tmp/x")
 	require.ErrorIs(t, err, errNoManifestFound)
 	assert.EqualError(t, err,
-		"no manifest found in /tmp/x (looked for index.mf)")
+		"no manifest found in /tmp/x (looked for index.mf and .index.mf)")
 }
 
 func TestVerifyRequiredSignerMessages(t *testing.T) {
@@ -171,11 +167,7 @@ func signedChecker(t *testing.T) *mfer.Checker {
 	fs := afero.NewMemMapFs()
 	require.NoError(t, afero.WriteFile(fs, "/index.mf", buf.Bytes(), 0o644))
 
-	chk, err := mfer.NewChecker(&mfer.CheckerOptions{
-		ManifestPath: "/index.mf",
-		BasePath:     "/",
-		Fs:           fs,
-	})
+	chk, err := mfer.NewChecker("/index.mf", "/", fs)
 	require.NoError(t, err)
 	require.True(t, chk.IsSigned())
 
@@ -272,15 +264,10 @@ func TestFetchManifestHTTPStatusMessage(t *testing.T) {
 		}))
 	defer server.Close()
 
-	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
-
-	set := flag.NewFlagSet(cmdFetch, flag.ContinueOnError)
-	for _, f := range mfa.fetchCommand().Flags {
-		require.NoError(t, f.Apply(set))
-	}
-
+	set := flag.NewFlagSet("fetch", flag.ContinueOnError)
 	require.NoError(t, set.Parse([]string{server.URL}))
 
+	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
 	ctx := urfcli.NewContext(nil, set, nil)
 
 	// fetchManifestOperation logs to the process-global logger.
@@ -298,11 +285,8 @@ func TestFetchFileHTTPStatusMessage(t *testing.T) {
 		}))
 	defer server.Close()
 
-	// downloadFile logs each retry of the 500 to the process-global logger.
-	err := runLocked(func() error {
-		return downloadFile(context.Background(), testClient(), server.URL+"/x", "x",
+	err := downloadFile(context.Background(), server.URL+"/x", "x",
 		&mfer.MFFilePath{}, nil)
-	})
 	require.ErrorIs(t, err, errHTTPStatus)
 	assert.EqualError(t, err, "HTTP 500")
 }

internal/cli/fetch.go

@@ -7,13 +7,11 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"math/rand/v2"
-	"net"
 	"net/http"
 	"net/url"
 	"os"
+	"path"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"time"
 
@@ -47,33 +45,12 @@ const (
 	bpsPerGbps = 1e9
 	bpsPerMbps = 1e6
 	bpsPerKbps = 1e3
-
-	// httpTimeout is the default time limit for one HTTP request, from
-	// connecting to reading the last byte of the body. It also bounds how
-	// long one file may take to download; fetch's --timeout changes it.
-	httpTimeout = 10 * time.Minute
-
-	// fetchAttempts is how many times fetch tries a request before it
-	// gives up on a transient failure.
-	fetchAttempts = 5
-
-	// firstRetryDelay is the longest fetch waits before its first retry.
-	// The limit doubles for each retry after that; the wait itself is
-	// random up to the limit.
-	firstRetryDelay = time.Second
-
-	// maxRetryAfter is the longest wait a server's Retry-After header can
-	// ask for. A server asking for longer fails the request at once.
-	maxRetryAfter = time.Minute
 )
 
 var (
 	// errURLRequired indicates the fetch command was run without a URL
 	// argument.
 	errURLRequired = errors.New("URL argument required")
-	// errInvalidTimeout indicates a fetch --timeout of zero or less, which
-	// http.Client would take as no time limit at all.
-	errInvalidTimeout = errors.New("--timeout must be greater than zero")
 	// errEmptyPath indicates an empty file path in the manifest.
 	errEmptyPath = errors.New("empty path")
 	// errAbsolutePath indicates an absolute file path in the manifest.
@@ -101,109 +78,24 @@ type DownloadProgress struct {
 	ETA         time.Duration // Estimated time to completion
 }
 
-// retryingClient is the HTTP client fetch makes every request with. It
-// waits up to firstDelay, which must be positive, before its first retry
-// of a transient failure. Tests shorten both the client's timeout and
-// firstDelay.
-type retryingClient struct {
-	client     *http.Client
-	firstDelay time.Duration
-}
-
-// get issues a GET for rawURL and passes a 200 OK response to use.
+// httpGet issues a GET request for the given URL using the provided
+// context and returns the response. The caller must close the body.
 //
-// A connection error, a timeout, or a 5xx or 429 status is retried, up to
-// fetchAttempts tries in all. Before each retry it waits a random time up
-// to a limit that doubles each time, unless the server's Retry-After
-// header says how long to wait. Any other failure, an error from use
-// included, is returned at once and unwrapped; a non-OK status is
-// returned as errHTTPStatus. use must start over each time it is called,
-// since a retry calls it again with a new response.
-func (c retryingClient) get(
-	ctx context.Context, rawURL string, use func(*http.Response) error,
-) error {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, rawURL, nil)
+// Errors are returned unwrapped: this helper replaced direct http.Get
+// calls, and each caller already supplies its own context string, so
+// adding one here would change user-visible messages.
+func httpGet(ctx context.Context, fileURL string) (*http.Response, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fileURL, nil)
 	if err != nil {
-		return err
+		return nil, err
 	}
 
-	delay := c.firstDelay
-
-	for attempt := 1; ; attempt++ {
-		// Wait a random time up to delay, so that clients that failed
-		// together do not all retry together.
-		wait := rand.N(delay) //nolint:gosec // G404: jitter, not a secret
-
-		var retry bool
-
-		resp, err := c.client.Do(req)
-
-		switch {
-		case err != nil:
-			retry = isConnectionError(err)
-		case resp.StatusCode == http.StatusOK:
-			err = use(resp)
-			retry = isConnectionError(err)
-
-			_ = resp.Body.Close()
-		default:
-			_ = resp.Body.Close()
-
-			err = fmt.Errorf("%w %d", errHTTPStatus, resp.StatusCode)
-			retry = resp.StatusCode >= http.StatusInternalServerError ||
-				resp.StatusCode == http.StatusTooManyRequests
-
-			after, ok := retryAfter(resp.Header.Get("Retry-After"))
-			if ok {
-				wait = after
-				retry = retry && after <= maxRetryAfter
-			}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
 	}
 
-		if !retry || attempt == fetchAttempts || ctx.Err() != nil {
-			return err
-		}
-
-		log.Warnf("%s: %s, retrying in %s", rawURL, err, wait.Round(time.Millisecond))
-
-		select {
-		case <-ctx.Done():
-			return ctx.Err()
-		case <-time.After(wait):
-		}
-
-		delay *= 2
-	}
-}
-
-// isConnectionError reports whether err is a connection error or a
-// timeout: a connection that could not be made, was reset, or closed
-// early, or a request that ran out of time.
-func isConnectionError(err error) bool {
-	var (
-		opErr  *net.OpError
-		netErr net.Error
-	)
-
-	return errors.As(err, &opErr) ||
-		(errors.As(err, &netErr) && netErr.Timeout()) ||
-		errors.Is(err, io.EOF) || errors.Is(err, io.ErrUnexpectedEOF)
-}
-
-// retryAfter returns the wait a Retry-After header value asks for, given
-// either in seconds or as an HTTP date. ok is false if there is none.
-func retryAfter(value string) (time.Duration, bool) {
-	seconds, err := strconv.Atoi(value)
-	if err == nil {
-		return time.Duration(seconds) * time.Second, true
-	}
-
-	when, err := http.ParseTime(value)
-	if err == nil {
-		return time.Until(when), true
-	}
-
-	return 0, false
+	return resp, nil
 }
 
 // reportDownloadProgress renders download progress until the channel
@@ -227,23 +119,25 @@ func reportDownloadProgress(progress <-chan DownloadProgress, done chan<- struct
 }
 
 // manifestBaseURL returns the URL of the directory containing the
-// manifest.
+// manifest, with a trailing slash.
 func manifestBaseURL(manifestURL string) (*url.URL, error) {
-	parsed, err := url.Parse(manifestURL)
+	baseURL, err := url.Parse(manifestURL)
 	if err != nil {
 		return nil, fmt.Errorf("fetch: invalid manifest URL: %w", err)
 	}
 
-	// JoinPath cleans the path it builds, so ".." drops the manifest's
-	// file name.
-	return parsed.JoinPath(".."), nil
+	baseURL.Path = path.Dir(baseURL.Path)
+	if !strings.HasSuffix(baseURL.Path, "/") {
+		baseURL.Path += "/"
+	}
+
+	return baseURL, nil
 }
 
 // downloadManifestFiles downloads every file in the manifest, reporting
 // progress on the progress channel.
 func downloadManifestFiles(
 	ctx context.Context,
-	client retryingClient,
 	baseURL *url.URL,
 	files []*mfer.MFFilePath,
 	progress chan<- DownloadProgress,
@@ -255,12 +149,10 @@ func downloadManifestFiles(
 			return fmt.Errorf("invalid path in manifest: %w", err)
 		}
 
-		// JoinPath takes escaped path text, so a name such as "100%.txt"
-		// must be escaped first.
-		fileURL := baseURL.JoinPath(encodeFilePath(f.GetPath())).String()
+		fileURL := baseURL.String() + encodeFilePath(f.GetPath())
 		log.Infof("fetching %s", f.GetPath())
 
-		err = downloadFile(ctx, client, fileURL, localPath, f, progress)
+		err = downloadFile(ctx, fileURL, localPath, f, progress)
 		if err != nil {
 			return fmt.Errorf("failed to download %s: %w", f.GetPath(), err)
 		}
@@ -276,41 +168,30 @@ func (mfa *CLIApp) fetchManifestOperation(ctx *cli.Context) error {
 		return errURLRequired
 	}
 
-	timeout := ctx.Duration(flagTimeout)
-	if timeout <= 0 {
-		return errInvalidTimeout
-	}
+	inputURL := ctx.Args().Get(0)
 
-	manifestURL, err := resolveManifestURL(ctx.Args().Get(0))
+	manifestURL, err := resolveManifestURL(inputURL)
 	if err != nil {
 		return fmt.Errorf("invalid URL: %w", err)
 	}
 
-	client := retryingClient{
-		client:     &http.Client{Timeout: timeout},
-		firstDelay: firstRetryDelay,
-	}
-
 	log.Infof("fetching manifest from %s", manifestURL)
 
-	// Read the whole manifest before parsing it, so that a connection
-	// lost partway through is retried rather than reported as a bad
-	// manifest.
-	var manifestData []byte
-
-	err = client.get(ctx.Context, manifestURL, func(resp *http.Response) error {
-		var readErr error
-
-		manifestData, readErr = io.ReadAll(resp.Body)
-
-		return readErr
-	})
+	// Fetch manifest
+	resp, err := httpGet(ctx.Context, manifestURL)
 	if err != nil {
 		return fmt.Errorf("failed to fetch manifest: %w", err)
 	}
 
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("failed to fetch manifest: %w %d",
+			errHTTPStatus, resp.StatusCode)
+	}
+
 	// Parse manifest
-	manifest, err := mfer.NewManifestFromReader(bytes.NewReader(manifestData))
+	manifest, err := mfer.NewManifestFromReader(resp.Body)
 	if err != nil {
 		return fmt.Errorf("failed to parse manifest: %w", err)
 	}
@@ -340,7 +221,7 @@ func (mfa *CLIApp) fetchManifestOperation(ctx *cli.Context) error {
 	startTime := time.Now()
 
 	// Download each file
-	dlErr := downloadManifestFiles(ctx.Context, client, baseURL, files, progress)
+	dlErr := downloadManifestFiles(ctx.Context, baseURL, files, progress)
 
 	close(progress)
 	<-done
@@ -432,7 +313,7 @@ func checkNoSymlinks(p string) error {
 
 // resolveManifestURL takes a URL and returns the manifest URL.
 // If the URL already ends with .mf, it's returned as-is.
-// Otherwise, the default manifest name is appended.
+// Otherwise, index.mf is appended.
 func resolveManifestURL(inputURL string) (string, error) {
 	parsed, err := url.Parse(inputURL)
 	if err != nil {
@@ -444,7 +325,15 @@ func resolveManifestURL(inputURL string) (string, error) {
 		return inputURL, nil
 	}
 
-	return parsed.JoinPath(defaultManifestName).String(), nil
+	// Ensure path ends with /
+	if !strings.HasSuffix(parsed.Path, "/") {
+		parsed.Path += "/"
+	}
+
+	// Append index.mf
+	parsed.Path += "index.mf"
+
+	return parsed.String(), nil
 }
 
 // progressWriter wraps an io.Writer and reports progress to a channel.
@@ -553,7 +442,6 @@ func verifyDownloadedHash(digest []byte, entry *mfer.MFFilePath) error {
 // Progress is reported via the progress channel.
 func downloadFile(
 	ctx context.Context,
-	client retryingClient,
 	fileURL, localPath string,
 	entry *mfer.MFFilePath,
 	progress chan<- DownloadProgress,
@@ -581,21 +469,18 @@ func downloadFile(
 
 	tmpPath := tempPathFor(localPath)
 
-	return client.get(ctx, fileURL, func(resp *http.Response) error {
-		return saveResponse(resp, tmpPath, localPath, entry, progress)
-	})
-}
+	// Fetch file
+	resp, err := httpGet(ctx, fileURL)
+	if err != nil {
+		return fmt.Errorf("HTTP request failed: %w", err)
+	}
+
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("%w %d", errHTTPStatus, resp.StatusCode)
+	}
 
-// saveResponse writes resp's body to tmpPath, verifies it against entry,
-// and renames it to localPath. It starts a new temp file each time and
-// removes it on failure, so a retry after a failed try never appends to
-// or keeps a partial file.
-func saveResponse(
-	resp *http.Response,
-	tmpPath, localPath string,
-	entry *mfer.MFFilePath,
-	progress chan<- DownloadProgress,
-) error {
 	// Determine expected size
 	expectedSize := entry.GetSize()
 
@@ -604,7 +489,7 @@ func saveResponse(
 		totalBytes = expectedSize
 	}
 
-	err := checkNoSymlinks(tmpPath)
+	err = checkNoSymlinks(tmpPath)
 	if err != nil {
 		return err
 	}

internal/cli/fetch_test.go

@@ -4,24 +4,16 @@ package cli
 import (
 	"bytes"
 	"context"
-	"flag"
-	"fmt"
 	"io"
-	"net"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
-	"strconv"
-	"sync"
-	"sync/atomic"
 	"testing"
-	"time"
 
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	urfcli "github.com/urfave/cli/v2"
 	"sneak.berlin/go/mfer/mfer"
 )
 
@@ -222,41 +214,6 @@ func fetchTestHandler(
 	}
 }
 
-// manifestOf scans a tree holding files and returns its manifest bytes.
-func manifestOf(t *testing.T, files map[string][]byte) []byte {
-	t.Helper()
-
-	sourceFs := afero.NewMemMapFs()
-	for p, content := range files {
-		require.NoError(t, sourceFs.MkdirAll(filepath.Dir("/"+p), 0o755))
-		require.NoError(t, afero.WriteFile(sourceFs, "/"+p, content, 0o644))
-	}
-
-	return scanToManifest(t, sourceFs)
-}
-
-// testClient returns the client tests download with. Its retries wait
-// milliseconds rather than seconds.
-func testClient() retryingClient {
-	return retryingClient{
-		client:     &http.Client{Timeout: 10 * time.Second},
-		firstDelay: time.Millisecond,
-	}
-}
-
-// getNothing calls client.get for rawURL with a use that reads nothing,
-// under a context that expires after timeout. It holds runMu, since get
-// logs each retry to the process-global logger, and starts the timeout
-// only once it has the lock.
-func getNothing(client retryingClient, rawURL string, timeout time.Duration) error {
-	return runLocked(func() error {
-		ctx, cancel := context.WithTimeout(context.Background(), timeout)
-		defer cancel()
-
-		return client.get(ctx, rawURL, func(*http.Response) error { return nil })
-	})
-}
-
 //nolint:paralleltest // changes the process-global working directory
 func TestFetchFromHTTP(t *testing.T) {
 	// Create source filesystem with test files
@@ -309,8 +266,7 @@ func TestFetchFromHTTP(t *testing.T) {
 		require.NoError(t, err)
 
 		fileURL := baseURL + f.GetPath()
-		err = downloadFile(context.Background(), testClient(),
-			fileURL, localPath, f, progress)
+		err = downloadFile(context.Background(), fileURL, localPath, f, progress)
 		require.NoError(t, err, "failed to download %s", f.GetPath())
 	}
 
@@ -357,7 +313,7 @@ func TestFetchHashMismatch(t *testing.T) {
 	chdirTemp(t)
 
 	// Try to download - should fail with hash mismatch
-	err = downloadFile(context.Background(), testClient(),
+	err = downloadFile(context.Background(),
 		server.URL+"/file.txt", testFileTxt, files[0], nil)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "mismatch")
@@ -403,7 +359,7 @@ func TestFetchSizeMismatch(t *testing.T) {
 	chdirTemp(t)
 
 	// Try to download - should fail with size mismatch
-	err = downloadFile(context.Background(), testClient(),
+	err = downloadFile(context.Background(),
 		server.URL+"/file.txt", testFileTxt, files[0], nil)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "size mismatch")
@@ -461,7 +417,7 @@ func TestFetchProgress(t *testing.T) {
 	}()
 
 	// Download
-	err = downloadFile(context.Background(), testClient(),
+	err = downloadFile(context.Background(),
 		server.URL+"/large.txt", "large.txt", files[0], progress)
 	close(progress)
 	<-done
@@ -567,343 +523,3 @@ func TestFetchReplacesHardLinkAtTempName(t *testing.T) {
 	require.NoError(t, err)
 	assert.Equal(t, "outside", string(outside), "fetch wrote outside the destination")
 }
-
-// TestGetRetriesTransientStatusesOnly answers every request with one
-// status and counts the requests: a 5xx or 429 is retried until
-// fetchAttempts runs out, and any other status fails at once.
-func TestGetRetriesTransientStatusesOnly(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		status   int
-		requests int32
-	}{
-		{http.StatusNotFound, 1},
-		{http.StatusForbidden, 1},
-		{http.StatusInternalServerError, fetchAttempts},
-		{http.StatusServiceUnavailable, fetchAttempts},
-		{http.StatusTooManyRequests, fetchAttempts},
-	}
-
-	for _, tt := range tests {
-		t.Run(http.StatusText(tt.status), func(t *testing.T) {
-			t.Parallel()
-
-			var requests atomic.Int32
-
-			server := httptest.NewServer(
-				http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-					requests.Add(1)
-					w.WriteHeader(tt.status)
-				}))
-			defer server.Close()
-
-			err := getNothing(testClient(), server.URL, 10*time.Second)
-			require.ErrorIs(t, err, errHTTPStatus)
-			require.EqualError(t, err, fmt.Sprintf("HTTP %d", tt.status))
-			assert.Equal(t, tt.requests, requests.Load())
-		})
-	}
-}
-
-// TestGetTimesOutOnStalledServer points get at a server that takes a
-// request and never answers it. The try must give up at the client's
-// timeout and be retried; when every try stalls, get must return a
-// timeout error rather than hang.
-func TestGetTimesOutOnStalledServer(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name       string
-		stallEvery bool
-	}{
-		{"first request stalls", false},
-		{"every request stalls", true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			var requests atomic.Int32
-
-			stop := make(chan struct{})
-			server := httptest.NewServer(
-				http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
-					if requests.Add(1) == 1 || tt.stallEvery {
-						select {
-						case <-r.Context().Done():
-						case <-stop:
-						}
-					}
-				}))
-
-			defer server.Close()
-			defer close(stop)
-
-			client := testClient()
-			client.client.Timeout = 50 * time.Millisecond
-
-			err := getNothing(client, server.URL, 10*time.Second)
-			if !tt.stallEvery {
-				require.NoError(t, err)
-
-				return
-			}
-
-			var netErr net.Error
-			require.ErrorAs(t, err, &netErr)
-			assert.True(t, netErr.Timeout(), "want a timeout, got %v", err)
-		})
-	}
-}
-
-// TestGetHonorsRetryAfter answers the first request with a 503 and a
-// Retry-After header, and any later one with 200 OK. The client's own
-// wait before a retry is an hour, so get finishes in time only if it
-// waits as long as Retry-After says instead. A Retry-After longer than
-// maxRetryAfter must fail at once.
-func TestGetHonorsRetryAfter(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		name     string
-		value    string
-		requests int32
-		wantErr  bool
-	}{
-		{"seconds", "0", 2, false},
-		{"HTTP date", time.Now().Add(-time.Minute).UTC().Format(http.TimeFormat), 2, false},
-		{"too long", strconv.Itoa(int((maxRetryAfter + time.Second).Seconds())), 1, true},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			var requests atomic.Int32
-
-			server := httptest.NewServer(
-				http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-					if requests.Add(1) == 1 {
-						w.Header().Set("Retry-After", tt.value)
-						w.WriteHeader(http.StatusServiceUnavailable)
-					}
-				}))
-			defer server.Close()
-
-			client := testClient()
-			client.firstDelay = time.Hour
-
-			err := getNothing(client, server.URL, 10*time.Second)
-			if tt.wantErr {
-				require.ErrorIs(t, err, errHTTPStatus)
-			} else {
-				require.NoError(t, err)
-			}
-
-			assert.Equal(t, tt.requests, requests.Load())
-		})
-	}
-}
-
-// TestGetStopsWaitingWhenCanceled gives get a server that always answers
-// 503 and an hour's wait before each retry, then lets the context expire
-// during that wait. get returning at all shows it stopped waiting.
-func TestGetStopsWaitingWhenCanceled(t *testing.T) {
-	t.Parallel()
-
-	server := httptest.NewServer(
-		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-			w.WriteHeader(http.StatusServiceUnavailable)
-		}))
-	defer server.Close()
-
-	client := testClient()
-	client.firstDelay = time.Hour
-
-	err := getNothing(client, server.URL, 50*time.Millisecond)
-	require.ErrorIs(t, err, context.DeadlineExceeded)
-}
-
-// TestDownloadFileRetriesToSuccess serves a file that fails twice before
-// it succeeds: first with a 503, then with a body cut off halfway. The
-// download must end with the whole, verified file and no temp file.
-//
-//nolint:paralleltest // changes the process-global working directory
-func TestDownloadFileRetriesToSuccess(t *testing.T) {
-	content := []byte("the whole file, every byte of it")
-
-	manifest, err := mfer.NewManifestFromReader(bytes.NewReader(
-		manifestOf(t, map[string][]byte{testFileTxt: content})))
-	require.NoError(t, err)
-
-	var requests atomic.Int32
-
-	server := httptest.NewServer(
-		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-			switch requests.Add(1) {
-			case 1:
-				w.WriteHeader(http.StatusServiceUnavailable)
-			case 2:
-				// Promise the whole file but send half of it; the server
-				// then closes the connection.
-				w.Header().Set("Content-Length", strconv.Itoa(len(content)))
-				_, _ = w.Write(content[:len(content)/2])
-			default:
-				_, _ = w.Write(content)
-			}
-		}))
-	defer server.Close()
-
-	chdirTemp(t)
-
-	err = downloadFile(context.Background(), testClient(),
-		server.URL+"/"+testFileTxt, testFileTxt, manifest.Files()[0], nil)
-	require.NoError(t, err)
-	assert.Equal(t, int32(3), requests.Load())
-
-	fetched, err := os.ReadFile(testFileTxt)
-	require.NoError(t, err)
-	assert.Equal(t, content, fetched)
-
-	_, err = os.Stat(".file.txt.tmp")
-	assert.True(t, os.IsNotExist(err), "temp file left behind")
-}
-
-// TestFetchBaseURLForms fetches one tree by its directory URL with and
-// without a trailing slash, with a query string, and by its manifest URL.
-// Each must request the same manifest and file paths.
-//
-//nolint:paralleltest // changes the process-global working directory
-func TestFetchBaseURLForms(t *testing.T) {
-	files := map[string][]byte{"one.txt": []byte("1"), "sub/two.txt": []byte("2")}
-	tree := http.StripPrefix("/tree", fetchTestHandler(manifestOf(t, files), files))
-
-	var (
-		mu        sync.Mutex
-		requested []string
-	)
-
-	server := httptest.NewServer(
-		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			mu.Lock()
-
-			requested = append(requested, r.URL.Path)
-
-			mu.Unlock()
-
-			tree.ServeHTTP(w, r)
-		}))
-	defer server.Close()
-
-	inputs := []string{"/tree", "/tree/", "/tree?key=value", "/tree/index.mf"}
-	for _, input := range inputs {
-		t.Run(input, func(t *testing.T) {
-			mu.Lock()
-			requested = nil
-			mu.Unlock()
-
-			chdirTemp(t)
-
-			opts := testOpts([]string{testApp, cmdFetch, "-q", server.URL + input},
-				afero.NewOsFs())
-			require.Equal(t, 0, runCLI(opts), testStderr(t, opts))
-
-			mu.Lock()
-			defer mu.Unlock()
-
-			assert.ElementsMatch(t,
-				[]string{"/tree/index.mf", "/tree/one.txt", "/tree/sub/two.txt"}, requested)
-		})
-	}
-}
-
-// TestFetchEscapedPaths fetches files whose names need escaping in a URL,
-// one of them a name that is itself an escape sequence. Each must arrive
-// under its own name with its own content.
-//
-//nolint:paralleltest // changes the process-global working directory
-func TestFetchEscapedPaths(t *testing.T) {
-	files := map[string][]byte{
-		"a b.txt":                []byte("space"),
-		"a%20b.txt":              []byte("percent sign, two, zero"),
-		"100%.txt":               []byte("percent sign"),
-		"q?x=1#frag.txt":         []byte("question mark and hash"),
-		"dir with space/sub.txt": []byte("directory with a space"),
-	}
-
-	server := httptest.NewServer(fetchTestHandler(manifestOf(t, files), files))
-	defer server.Close()
-
-	chdirTemp(t)
-
-	opts := testOpts([]string{testApp, cmdFetch, "-q", server.URL}, afero.NewOsFs())
-	require.Equal(t, 0, runCLI(opts), testStderr(t, opts))
-
-	for name, content := range files {
-		fetched, err := os.ReadFile(name) //nolint:gosec // test-controlled path
-		require.NoError(t, err)
-		assert.Equal(t, content, fetched, name)
-	}
-}
-
-// TestFetchTimeoutFlag runs fetch with --timeout against a server that
-// never answers. Without the flag's limit the request would wait forever;
-// once fetch gives up on it, the server cancels fetch's context so that
-// fetch returns instead of retrying.
-func TestFetchTimeoutFlag(t *testing.T) {
-	t.Parallel()
-
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	server := httptest.NewServer(
-		http.HandlerFunc(func(_ http.ResponseWriter, r *http.Request) {
-			<-r.Context().Done() // fetch gave up on this request
-			cancel()
-		}))
-	defer server.Close()
-
-	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
-
-	set := flag.NewFlagSet(cmdFetch, flag.ContinueOnError)
-	for _, f := range mfa.fetchCommand().Flags {
-		require.NoError(t, f.Apply(set))
-	}
-
-	require.NoError(t, set.Parse([]string{"--" + flagTimeout, "100ms", server.URL}))
-
-	cliCtx := urfcli.NewContext(nil, set, nil)
-	cliCtx.Context = ctx
-
-	// fetchManifestOperation logs to the process-global logger.
-	err := runLocked(func() error { return mfa.fetchManifestOperation(cliCtx) })
-	require.Error(t, err)
-}
-
-// TestFetchRejectsTimeoutOfZeroOrLess runs fetch with a --timeout of zero
-// and of less than zero. http.Client takes either as no time limit at all,
-// so fetch must refuse it before making any request.
-func TestFetchRejectsTimeoutOfZeroOrLess(t *testing.T) {
-	t.Parallel()
-
-	var requests atomic.Int32
-
-	server := httptest.NewServer(
-		http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
-			requests.Add(1)
-		}))
-	defer server.Close()
-
-	for _, timeout := range []string{"0", "-1s"} {
-		opts := testOpts(
-			[]string{testApp, cmdFetch, "--" + flagTimeout + "=" + timeout, server.URL},
-			afero.NewMemMapFs())
-
-		assert.Equal(t, 1, runCLI(opts), timeout)
-		assert.Contains(t, testStderr(t, opts), errInvalidTimeout.Error(), timeout)
-	}
-
-	assert.Zero(t, requests.Load(), "fetch made a request")
-}

internal/cli/freshen.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
-	"os"
 	"path/filepath"
 	"time"
 
@@ -57,7 +56,7 @@ type freshenEntry struct {
 type freshenScanner struct {
 	fs              afero.Fs
 	absBase         string
-	excluded        []fs.FileInfo // files left out of the listing
+	manifestBase    string
 	includeDotfiles bool
 	followSymlinks  bool
 	showProgress    bool
@@ -157,6 +156,11 @@ func (s *freshenScanner) walk(path string, info fs.FileInfo, walkErr error) erro
 			"freshen: failed to compute relative path for %s: %w", path, err)
 	}
 
+	// Skip the manifest file itself
+	if relPath == s.manifestBase || relPath == "."+s.manifestBase {
+		return nil
+	}
+
 	// Handle dotfiles
 	if !s.includeDotfiles && mfer.IsHiddenPath(filepath.ToSlash(relPath)) {
 		if info.IsDir() {
@@ -181,12 +185,6 @@ func (s *freshenScanner) walk(path string, info fs.FileInfo, walkErr error) erro
 		info = realInfo
 	}
 
-	for _, excluded := range s.excluded {
-		if os.SameFile(info, excluded) {
-			return nil
-		}
-	}
-
 	s.scanCount++
 
 	// Check against existing manifest
@@ -309,7 +307,7 @@ func (h *freshenHasher) processEntry(e *freshenEntry) error {
 func writeFreshenedManifest(
 	ctx context.Context, afs afero.Fs, builder *mfer.Builder, manifestPath string,
 ) error {
-	tmpPath := manifestTempPath(manifestPath)
+	tmpPath := manifestPath + ".tmp"
 
 	outFile, err := afs.Create(tmpPath)
 	if err != nil {
@@ -366,22 +364,10 @@ func (mfa *CLIApp) freshenScan(
 	startScan := time.Now()
 	showProgress := ctx.Bool("progress")
 
-	// Leave out the manifest and a temp file left by an interrupted run,
-	// as gen does. A path that cannot be stat'd, normally because no file
-	// is there, needs no leaving out.
-	var excluded []fs.FileInfo
-
-	for _, p := range []string{manifestPath, manifestTempPath(manifestPath)} {
-		info, err := mfa.Fs.Stat(p)
-		if err == nil {
-			excluded = append(excluded, info)
-		}
-	}
-
 	scanner := &freshenScanner{
 		fs:              mfa.Fs,
 		absBase:         absBase,
-		excluded:        excluded,
+		manifestBase:    filepath.Base(manifestPath),
 		includeDotfiles: ctx.Bool("include-dotfiles"),
 		followSymlinks:  ctx.Bool("follow-symlinks"),
 		showProgress:    showProgress,
@@ -459,10 +445,7 @@ func (mfa *CLIApp) loadExistingEntries(
 	log.Infof("loading manifest from %s", manifestPath)
 
 	// Load existing manifest
-	manifest, err := mfer.NewManifestFromFile(&mfer.ManifestFromFileOptions{
-		Path: manifestPath,
-		Fs:   mfa.Fs,
-	})
+	manifest, err := mfer.NewManifestFromFile(mfa.Fs, manifestPath)
 	if err != nil {
 		return nil, fmt.Errorf("failed to load manifest: %w", err)
 	}
@@ -629,15 +612,7 @@ func addExistingToBuilder(b *mfer.Builder, entry *mfer.MFFilePath) error {
 		return nil
 	}
 
-	err := b.AddFileWithHash(mfer.RelFilePath(entry.GetPath()),
+	return b.AddFileWithHash(mfer.RelFilePath(entry.GetPath()),
 		mfer.FileSize(entry.GetSize()), mfer.ModTime(mtime),
 		entry.GetHashes()[0].GetMultiHash())
-	if err != nil {
-		return fmt.Errorf(
-			"manifest entry %s: %w (regenerate the manifest with mfer generate)",
-			entry.GetPath(), err,
-		)
-	}
-
-	return nil
 }

internal/cli/freshen_test.go

@@ -4,13 +4,10 @@ package cli
 import (
 	"bytes"
 	"context"
-	"crypto/sha256"
 	"os"
-	"path/filepath"
 	"testing"
 	"time"
 
-	"github.com/multiformats/go-multihash"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -32,7 +29,7 @@ func (s stubFileInfo) IsDir() bool        { return false }
 func (s stubFileInfo) Sys() any           { return nil }
 
 // setupFreshenDir populates /testdir with two files, scans it, and
-// writes the resulting manifest to /testdir/index.mf.
+// writes the resulting manifest to /testdir/.index.mf.
 func setupFreshenDir(t *testing.T, fs afero.Fs) {
 	t.Helper()
 
@@ -51,7 +48,7 @@ func setupFreshenDir(t *testing.T, fs afero.Fs) {
 
 	// Write manifest to filesystem
 	require.NoError(t,
-		afero.WriteFile(fs, "/testdir/index.mf", manifestBuf.Bytes(), 0o644))
+		afero.WriteFile(fs, "/testdir/.index.mf", manifestBuf.Bytes(), 0o644))
 }
 
 func TestFreshenUnchanged(t *testing.T) {
@@ -61,10 +58,7 @@ func TestFreshenUnchanged(t *testing.T) {
 	setupFreshenDir(t, fs)
 
 	// Parse manifest to verify
-	manifest, err := mfer.NewManifestFromFile(&mfer.ManifestFromFileOptions{
-		Path: "/testdir/index.mf",
-		Fs:   fs,
-	})
+	manifest, err := mfer.NewManifestFromFile(fs, "/testdir/.index.mf")
 	require.NoError(t, err)
 	assert.Len(t, manifest.Files(), 2)
 }
@@ -76,10 +70,7 @@ func TestFreshenWithChanges(t *testing.T) {
 	setupFreshenDir(t, fs)
 
 	// Verify initial manifest has 2 files
-	manifest, err := mfer.NewManifestFromFile(&mfer.ManifestFromFileOptions{
-		Path: "/testdir/index.mf",
-		Fs:   fs,
-	})
+	manifest, err := mfer.NewManifestFromFile(fs, "/testdir/.index.mf")
 	require.NoError(t, err)
 	assert.Len(t, manifest.Files(), 2)
 
@@ -104,64 +95,6 @@ func TestFreshenWithChanges(t *testing.T) {
 	assert.Equal(t, "modified content2", string(content))
 }
 
-// TestFreshenLeavesManifestOutOfListing freshens a manifest kept in a
-// subdirectory of the tree it lists: the manifest is not listed, while an
-// ordinary file of the same name at the top of the tree is. The manifest
-// is recognized by file identity, which needs the real filesystem.
-func TestFreshenLeavesManifestOutOfListing(t *testing.T) {
-	t.Parallel()
-
-	root := t.TempDir()
-	manifestPath := filepath.Join(root, "sub", "listing.mf")
-
-	fs := afero.NewOsFs()
-	require.NoError(t, fs.MkdirAll(filepath.Join(root, "sub"), 0o750))
-	writeTestFile(t, fs, filepath.Join(root, testFileTxt), "hello")
-	writeTestFile(t, fs, filepath.Join(root, "listing.mf"), "an ordinary file")
-
-	opts := testOpts([]string{testApp, cmdGenerate, "-q", "-o", manifestPath, root}, fs)
-	require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
-
-	// A new file gives freshen something to write.
-	writeTestFile(t, fs, filepath.Join(root, "added.txt"), "added")
-
-	opts = testOpts([]string{
-		testApp, "freshen", "-q", testFlagBase, root, manifestPath,
-	}, fs)
-	require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
-
-	assert.ElementsMatch(t, []string{testFileTxt, "listing.mf", "added.txt"},
-		manifestPaths(t, fs, manifestPath))
-}
-
-// TestFreshenLeavesLeftoverTempFileOutOfListing freshens a manifest where
-// an interrupted run left its temp file beside it: the leftover is not
-// listed.
-func TestFreshenLeavesLeftoverTempFileOutOfListing(t *testing.T) {
-	t.Parallel()
-
-	root := t.TempDir()
-	manifestPath := filepath.Join(root, "index.mf")
-
-	fs := afero.NewOsFs()
-	writeTestFile(t, fs, filepath.Join(root, testFileTxt), "hello")
-
-	opts := testOpts([]string{testApp, cmdGenerate, "-q", "-o", manifestPath, root}, fs)
-	require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
-
-	writeTestFile(t, fs, manifestTempPath(manifestPath), "part of a manifest")
-	// A new file gives freshen something to write.
-	writeTestFile(t, fs, filepath.Join(root, "added.txt"), "added")
-
-	opts = testOpts([]string{
-		testApp, "freshen", "-q", testFlagBase, root, manifestPath,
-	}, fs)
-	require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
-
-	assert.ElementsMatch(t, []string{testFileTxt, "added.txt"},
-		manifestPaths(t, fs, manifestPath))
-}
-
 // TestFreshenRecordEntryMtimePresence pins the behavior of recordEntry
 // with respect to MFFilePath.Mtime, which is a message pointer with
 // proto3 field presence and may legitimately be absent.
@@ -236,50 +169,21 @@ func TestFreshenRecordEntryMtimePresence(t *testing.T) {
 func TestFreshenAddExistingRejectsMissingMtime(t *testing.T) {
 	t.Parallel()
 
-	hash, err := multihash.Encode(make([]byte, sha256.Size), multihash.SHA2_256)
-	require.NoError(t, err)
-
 	b := mfer.NewBuilder()
 	entry := &mfer.MFFilePath{
 		Path:  "file1.txt",
 		Size:  8,
 		Mtime: nil,
 		Hashes: []*mfer.MFFileChecksum{
-			{MultiHash: hash},
+			{MultiHash: []byte{0x12, 0x20}},
 		},
 	}
 
-	err = addExistingToBuilder(b, entry)
+	err := addExistingToBuilder(b, entry)
 	require.ErrorIs(t, err, errEntryMissingMtime)
 	assert.Contains(t, err.Error(), "file1.txt")
 }
 
-// TestFreshenAddExistingRejectsShortHash pins that an existing manifest
-// entry whose hash the builder refuses is reported as a problem with the
-// manifest, with the command that fixes it.
-func TestFreshenAddExistingRejectsShortHash(t *testing.T) {
-	t.Parallel()
-
-	sha1Hash, err := multihash.Encode(make([]byte, 20), multihash.SHA1)
-	require.NoError(t, err)
-
-	b := mfer.NewBuilder()
-	entry := &mfer.MFFilePath{
-		Path:  "old.txt",
-		Size:  8,
-		Mtime: &mfer.Timestamp{Seconds: 1_700_000_000},
-		Hashes: []*mfer.MFFileChecksum{
-			{MultiHash: sha1Hash},
-		},
-	}
-
-	err = addExistingToBuilder(b, entry)
-	require.Error(t, err)
-	assert.Contains(t, err.Error(), "manifest entry old.txt")
-	assert.Contains(t, err.Error(), "mfer generate")
-	assert.Zero(t, b.FileCount())
-}
-
 // TestEntryMtime pins the presence semantics the callers depend on.
 func TestEntryMtime(t *testing.T) {
 	t.Parallel()

internal/cli/gen.go

@@ -89,15 +89,11 @@ func (mfa *CLIApp) collectInputPaths(args cli.Args) ([]string, error) {
 
 // buildScannerOptions constructs scanner options from the CLI flags.
 func (mfa *CLIApp) buildScannerOptions(ctx *cli.Context) *mfer.ScannerOptions {
-	output := ctx.String("output")
 	opts := &mfer.ScannerOptions{
 		IncludeDotfiles:   ctx.Bool("include-dotfiles"),
 		FollowSymLinks:    ctx.Bool("follow-symlinks"),
 		IncludeTimestamps: ctx.Bool("include-timestamps"),
 		Fs:                mfa.Fs,
-		// Neither a manifest being replaced nor a temp file left by an
-		// interrupted run belongs in the new manifest.
-		ExcludePaths: []string{output, manifestTempPath(output)},
 	}
 
 	// Set seed for deterministic UUID if provided
@@ -221,7 +217,7 @@ func (mfa *CLIApp) generateManifestOperation(ctx *cli.Context) error {
 	}
 
 	// Create temp file for atomic write
-	tmpPath := manifestTempPath(outputPath)
+	tmpPath := outputPath + ".tmp"
 
 	outFile, err := mfa.Fs.Create(tmpPath)
 	if err != nil {

internal/cli/manifest_loader.go

@@ -65,7 +65,7 @@ func (mfa *CLIApp) openManifestReader(pathOrURL string) (io.ReadCloser, error) {
 }
 
 // resolveManifestArg resolves the manifest path from CLI arguments.
-// HTTP(S) URLs are returned as-is. Directories are searched for index.mf.
+// HTTP(S) URLs are returned as-is. Directories are searched for index.mf/.index.mf.
 // If no argument is given, the current directory is searched.
 func (mfa *CLIApp) resolveManifestArg(ctx *cli.Context) (string, error) {
 	if ctx.Args().Len() > 0 {

internal/cli/mfer.go

@@ -17,28 +17,15 @@ import (
 const (
 	cmdGenerate = "generate"
 	cmdCheck    = "check"
-	cmdFreshen  = "freshen"
 	cmdExport   = "export"
 	cmdFetch    = "fetch"
 	cmdVersion  = "version"
 
 	flagProgress = "progress"
-	flagTimeout  = "timeout"
 
 	manifestArgsUsage = "[manifest file]"
-
-	// defaultManifestName is the filename gen writes by default, the one
-	// looked for when a command is given a directory, and the one fetch
-	// appends to a directory URL.
-	defaultManifestName = "index.mf"
 )
 
-// manifestTempPath returns the temp file gen and freshen write a manifest
-// to before renaming it to out.
-func manifestTempPath(out string) string {
-	return out + ".tmp"
-}
-
 // errUnknownCommand indicates an unrecognized command argument.
 var errUnknownCommand = errors.New("unknown command")
 
@@ -131,7 +118,7 @@ func commonFlags() []cli.Flag {
 		&cli.BoolFlag{
 			Name:    "verbose",
 			Aliases: []string{"v"},
-			Usage:   "Increase verbosity (-v for verbose, -v -v for debug)",
+			Usage:   "Increase verbosity (-v for verbose, -vv for debug)",
 			Count:   new(int),
 		},
 		&cli.BoolFlag{
@@ -147,7 +134,6 @@ func (mfa *CLIApp) generateCommand() *cli.Command {
 		Name:    cmdGenerate,
 		Aliases: []string{"gen"},
 		Usage:   "Generate manifest file",
-		ArgsUsage: "[path ...]",
 		Action: func(c *cli.Context) error {
 			mfa.setVerbosity(c)
 			mfa.printBanner()
@@ -168,7 +154,7 @@ func (mfa *CLIApp) generateCommand() *cli.Command {
 			},
 			&cli.StringFlag{
 				Name:    "output",
-				Value:   defaultManifestName,
+				Value:   "./.index.mf",
 				Aliases: []string{"o"},
 				Usage:   "Specify output filename",
 			},
@@ -227,7 +213,7 @@ func (mfa *CLIApp) checkCommand() *cli.Command {
 			},
 			&cli.BoolFlag{
 				Name:  "no-extra-files",
-				Usage: "Fail, instead of warning, if files in base directory are not in manifest",
+				Usage: "Fail if files exist in base directory that are not in manifest",
 			},
 			&cli.StringFlag{
 				Name:    "require-signature",
@@ -241,7 +227,7 @@ func (mfa *CLIApp) checkCommand() *cli.Command {
 
 func (mfa *CLIApp) freshenCommand() *cli.Command {
 	return &cli.Command{
-		Name:      cmdFreshen,
+		Name:      "freshen",
 		Usage:     "Update manifest with changed, new, and removed files",
 		ArgsUsage: manifestArgsUsage,
 		Action: func(c *cli.Context) error {
@@ -340,21 +326,13 @@ func (mfa *CLIApp) fetchCommand() *cli.Command {
 	return &cli.Command{
 		Name:  cmdFetch,
 		Usage: "fetch manifest and referenced files",
-		ArgsUsage: "URL",
 		Action: func(c *cli.Context) error {
 			mfa.setVerbosity(c)
 			mfa.printBanner()
 
 			return mfa.fetchManifestOperation(c)
 		},
-		Flags: append(commonFlags(),
-			&cli.DurationFlag{
-				Name:  flagTimeout,
-				Value: httpTimeout,
-				Usage: "Time limit for each HTTP request, including the download " +
-					"of its body",
-			},
-		),
+		Flags: commonFlags(),
 	}
 }
 

mfer/builder.go

@@ -35,8 +35,7 @@ var (
 	errPathDotDot       = errors.New("contains '..' segment")
 	errSizeMismatch     = errors.New("size mismatch")
 	errNegativeSize     = errors.New("size cannot be negative")
-	errHashNotMultihash = errors.New("hash is not a valid multihash")
-	errHashTooShort     = errors.New("hash digest is too short")
+	errEmptyHash        = errors.New("hash cannot be nil or empty")
 )
 
 // ValidatePath checks that a file path conforms to manifest path invariants:
@@ -229,8 +228,7 @@ func (b *Builder) FileCount() int {
 
 // AddFileWithHash adds a file entry with a pre-computed hash.
 // This is useful when the hash is already known (e.g., from an existing manifest).
-// Returns an error if path is invalid, size is negative, or hash is not a
-// multihash with a digest of at least 32 bytes, as long as SHA-256's.
+// Returns an error if path is empty, size is negative, or hash is nil/empty.
 func (b *Builder) AddFileWithHash(
 	path RelFilePath,
 	size FileSize,
@@ -246,19 +244,8 @@ func (b *Builder) AddFileWithHash(
 		return errNegativeSize
 	}
 
-	decoded, err := multihash.Decode(hash)
-	if err != nil {
-		return fmt.Errorf("%w: %w", errHashNotMultihash, err)
-	}
-
-	// The reader's limit on decoding cost (maxDecodedGrowth) assumes every
-	// hash is at least as long as a SHA-256 multihash, so a manifest of
-	// shorter ones could fail to load.
-	if len(decoded.Digest) < sha256.Size {
-		return fmt.Errorf(
-			"%w: %d bytes, at least %d needed",
-			errHashTooShort, len(decoded.Digest), sha256.Size,
-		)
+	if len(hash) == 0 {
+		return errEmptyHash
 	}
 
 	entry := &MFFilePath{

mfer/builder_test.go

@@ -4,15 +4,11 @@ package mfer
 import (
 	"bytes"
 	"context"
-	"crypto/sha256"
 	"fmt"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
 
-	"github.com/multiformats/go-multihash"
-	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -46,10 +42,9 @@ func TestBuilderAddFileWithHash(t *testing.T) {
 	t.Parallel()
 
 	b := NewBuilder()
-	hash, err := multihash.Encode(make([]byte, sha256.Size), multihash.SHA2_256)
-	require.NoError(t, err)
+	hash := make([]byte, 34) // SHA256 multihash is 34 bytes
 
-	err = b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), hash)
+	err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), hash)
 	require.NoError(t, err)
 	assert.Equal(t, 1, b.FileCount())
 }
@@ -57,14 +52,12 @@ func TestBuilderAddFileWithHash(t *testing.T) {
 func TestBuilderAddFileWithHashValidation(t *testing.T) {
 	t.Parallel()
 
-	sha256Hash, err := multihash.Encode(make([]byte, sha256.Size), multihash.SHA2_256)
-	require.NoError(t, err)
-
 	t.Run("empty path", func(t *testing.T) {
 		t.Parallel()
 
 		b := NewBuilder()
-		err := b.AddFileWithHash("", 100, ModTime(time.Now()), sha256Hash)
+		hash := make([]byte, 34)
+		err := b.AddFileWithHash("", 100, ModTime(time.Now()), hash)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "path")
 	})
@@ -73,58 +66,41 @@ func TestBuilderAddFileWithHashValidation(t *testing.T) {
 		t.Parallel()
 
 		b := NewBuilder()
-		err := b.AddFileWithHash("test.txt", -1, ModTime(time.Now()), sha256Hash)
+		hash := make([]byte, 34)
+		err := b.AddFileWithHash("test.txt", -1, ModTime(time.Now()), hash)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "size")
 	})
 
+	t.Run("nil hash", func(t *testing.T) {
+		t.Parallel()
+
+		b := NewBuilder()
+		err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), nil)
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "hash")
+	})
+
+	t.Run("empty hash", func(t *testing.T) {
+		t.Parallel()
+
+		b := NewBuilder()
+		err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), []byte{})
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "hash")
+	})
+
 	t.Run("valid inputs", func(t *testing.T) {
 		t.Parallel()
 
 		b := NewBuilder()
-		err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), sha256Hash)
+		hash := make([]byte, 34)
+		err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), hash)
 		require.NoError(t, err)
 		assert.Equal(t, 1, b.FileCount())
 	})
 }
 
-func TestBuilderAddFileWithHashRejectsBadHashes(t *testing.T) {
-	t.Parallel()
-
-	sha1Hash, err := multihash.Encode(make([]byte, 20), multihash.SHA1)
-	require.NoError(t, err)
-
-	truncatedHash, err := multihash.Encode(make([]byte, sha256.Size-1), multihash.SHA2_256)
-	require.NoError(t, err)
-
-	tests := []struct {
-		name string
-		hash Multihash
-		want error
-	}{
-		{"nil hash", nil, errHashNotMultihash},
-		{"empty hash", []byte{}, errHashNotMultihash},
-		{"one-byte hash", []byte{0x12}, errHashNotMultihash},
-		// A SHA-256 code and 32-byte length, then only two bytes of digest.
-		{"malformed multihash", []byte{0x12, 0x20, 0x01, 0x02}, errHashNotMultihash},
-		// A valid multihash, but its 20-byte SHA-1 digest is too short.
-		{"SHA-1 multihash", sha1Hash, errHashTooShort},
-		// A valid multihash whose 31-byte digest is one byte short.
-		{"31-byte digest", truncatedHash, errHashTooShort},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			t.Parallel()
-
-			b := NewBuilder()
-			err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), tt.hash)
-			require.ErrorIs(t, err, tt.want)
-			assert.Equal(t, 0, b.FileCount())
-		})
-	}
-}
-
 func TestBuilderBuild(t *testing.T) {
 	t.Parallel()
 
@@ -380,8 +356,7 @@ func TestBuilderBuildRoundTrip(t *testing.T) {
 func TestBuilderBuildRoundTripLargeManifest(t *testing.T) {
 	t.Parallel()
 
-	hash, err := multihash.Encode(make([]byte, sha256.Size), multihash.SHA2_256)
-	require.NoError(t, err)
+	hash := make([]byte, 34) // multihash: 2-byte prefix + 32-byte SHA-256
 
 	b := NewBuilder()
 
@@ -422,29 +397,6 @@ func TestNewManifestFromReaderTruncated(t *testing.T) {
 	assert.Error(t, err)
 }
 
-func TestNewManifestFromFileRequiresPath(t *testing.T) {
-	t.Parallel()
-
-	_, err := NewManifestFromFile(nil)
-	require.ErrorIs(t, err, errManifestPathEmpty)
-
-	_, err = NewManifestFromFile(&ManifestFromFileOptions{Fs: afero.NewMemMapFs()})
-	require.ErrorIs(t, err, errManifestPathEmpty)
-}
-
-func TestNewManifestFromFileNilFsUsesOsFs(t *testing.T) {
-	t.Parallel()
-
-	path := filepath.Join(t.TempDir(), "index.mf")
-	createTestManifest(t, afero.NewOsFs(), path, map[string][]byte{
-		testFileName: []byte("hello"),
-	})
-
-	m, err := NewManifestFromFile(&ManifestFromFileOptions{Path: path})
-	require.NoError(t, err)
-	assert.Len(t, m.Files(), 1)
-}
-
 func TestManifestString(t *testing.T) {
 	t.Parallel()
 

mfer/checker.go

@@ -14,11 +14,7 @@ import (
 	"github.com/spf13/afero"
 )
 
-var (
-	errNoSigningPubKey   = errors.New("manifest has no signing public key")
-	errManifestPathEmpty = errors.New("manifest path cannot be empty")
-	errBasePathEmpty     = errors.New("base path cannot be empty")
-)
+var errNoSigningPubKey = errors.New("manifest has no signing public key")
 
 // Result represents the outcome of checking a single file.
 type Result struct {
@@ -77,51 +73,29 @@ type Checker struct {
 	fs       afero.Fs
 	// manifestPaths is a set of paths in the manifest for quick lookup
 	manifestPaths map[RelFilePath]struct{}
-	// manifestInfo is the manifest file, which FindExtraFiles leaves out,
-	// matched with os.SameFile.
-	manifestInfo os.FileInfo
+	// manifestRelPath is the relative path of the manifest file from
+	// basePath (for exclusion)
+	manifestRelPath RelFilePath
 	// signature info from the manifest
 	signature     []byte
 	signer        []byte
 	signingPubKey []byte
 }
 
-// CheckerOptions configures a Checker.
-type CheckerOptions struct {
-	// ManifestPath is the manifest file to check against (required).
-	ManifestPath string
-	// BasePath is the directory relative to which manifest paths are
-	// resolved (required).
-	BasePath string
-	// Fs is the filesystem to use, defaults to OsFs if nil.
-	Fs afero.Fs
-}
-
-// NewChecker creates a new Checker with the given options. It returns an
-// error if opts is nil or either path is empty.
-func NewChecker(opts *CheckerOptions) (*Checker, error) {
-	if opts == nil || opts.ManifestPath == "" {
-		return nil, errManifestPathEmpty
-	}
-
-	if opts.BasePath == "" {
-		return nil, errBasePathEmpty
-	}
-
-	fs := opts.Fs
+// NewChecker creates a new Checker for the given manifest, base path, and filesystem.
+// The basePath is the directory relative to which manifest paths are resolved.
+// If fs is nil, the real filesystem (OsFs) is used.
+func NewChecker(manifestPath string, basePath string, fs afero.Fs) (*Checker, error) {
 	if fs == nil {
 		fs = afero.NewOsFs()
 	}
 
-	m, err := NewManifestFromFile(&ManifestFromFileOptions{
-		Path: opts.ManifestPath,
-		Fs:   fs,
-	})
+	m, err := NewManifestFromFile(fs, manifestPath)
 	if err != nil {
 		return nil, err
 	}
 
-	abs, err := filepath.Abs(opts.BasePath)
+	abs, err := filepath.Abs(basePath)
 	if err != nil {
 		return nil, err
 	}
@@ -133,17 +107,23 @@ func NewChecker(opts *CheckerOptions) (*Checker, error) {
 		manifestPaths[RelFilePath(f.GetPath())] = struct{}{}
 	}
 
-	manifestInfo, err := fs.Stat(opts.ManifestPath)
+	// Compute manifest's relative path from basePath for exclusion in FindExtraFiles
+	absManifest, err := filepath.Abs(manifestPath)
 	if err != nil {
 		return nil, err
 	}
 
+	manifestRel, err := filepath.Rel(abs, absManifest)
+	if err != nil {
+		manifestRel = ""
+	}
+
 	return &Checker{
 		basePath:        AbsFilePath(abs),
 		files:           files,
 		fs:              fs,
 		manifestPaths:   manifestPaths,
-		manifestInfo:  manifestInfo,
+		manifestRelPath: RelFilePath(manifestRel),
 		signature:       m.pbOuter.GetSignature(),
 		signer:          m.pbOuter.GetSigner(),
 		signingPubKey:   m.pbOuter.GetSigningPubKey(),
@@ -267,10 +247,10 @@ func (c *Checker) Check(
 	return nil
 }
 
-// FindExtraFiles walks the filesystem and reports files not in the manifest,
-// hidden files and directories included. The manifest file itself is not
-// reported. Results are sent to the results channel. The channel is closed
-// when done.
+// FindExtraFiles walks the filesystem and reports files not in the manifest.
+// Results are sent to the results channel. The channel is closed when done.
+// Hidden files/directories (starting with .) are skipped, as they are excluded
+// from manifests by default. The manifest file itself is also skipped.
 func (c *Checker) FindExtraFiles(ctx context.Context, results chan<- Result) error {
 	if results != nil {
 		defer close(results)
@@ -293,6 +273,15 @@ func (c *Checker) FindExtraFiles(ctx context.Context, results chan<- Result) err
 			return err
 		}
 
+		// Skip hidden files and directories (dotfiles)
+		if IsHiddenPath(filepath.ToSlash(rel)) {
+			if info.IsDir() {
+				return filepath.SkipDir
+			}
+
+			return nil
+		}
+
 		// Skip directories
 		if info.IsDir() {
 			return nil
@@ -300,8 +289,8 @@ func (c *Checker) FindExtraFiles(ctx context.Context, results chan<- Result) err
 
 		relPath := RelFilePath(rel)
 
-		// Skip the manifest file itself, however its path is spelled
-		if os.SameFile(info, c.manifestInfo) {
+		// Skip the manifest file itself
+		if relPath == c.manifestRelPath {
 			return nil
 		}
 

mfer/checker_test.go

@@ -5,8 +5,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"os"
-	"path/filepath"
 	"testing"
 	"time"
 
@@ -19,8 +17,6 @@ const (
 	testFile1      = "file1.txt"
 	testFile2      = "file2.txt"
 	testExistsFile = "exists.txt"
-	testManifestPath = "/manifest.mf"
-	testDataDir      = "/data"
 )
 
 func TestStatusString(t *testing.T) {
@@ -70,13 +66,15 @@ func createTestManifest(
 }
 
 // createFilesOnDisk creates the given files on the filesystem under
-// testDataDir.
+// /data.
 func createFilesOnDisk(t *testing.T, fs afero.Fs, files map[string][]byte) {
 	t.Helper()
 
+	basePath := "/data"
+
 	for path, content := range files {
-		fullPath := testDataDir + "/" + path
-		require.NoError(t, fs.MkdirAll(testDataDir, 0o755))
+		fullPath := basePath + "/" + path
+		require.NoError(t, fs.MkdirAll(basePath, 0o755))
 		require.NoError(t, afero.WriteFile(fs, fullPath, content, 0o644))
 	}
 }
@@ -92,13 +90,9 @@ func TestNewChecker(t *testing.T) {
 			testFile1: []byte("hello"),
 			testFile2: []byte("world"),
 		}
-		createTestManifest(t, fs, testManifestPath, files)
+		createTestManifest(t, fs, "/manifest.mf", files)
 
-		chk, err := NewChecker(&CheckerOptions{
-			ManifestPath: testManifestPath,
-			BasePath:     "/",
-			Fs:           fs,
-		})
+		chk, err := NewChecker("/manifest.mf", "/", fs)
 		require.NoError(t, err)
 		assert.NotNil(t, chk)
 		assert.Equal(t, FileCount(2), chk.FileCount())
@@ -108,11 +102,7 @@ func TestNewChecker(t *testing.T) {
 		t.Parallel()
 
 		fs := afero.NewMemMapFs()
-		_, err := NewChecker(&CheckerOptions{
-			ManifestPath: "/nonexistent.mf",
-			BasePath:     "/",
-			Fs:           fs,
-		})
+		_, err := NewChecker("/nonexistent.mf", "/", fs)
 		assert.Error(t, err)
 	})
 
@@ -121,73 +111,11 @@ func TestNewChecker(t *testing.T) {
 
 		fs := afero.NewMemMapFs()
 		require.NoError(t, afero.WriteFile(fs, "/bad.mf", []byte("not a manifest"), 0o644))
-		_, err := NewChecker(&CheckerOptions{
-			ManifestPath: "/bad.mf",
-			BasePath:     "/",
-			Fs:           fs,
-		})
+		_, err := NewChecker("/bad.mf", "/", fs)
 		assert.Error(t, err)
 	})
 }
 
-func TestNewCheckerRequiredPaths(t *testing.T) {
-	t.Parallel()
-
-	for _, tc := range []struct {
-		name string
-		opts *CheckerOptions
-		want string
-		is   error
-	}{
-		{
-			name: "nil options",
-			opts: nil,
-			want: "manifest path cannot be empty",
-			is:   errManifestPathEmpty,
-		},
-		{
-			name: "empty manifest path",
-			opts: &CheckerOptions{BasePath: testDataDir},
-			want: "manifest path cannot be empty",
-			is:   errManifestPathEmpty,
-		},
-		{
-			name: "empty base path",
-			opts: &CheckerOptions{ManifestPath: testManifestPath},
-			want: "base path cannot be empty",
-			is:   errBasePathEmpty,
-		},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			t.Parallel()
-
-			chk, err := NewChecker(tc.opts)
-			require.ErrorIs(t, err, tc.is)
-			require.EqualError(t, err, tc.want)
-			assert.Nil(t, chk)
-		})
-	}
-}
-
-func TestNewCheckerNilFsUsesOsFs(t *testing.T) {
-	t.Parallel()
-
-	dir := t.TempDir()
-	manifestPath := filepath.Join(dir, "index.mf")
-	content := []byte("hello")
-	createTestManifest(t, afero.NewOsFs(), manifestPath, map[string][]byte{
-		testFile1: content,
-	})
-	require.NoError(t, os.WriteFile(filepath.Join(dir, testFile1), content, 0o600))
-
-	chk, err := NewChecker(&CheckerOptions{ManifestPath: manifestPath, BasePath: dir})
-	require.NoError(t, err)
-
-	results := make(chan Result, 1)
-	require.NoError(t, chk.Check(context.Background(), results, nil))
-	assert.Equal(t, StatusOK, (<-results).Status)
-}
-
 func TestCheckerFileCountAndTotalBytes(t *testing.T) {
 	t.Parallel()
 
@@ -197,13 +125,9 @@ func TestCheckerFileCountAndTotalBytes(t *testing.T) {
 		"medium.txt": []byte("hello world"),
 		"large.txt":  bytes.Repeat([]byte("x"), 1000),
 	}
-	createTestManifest(t, fs, testManifestPath, files)
+	createTestManifest(t, fs, "/manifest.mf", files)
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     "/",
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/", fs)
 	require.NoError(t, err)
 
 	assert.Equal(t, FileCount(3), chk.FileCount())
@@ -218,14 +142,10 @@ func TestCheckAllFilesOK(t *testing.T) {
 		testFile1: []byte("content one"),
 		testFile2: []byte("content two"),
 	}
-	createTestManifest(t, fs, testManifestPath, files)
+	createTestManifest(t, fs, "/manifest.mf", files)
 	createFilesOnDisk(t, fs, files)
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	results := make(chan Result, 10)
@@ -252,17 +172,13 @@ func TestCheckMissingFile(t *testing.T) {
 		testExistsFile: []byte("I exist"),
 		"missing.txt":  []byte("I don't exist on disk"),
 	}
-	createTestManifest(t, fs, testManifestPath, files)
+	createTestManifest(t, fs, "/manifest.mf", files)
 	// Only create one file
 	createFilesOnDisk(t, fs, map[string][]byte{
 		testExistsFile: []byte("I exist"),
 	})
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	results := make(chan Result, 10)
@@ -295,17 +211,13 @@ func TestCheckSizeMismatch(t *testing.T) {
 	files := map[string][]byte{
 		testFileName: []byte("original content"),
 	}
-	createTestManifest(t, fs, testManifestPath, files)
+	createTestManifest(t, fs, "/manifest.mf", files)
 	// Create file with different size
 	createFilesOnDisk(t, fs, map[string][]byte{
 		testFileName: []byte("short"),
 	})
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	results := make(chan Result, 10)
@@ -325,7 +237,7 @@ func TestCheckHashMismatch(t *testing.T) {
 	files := map[string][]byte{
 		testFileName: originalContent,
 	}
-	createTestManifest(t, fs, testManifestPath, files)
+	createTestManifest(t, fs, "/manifest.mf", files)
 	// Create file with same size but different content
 	differentContent := []byte("different contnt") // same length (16 bytes) but different
 	require.Len(t, differentContent, len(originalContent), "test requires same length")
@@ -333,11 +245,7 @@ func TestCheckHashMismatch(t *testing.T) {
 		testFileName: differentContent,
 	})
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	results := make(chan Result, 10)
@@ -357,14 +265,10 @@ func TestCheckWithProgress(t *testing.T) {
 		testFile1: bytes.Repeat([]byte("a"), 100),
 		testFile2: bytes.Repeat([]byte("b"), 200),
 	}
-	createTestManifest(t, fs, testManifestPath, files)
+	createTestManifest(t, fs, "/manifest.mf", files)
 	createFilesOnDisk(t, fs, files)
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	results := make(chan Result, 10)
@@ -401,14 +305,10 @@ func TestCheckContextCancellation(t *testing.T) {
 		files[string(rune('a'+i%26))+".txt"] = bytes.Repeat([]byte("x"), 1000)
 	}
 
-	createTestManifest(t, fs, testManifestPath, files)
+	createTestManifest(t, fs, "/manifest.mf", files)
 	createFilesOnDisk(t, fs, files)
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -427,7 +327,7 @@ func TestFindExtraFiles(t *testing.T) {
 	manifestFiles := map[string][]byte{
 		testFile1: []byte("in manifest"),
 	}
-	createTestManifest(t, fs, testManifestPath, manifestFiles)
+	createTestManifest(t, fs, "/manifest.mf", manifestFiles)
 
 	// Disk has file1 and file2
 	createFilesOnDisk(t, fs, map[string][]byte{
@@ -435,11 +335,7 @@ func TestFindExtraFiles(t *testing.T) {
 		testFile2: []byte("extra file"),
 	})
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	results := make(chan Result, 10)
@@ -457,44 +353,46 @@ func TestFindExtraFiles(t *testing.T) {
 	assert.Equal(t, "not in manifest", extras[0].Message)
 }
 
-// TestFindExtraFilesReportsHiddenFilesButNotManifest keeps the manifest
-// inside the checked tree: hidden files and directories are reported, the
-// manifest is not. The manifest is recognized by file identity, which needs
-// the real filesystem.
-func TestFindExtraFilesReportsHiddenFilesButNotManifest(t *testing.T) {
+func TestFindExtraFilesSkipsManifestAndDotfiles(t *testing.T) {
 	t.Parallel()
 
-	dir := t.TempDir()
-	manifestPath := filepath.Join(dir, "index.mf")
-
-	fs := afero.NewOsFs()
-	createTestManifest(t, fs, manifestPath, map[string][]byte{
+	fs := afero.NewMemMapFs()
+	manifestFiles := map[string][]byte{
+		testFile1: []byte("in manifest"),
+	}
+	createTestManifest(t, fs, "/data/.index.mf", manifestFiles)
+	createFilesOnDisk(t, fs, map[string][]byte{
 		testFile1: []byte("in manifest"),
 	})
+	// Create dotfile and manifest that should be skipped
+	require.NoError(t, afero.WriteFile(fs, "/data/.hidden", []byte("hidden"), 0o644))
+	require.NoError(t, afero.WriteFile(fs, "/data/.config/settings", []byte("cfg"), 0o644))
+	// Create a real extra file
+	require.NoError(t, fs.MkdirAll("/data", 0o755))
+	require.NoError(t, afero.WriteFile(fs, "/data/extra.txt", []byte("extra"), 0o644))
 
-	unlisted := []RelFilePath{"extra.txt", ".hidden", ".git/config"}
-	for _, p := range append([]RelFilePath{testFile1}, unlisted...) {
-		path := filepath.Join(dir, string(p))
-		require.NoError(t, fs.MkdirAll(filepath.Dir(path), 0o750))
-		require.NoError(t, afero.WriteFile(fs, path, []byte("x"), 0o600))
-	}
-
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: manifestPath,
-		BasePath:     dir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/data/.index.mf", "/data", fs)
 	require.NoError(t, err)
 
 	results := make(chan Result, 10)
-	require.NoError(t, chk.FindExtraFiles(context.Background(), results))
+	err = chk.FindExtraFiles(context.Background(), results)
+	require.NoError(t, err)
 
-	var extras []RelFilePath
+	var extras []Result
 	for r := range results {
-		extras = append(extras, r.Path)
+		extras = append(extras, r)
 	}
 
-	assert.ElementsMatch(t, unlisted, extras)
+	// Should only report extra.txt, not .hidden, .config/settings, or .index.mf
+	for _, e := range extras {
+		t.Logf("extra: %s", e.Path)
+	}
+
+	assert.Len(t, extras, 1)
+
+	if len(extras) > 0 {
+		assert.Equal(t, RelFilePath("extra.txt"), extras[0].Path)
+	}
 }
 
 func TestFindExtraFilesContextCancellation(t *testing.T) {
@@ -502,14 +400,10 @@ func TestFindExtraFilesContextCancellation(t *testing.T) {
 
 	fs := afero.NewMemMapFs()
 	files := map[string][]byte{testFileName: []byte("data")}
-	createTestManifest(t, fs, testManifestPath, files)
+	createTestManifest(t, fs, "/manifest.mf", files)
 	createFilesOnDisk(t, fs, files)
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	ctx, cancel := context.WithCancel(context.Background())
@@ -525,14 +419,10 @@ func TestCheckNilChannels(t *testing.T) {
 
 	fs := afero.NewMemMapFs()
 	files := map[string][]byte{testFileName: []byte("data")}
-	createTestManifest(t, fs, testManifestPath, files)
+	createTestManifest(t, fs, "/manifest.mf", files)
 	createFilesOnDisk(t, fs, files)
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	// Should not panic with nil channels
@@ -545,14 +435,10 @@ func TestFindExtraFilesNilChannel(t *testing.T) {
 
 	fs := afero.NewMemMapFs()
 	files := map[string][]byte{testFileName: []byte("data")}
-	createTestManifest(t, fs, testManifestPath, files)
+	createTestManifest(t, fs, "/manifest.mf", files)
 	createFilesOnDisk(t, fs, files)
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	// Should not panic with nil channel
@@ -569,7 +455,7 @@ func TestCheckSubdirectories(t *testing.T) {
 		"dir1/dir2/file2.txt":     []byte("content2"),
 		"dir1/dir2/dir3/deep.txt": []byte("deep content"),
 	}
-	createTestManifest(t, fs, testManifestPath, files)
+	createTestManifest(t, fs, "/manifest.mf", files)
 
 	// Create files with full directory structure
 	for path, content := range files {
@@ -579,11 +465,7 @@ func TestCheckSubdirectories(t *testing.T) {
 		require.NoError(t, afero.WriteFile(fs, fullPath, content, 0o644))
 	}
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	results := make(chan Result, 10)
@@ -611,17 +493,13 @@ func TestCheckMissingFileDetectedWithoutFallback(t *testing.T) {
 		testExistsFile: []byte("here"),
 		"missing.txt":  []byte("not on disk"),
 	}
-	createTestManifest(t, fs, testManifestPath, files)
+	createTestManifest(t, fs, "/manifest.mf", files)
 	// Only create one file on disk
 	createFilesOnDisk(t, fs, map[string][]byte{
 		testExistsFile: []byte("here"),
 	})
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	results := make(chan Result, 10)
@@ -641,18 +519,77 @@ func TestCheckMissingFileDetectedWithoutFallback(t *testing.T) {
 	assert.Equal(t, 0, statusCounts[StatusError], "no files should be ERROR")
 }
 
+func TestFindExtraFilesSkipsDotfiles(t *testing.T) {
+	t.Parallel()
+
+	// Regression test for #16: FindExtraFiles should not report dotfiles
+	// or the manifest file itself as extra files.
+	fs := afero.NewMemMapFs()
+	files := map[string][]byte{
+		testFile1: []byte("in manifest"),
+	}
+	createTestManifest(t, fs, "/data/.index.mf", files)
+	createFilesOnDisk(t, fs, files)
+
+	// Add dotfiles and manifest file on disk
+	require.NoError(t, afero.WriteFile(fs, "/data/.hidden", []byte("dotfile"), 0o644))
+	require.NoError(t, fs.MkdirAll("/data/.git", 0o755))
+	require.NoError(t,
+		afero.WriteFile(fs, "/data/.git/config", []byte("git config"), 0o644))
+
+	chk, err := NewChecker("/data/.index.mf", "/data", fs)
+	require.NoError(t, err)
+
+	results := make(chan Result, 10)
+	err = chk.FindExtraFiles(context.Background(), results)
+	require.NoError(t, err)
+
+	var extras []Result
+	for r := range results {
+		extras = append(extras, r)
+	}
+
+	// Should report NO extra files — dotfiles and manifest should be skipped
+	assert.Empty(t, extras,
+		"FindExtraFiles should not report dotfiles or manifest file as extra; got: %v",
+		extras)
+}
+
+func TestFindExtraFilesSkipsManifestFile(t *testing.T) {
+	t.Parallel()
+
+	// The manifest file itself should never be reported as extra
+	fs := afero.NewMemMapFs()
+	files := map[string][]byte{
+		testFile1: []byte("content"),
+	}
+	createTestManifest(t, fs, "/data/index.mf", files)
+	createFilesOnDisk(t, fs, files)
+
+	chk, err := NewChecker("/data/index.mf", "/data", fs)
+	require.NoError(t, err)
+
+	results := make(chan Result, 10)
+	err = chk.FindExtraFiles(context.Background(), results)
+	require.NoError(t, err)
+
+	var extras []Result
+	for r := range results {
+		extras = append(extras, r)
+	}
+
+	assert.Empty(t, extras,
+		"manifest file should not be reported as extra; got: %v", extras)
+}
+
 func TestCheckEmptyManifest(t *testing.T) {
 	t.Parallel()
 
 	fs := afero.NewMemMapFs()
 	// Create manifest with no files
-	createTestManifest(t, fs, testManifestPath, map[string][]byte{})
+	createTestManifest(t, fs, "/manifest.mf", map[string][]byte{})
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	assert.Equal(t, FileCount(0), chk.FileCount())
@@ -684,14 +621,10 @@ func TestCheckProgressRateLimited(t *testing.T) {
 		files[name] = []byte("content")
 	}
 
-	createTestManifest(t, fs, testManifestPath, files)
+	createTestManifest(t, fs, "/manifest.mf", files)
 	createFilesOnDisk(t, fs, files)
 
-	chk, err := NewChecker(&CheckerOptions{
-		ManifestPath: testManifestPath,
-		BasePath:     testDataDir,
-		Fs:           fs,
-	})
+	chk, err := NewChecker("/manifest.mf", "/data", fs)
 	require.NoError(t, err)
 
 	results := make(chan Result, 200)

mfer/constants.go

@@ -17,28 +17,4 @@ const (
 
 	// uuidLength is the length in bytes of a binary UUID.
 	uuidLength = 16
-
-	// Numbers in mf.proto of MFFile.files and of the MFFilePath fields
-	// that decoding sets aside a fixed amount of memory for.
-	filesFieldNumber    = 101
-	hashesFieldNumber   = 3
-	mimeTypeFieldNumber = 301
-	mtimeFieldNumber    = 302
-	ctimeFieldNumber    = 303
-
-	// Bytes decoding sets aside for each file entry, hash, timestamp and
-	// MIME type, however short its encoding. checkDecodedSize refuses an
-	// inner message for which these add up to more than maxDecodedGrowth
-	// times its size.
-	decodedFileEntrySize = 160
-	decodedHashSize      = 112
-	decodedTimestampSize = 64
-	decodedMIMETypeSize  = 16
-
-	// Each file entry mfer writes holds a path of at least one byte, a
-	// multihash at least as long as SHA-256's 34 bytes (AddFileWithHash
-	// refuses shorter ones) and a modification time: at least 47 bytes,
-	// counted at 336. So its manifests add up to at most about 7.15 times
-	// their size, and this limit is about 12% above that.
-	maxDecodedGrowth = 8
 )

mfer/deserialize.go

@@ -11,7 +11,6 @@ import (
 	"github.com/google/uuid"
 	"github.com/klauspost/compress/zstd"
 	"github.com/spf13/afero"
-	"google.golang.org/protobuf/encoding/protowire"
 	"google.golang.org/protobuf/proto"
 	"sneak.berlin/go/mfer/internal/bork"
 	"sneak.berlin/go/mfer/internal/log"
@@ -28,8 +27,6 @@ var (
 	errUUIDMismatch         = errors.New("outer and inner UUID mismatch")
 	errInvalidFileFormat    = errors.New("invalid file format")
 	errInvalidManifestPath  = errors.New("manifest contains invalid path")
-	errDecodedTooLarge      = errors.New(
-		"manifest would take too much memory to decode")
 )
 
 // validateUUID checks that the byte slice is a valid UUID (16 bytes, parseable).
@@ -157,85 +154,6 @@ func (m *manifest) decompressInner() ([]byte, error) {
 	return dat, nil
 }
 
-// checkDecodedSize refuses an encoded inner message whose file entries,
-// hashes, timestamps and MIME types would take more than maxDecodedGrowth
-// times its size to decode. Decoding sets aside a fixed amount for each,
-// however short its encoding, so a message of empty ones would take about
-// 50 times its size.
-func checkDecodedSize(inner []byte) error {
-	limit := maxDecodedGrowth * int64(len(inner))
-
-	var decoded int64
-
-	add := func(size int64) error {
-		decoded += size
-		if decoded > limit {
-			return errDecodedTooLarge
-		}
-
-		return nil
-	}
-
-	return forEachBytesField(inner, func(num protowire.Number, entry []byte) error {
-		if num != filesFieldNumber {
-			return nil
-		}
-
-		err := add(decodedFileEntrySize)
-		if err != nil {
-			return err
-		}
-
-		return forEachBytesField(entry, func(num protowire.Number, _ []byte) error {
-			if num == hashesFieldNumber {
-				return add(decodedHashSize)
-			}
-
-			if num == mtimeFieldNumber || num == ctimeFieldNumber {
-				return add(decodedTimestampSize)
-			}
-
-			if num == mimeTypeFieldNumber {
-				return add(decodedMIMETypeSize)
-			}
-
-			return nil
-		})
-	})
-}
-
-// forEachBytesField calls fn with the number and value of each
-// length-delimited field in the encoded message msg, and fails if msg is
-// malformed.
-func forEachBytesField(
-	msg []byte, fn func(num protowire.Number, value []byte) error,
-) error {
-	for len(msg) > 0 {
-		num, wireType, tagLen := protowire.ConsumeTag(msg)
-		if tagLen < 0 {
-			return protowire.ParseError(tagLen)
-		}
-
-		valueLen := protowire.ConsumeFieldValue(num, wireType, msg[tagLen:])
-		if valueLen < 0 {
-			return protowire.ParseError(valueLen)
-		}
-
-		if wireType == protowire.BytesType {
-			value, _ := protowire.ConsumeBytes(msg[tagLen:])
-
-			err := fn(num, value)
-			if err != nil {
-				return err
-			}
-		}
-
-		msg = msg[tagLen+valueLen:]
-	}
-
-	return nil
-}
-
 func (m *manifest) deserializeInner() error {
 	err := m.validateOuterHeader()
 	if err != nil {
@@ -259,16 +177,10 @@ func (m *manifest) deserializeInner() error {
 		return bork.ErrFileTruncated
 	}
 
-	err = checkDecodedSize(dat)
-	if err != nil {
-		return fmt.Errorf("deserialize: unmarshal inner: %w", err)
-	}
-
 	// Deserialize inner message
 	m.pbInner = new(MFFile)
 
-	// Unknown fields would cost memory; mfer never writes a loaded manifest out.
-	err = proto.UnmarshalOptions{DiscardUnknown: true}.Unmarshal(dat, m.pbInner)
+	err = proto.Unmarshal(dat, m.pbInner)
 	if err != nil {
 		return fmt.Errorf("deserialize: unmarshal inner: %w", err)
 	}
@@ -337,8 +249,7 @@ func NewManifestFromReader(input io.Reader) (*manifest, error) {
 	// deserialize outer:
 	m.pbOuter = new(MFFileOuter)
 
-	// Unknown fields would cost memory; mfer never writes a loaded manifest out.
-	err = proto.UnmarshalOptions{DiscardUnknown: true}.Unmarshal(dat, m.pbOuter)
+	err = proto.Unmarshal(dat, m.pbOuter)
 	if err != nil {
 		return nil, err
 	}
@@ -352,29 +263,16 @@ func NewManifestFromReader(input io.Reader) (*manifest, error) {
 	return m, nil
 }
 
-// ManifestFromFileOptions configures NewManifestFromFile.
-type ManifestFromFileOptions struct {
-	// Path is the manifest file to read (required).
-	Path string
-	// Fs is the filesystem to use, defaults to OsFs if nil.
-	Fs afero.Fs
-}
-
-// NewManifestFromFile reads a manifest from a file. It returns an error if
-// opts is nil or its path is empty.
+// NewManifestFromFile reads a manifest from a file path using the given filesystem.
+// If fs is nil, the real filesystem (OsFs) is used.
 //
 //nolint:revive // unexported-return: exporting manifest is owner question 13
-func NewManifestFromFile(opts *ManifestFromFileOptions) (*manifest, error) {
-	if opts == nil || opts.Path == "" {
-		return nil, errManifestPathEmpty
-	}
-
-	fs := opts.Fs
+func NewManifestFromFile(fs afero.Fs, path string) (*manifest, error) {
 	if fs == nil {
 		fs = afero.NewOsFs()
 	}
 
-	f, err := fs.Open(opts.Path)
+	f, err := fs.Open(path)
 	if err != nil {
 		return nil, err
 	}

mfer/deserialize_fuzz_test.go

@@ -54,15 +54,9 @@ func FuzzNewManifestFromReader(f *testing.F) {
 		}
 
 		// It also keeps a few copies of its input. Buffers grow by
-		// copying, so reaching those sizes allocates up to about six times
-		// them in total. Decoding the decompressed data takes up to
-		// maxDecodedGrowth times its size for file entries, hashes,
-		// timestamps and MIME types, and drops fields it does not know.
-		// The strings and bytes it copies out of it, such as many one-byte
-		// values in one hash, take up to about five times more under the
-		// race detector, which pads every small copy to 16 bytes, and about
-		// half that without it. Twenty times the input and the
-		// decompressed data leaves room for all of that.
+		// copying, so reaching those sizes allocates a few times them in
+		// total: sixteen times the input and the decompressed data leaves
+		// room for that.
 		//
 		// The decoder also sets aside a new buffer of one to two times the
 		// window for each frame that asks for a larger window than the
@@ -77,9 +71,8 @@ func FuzzNewManifestFromReader(f *testing.F) {
 		// fails if the decoder accepts windows of twice zstdWindowSize; the
 		// seed whose two frames together exceed MaxDecompressedSize fails
 		// if the decoder decodes them in full instead of stopping at the
-		// declared size; the seeds of empty file entries and of a file
-		// entry of empty hashes fail if the parser decodes them.
-		limit := 20*(uint64(len(data))+decompressed) + 24*zstdWindowSize
+		// declared size.
+		limit := 16*(uint64(len(data))+decompressed) + 24*zstdWindowSize
 
 		allocated := after.TotalAlloc - before.TotalAlloc
 		if allocated > limit {

mfer/deserialize_path_test.go

@@ -6,14 +6,10 @@ import (
 	"context"
 	"crypto/sha256"
 	"fmt"
-	"strconv"
-	"strings"
 	"testing"
-	"time"
 
 	"github.com/google/uuid"
 	"github.com/klauspost/compress/zstd"
-	"github.com/multiformats/go-multihash"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"google.golang.org/protobuf/encoding/protowire"
@@ -118,119 +114,10 @@ func TestDeserializeRejectsInvalidEntryPaths(t *testing.T) {
 	}
 }
 
-// Entries of a path, an empty hash, an empty MIME type and empty modification
-// and change times are counted at 416 bytes each (160 + 112 + 16 + 64 + 64)
-// and take 16 bytes plus the path to encode. A 35-character path makes that
-// 51 bytes, about 8.2 times: refused, and leaving any one of the five
-// uncounted, even the MIME type, brings it under 8. A 37-character path makes
-// it 53 bytes, about 7.8 times: loaded.
-func TestDeserializeRefusesEntriesThatDecodeTooLarge(t *testing.T) {
-	t.Parallel()
-
-	tests := []struct {
-		pathLen int
-		refused bool
-	}{
-		{35, true},
-		{37, false},
-	}
-
-	for _, tt := range tests {
-		t.Run(strconv.Itoa(tt.pathLen), func(t *testing.T) {
-			t.Parallel()
-
-			entry := protowire.AppendTag(nil, 1, protowire.BytesType) // MFFilePath.path
-			entry = protowire.AppendString(entry, strings.Repeat("a", tt.pathLen))
-			entry = protowire.AppendTag(entry, 3, protowire.BytesType) // MFFilePath.hashes
-			entry = protowire.AppendBytes(entry, nil)
-			entry = protowire.AppendTag(entry, 301, protowire.BytesType) // MFFilePath.mimeType
-			entry = protowire.AppendBytes(entry, nil)
-			entry = protowire.AppendTag(entry, 302, protowire.BytesType) // MFFilePath.mtime
-			entry = protowire.AppendBytes(entry, nil)
-			entry = protowire.AppendTag(entry, 303, protowire.BytesType) // MFFilePath.ctime
-			entry = protowire.AppendBytes(entry, nil)
-
-			id := uuid.New()
-			inner := protowire.AppendTag(nil, 102, protowire.BytesType) // MFFile.uuid
-			inner = protowire.AppendBytes(inner, id[:])
-
-			for range 1000 {
-				inner = protowire.AppendTag(inner, 101, protowire.BytesType) // MFFile.files
-				inner = protowire.AppendBytes(inner, entry)
-			}
-
-			_, err := NewManifestFromReader(bytes.NewReader(wrapInner(t, id, inner)))
-			if tt.refused {
-				require.ErrorIs(t, err, errDecodedTooLarge)
-			} else {
-				require.NoError(t, err)
-			}
-		})
-	}
-}
-
-// Fields the decoder does not know are dropped, in the outer message, the inner
-// message and a file entry, so that they take no memory once loaded.
-func TestDeserializeDropsUnknownFields(t *testing.T) {
-	t.Parallel()
-
-	unknown := protowire.AppendTag(nil, 99, protowire.BytesType) // in no message
-	unknown = protowire.AppendBytes(unknown, []byte("not known"))
-
-	entry := protowire.AppendTag(nil, 1, protowire.BytesType) // MFFilePath.path
-	entry = protowire.AppendString(entry, "a")
-	entry = append(entry, unknown...)
-
-	id := uuid.New()
-	inner := protowire.AppendTag(nil, 101, protowire.BytesType) // MFFile.files
-	inner = protowire.AppendBytes(inner, entry)
-	inner = protowire.AppendTag(inner, 102, protowire.BytesType) // MFFile.uuid
-	inner = protowire.AppendBytes(inner, id[:])
-	inner = append(inner, unknown...)
-
-	data := wrapInner(t, id, inner)
-	data = append(data, unknown...) // the outer message ends the file
-
-	m, err := NewManifestFromReader(bytes.NewReader(data))
-	require.NoError(t, err)
-	require.Len(t, m.Files(), 1)
-	assert.Empty(t, m.pbOuter.ProtoReflect().GetUnknown())
-	assert.Empty(t, m.pbInner.ProtoReflect().GetUnknown())
-	assert.Empty(t, m.Files()[0].ProtoReflect().GetUnknown())
-}
-
-// Many empty files with names of at most three characters and modification
-// times at the epoch make about the densest manifest mfer writes: it takes
-// about 7 times its size to decode, and still loads. A signature would not
-// change the inner message, so none is added.
-func TestDeserializeLoadsDensestManifest(t *testing.T) {
-	t.Parallel()
-
-	hash, err := multihash.Encode(make([]byte, sha256.Size), multihash.SHA2_256)
-	require.NoError(t, err)
-
-	b := NewBuilder()
-	b.SetIncludeTimestamps(true)
-
-	const files = 10000
-	for i := range files {
-		name := RelFilePath(strconv.FormatInt(int64(i), 36))
-		require.NoError(t, b.AddFileWithHash(name, 0, ModTime(time.Unix(0, 0)), hash))
-	}
-
-	var buf bytes.Buffer
-	require.NoError(t, b.Build(context.Background(), &buf))
-
-	m, err := NewManifestFromReader(&buf)
-	require.NoError(t, err)
-	assert.Len(t, m.Files(), files)
-}
-
 func TestDeserializeValidManifestRoundTrips(t *testing.T) {
 	t.Parallel()
 
-	hash, err := multihash.Encode(make([]byte, sha256.Size), multihash.SHA2_256)
-	require.NoError(t, err)
+	hash := make([]byte, 34) // multihash: 2-byte prefix + 32-byte SHA-256
 
 	b := NewBuilder()
 	require.NoError(t, b.AddFileWithHash("dir/file.txt", 123, ModTime{}, hash))

mfer/mf.pb.go

@@ -587,7 +587,7 @@ const file_mf_proto_rawDesc = "" +
 	"\fVERSION_NONE\x10\x00\x12\x0f\n" +
 	"\vVERSION_ONE\x10\x01B\f\n" +
 	"\n" +
-	"_createdAtB\x1bZ\x19sneak.berlin/go/mfer/mferb\x06proto3"
+	"_createdAtB\x1dZ\x1bgit.eeqj.de/sneak/mfer/mferb\x06proto3"
 
 var (
 	file_mf_proto_rawDescOnce sync.Once

mfer/mf.proto

@@ -1,6 +1,6 @@
 syntax = "proto3";
 
-option go_package = "sneak.berlin/go/mfer/mfer";
+option go_package = "git.eeqj.de/sneak/mfer/mfer";
 
 message Timestamp {
   int64 seconds = 1;

mfer/mf.proto.sha256

@@ -1 +0,0 @@
-fa6fceaba5553c8667c631994535fe5c307c8adb19f3ad289babf79a0f438650  mf.proto

mfer/mf_test.go

@@ -1,29 +0,0 @@
-package mfer_test
-
-import (
-	"crypto/sha256"
-	"encoding/hex"
-	"os"
-	"strings"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-// mf.pb.go is generated from mf.proto and committed. `make generate`
-// records the hash of the mf.proto it generated from in mf.proto.sha256.
-func TestGeneratedCodeMatchesProto(t *testing.T) {
-	t.Parallel()
-
-	proto, err := os.ReadFile("mf.proto")
-	require.NoError(t, err)
-
-	recorded, err := os.ReadFile("mf.proto.sha256")
-	require.NoError(t, err)
-
-	recordedHash, _, _ := strings.Cut(string(recorded), " ")
-	sum := sha256.Sum256(proto)
-	require.Equal(t, recordedHash, hex.EncodeToString(sum[:]),
-		"mfer/mf.proto has changed since mfer/mf.pb.go was generated "+
-			"from it: run `make generate` and commit the result")
-}

mfer/scanner.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"io"
 	"io/fs"
-	"os"
 	"path"
 	"path/filepath"
 	"strings"
@@ -58,8 +57,6 @@ type ScannerOptions struct {
 	SigningOptions *SigningOptions
 	// Seed, if set, derives a deterministic UUID from this seed.
 	Seed string
-	// ExcludePaths lists files to leave out of the listing, matched with os.SameFile.
-	ExcludePaths []string
 }
 
 // FileEntry represents a file that has been enumerated.
@@ -78,7 +75,6 @@ type Scanner struct {
 	totalBytes FileSize // cached sum of all file sizes
 	options    *ScannerOptions
 	fs         afero.Fs
-	excluded   []fs.FileInfo // the files named in ExcludePaths that exist
 }
 
 // NewScanner creates a new Scanner with default options.
@@ -97,22 +93,11 @@ func NewScannerWithOptions(opts *ScannerOptions) *Scanner {
 		fs = afero.NewOsFs()
 	}
 
-	s := &Scanner{
+	return &Scanner{
 		files:   make([]*FileEntry, 0),
 		options: opts,
 		fs:      fs,
 	}
-
-	// A path that cannot be stat'd, normally because no file is there,
-	// needs no leaving out.
-	for _, p := range opts.ExcludePaths {
-		info, err := s.fs.Stat(p)
-		if err == nil {
-			s.excluded = append(s.excluded, info)
-		}
-	}
-
-	return s
 }
 
 // EnumerateFile adds a single file to the scanner, calling stat() to get metadata.
@@ -450,12 +435,6 @@ func (s *Scanner) enumerateFileWithInfo(
 		info = realInfo
 	}
 
-	for _, excluded := range s.excluded {
-		if os.SameFile(info, excluded) {
-			return nil
-		}
-	}
-
 	entry := &FileEntry{
 		Path:    RelFilePath(cleanPath),
 		AbsPath: AbsFilePath(absPath),

mfer/testdata/fuzz/FuzzNewManifestFromReader/empty-file-entries

@@ -1,2 +0,0 @@
-go test fuzz v1
-[]byte("ZNAVSRFG\xa8\x06\x01\xb0\x06\x01\xb8\x06\xff\xff\xff\x03\xc2\x06 {\x16\xbdu\xa0\xa2\x11\xfcH\xef*\x1b7\r\x99\xefb\x04\x02g\n\xa9\xf3B5\xe5p\x96\x8c\x8c\xac\x0e\xca\x06\x10\x03Q\xb2\xd0\x19`F\xc1\xb1\xc0Z\xf4x\xf4g^\xba\f\xa1\x06(\xb5/\xfd\x04h\x04\x01\x00d\x01\xb2\x06\x10\x03Q\xb2\xd0\x19`F\xc1\xb1\xc0Z\xf4x\xf4g^\xaa\x06\x00\x01T\x13\x024\xce\xff\rL\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15M\x00\x00\x00\x01T\x00\x044\xfc\xff\x153\xea\a\xb4")

mfer/testdata/fuzz/FuzzNewManifestFromReader/file-entry-of-empty-hashes

@@ -1,2 +0,0 @@
-go test fuzz v1
-[]byte("ZNAVSRFG\xa8\x06\x01\xb0\x06\x01\xb8\x06\xff\xff\xff\x03\xc2\x06 .\xcd\x11|0\xfcP\xe5\x1b\xe3\xc6Ӡ\xcdڤx\xcd\x169t\x1a9~ǽB\xc9\xe8G`\x05\xca\x06\x10\x11*!\x0e\x95EF\xb8\xbd\x9f\xde\x12MF\r\x99\xba\f\xa6\x06(\xb5/\xfd\x04h,\x01\x00\xb4\x01\xb2\x06\x10\x11*!\x0e\x95EF\xb8\xbd\x9f\xde\x12MF\r\x99\xaa\x06\xe6\xff\xff\x03\x1a\x00\x01T\x14\x024\x8b\xff\x17L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15L\x00\x00\x00\x01T\x00\x044\xfd\xff\x15M\x00\x00\x00\x01T\x00\x044\xfc\xff\x15\x02\xd1.\xe3")

script/fmt

@@ -5,8 +5,19 @@ set -eu
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
 ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
+# Regenerate mfer/mf.pb.go from mfer/mf.proto if it is missing or stale
+# (mirrors the old Makefile prerequisite; the generated file is
+# committed, so this is normally a no-op).
+ensure_pb() {
+    if [ ! -f mfer/mf.pb.go ] ||
+        [ -n "$(find mfer/mf.proto -newer mfer/mf.pb.go 2>/dev/null)" ]; then
+        (cd mfer && go generate .)
+    fi
+}
+
 main() {
     cd "$ROOT"
+    ensure_pb
     gofumpt -l -w mfer internal cmd
     # Markdown and JSON, over the same file set script/fmt-check verifies.
     "$SCRIPT_DIR/prettier" --write

script/fmt-check-go

@@ -6,8 +6,19 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Regenerate mfer/mf.pb.go from mfer/mf.proto if it is missing or stale
+# (mirrors the old Makefile prerequisite; the generated file is
+# committed, so this is normally a no-op).
+ensure_pb() {
+    if [ ! -f mfer/mf.pb.go ] ||
+        [ -n "$(find mfer/mf.proto -newer mfer/mf.pb.go 2>/dev/null)" ]; then
+        (cd mfer && go generate .)
+    fi
+}
+
 main() {
     cd "$ROOT"
+    ensure_pb
     if [ -n "$(gofmt -l .)" ]; then
         echo "gofmt: files need formatting:" >&2
         gofmt -l . >&2

script/generate

@@ -1,52 +0,0 @@
-#!/bin/sh
-# script/generate: regenerate mfer/mf.pb.go from mfer/mf.proto, and record
-# the hash of that mf.proto in mfer/mf.proto.sha256. Nothing else
-# regenerates mf.pb.go: it is committed, so building and checking need no
-# protoc. A test fails while mf.proto no longer matches the recorded hash.
-#
-# Needs exactly the protoc and protoc-gen-go versions named in the header of
-# the committed mf.pb.go (README.md says how to install them). Another
-# version writes a different mf.pb.go, so the script refuses to run.
-set -eu
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
-
-# protoc 33.4 names itself v6.33.4 in the mf.pb.go header.
-PROTOC_VERSION="33.4"
-PROTOC_GEN_GO_VERSION="v1.36.11"
-
-# require_version <command> <its exact --version output>
-require_version() {
-    actual="$("$1" --version 2>/dev/null || true)"
-    if [ "$actual" != "$2" ]; then
-        echo "generate: needs $2 on PATH, found: ${actual:-none}" >&2
-        echo "  README.md says how to install it." >&2
-        exit 1
-    fi
-}
-
-# sha256 <file>: print "<hash>  <file>", with sha256sum, or with shasum
-# where there is no sha256sum.
-sha256() {
-    if command -v sha256sum >/dev/null 2>&1; then
-        sha256sum "$1"
-    elif command -v shasum >/dev/null 2>&1; then
-        shasum -a 256 "$1"
-    else
-        echo "generate: needs sha256sum or shasum on PATH" >&2
-        exit 1
-    fi
-}
-
-main() {
-    cd "$ROOT/mfer"
-    require_version protoc "libprotoc $PROTOC_VERSION"
-    require_version protoc-gen-go "protoc-gen-go $PROTOC_GEN_GO_VERSION"
-    # Hashed before regenerating, so a missing hash tool stops the script
-    # before it changes anything. Regenerating leaves mf.proto as it is.
-    proto_hash="$(sha256 mf.proto)"
-    go generate .
-    echo "$proto_hash" >mf.proto.sha256
-}
-
-main "$@"

script/test

@@ -4,8 +4,19 @@ set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
+# Regenerate mfer/mf.pb.go from mfer/mf.proto if it is missing or stale
+# (mirrors the old Makefile prerequisite; the generated file is
+# committed, so this is normally a no-op).
+ensure_pb() {
+    if [ ! -f mfer/mf.pb.go ] ||
+        [ -n "$(find mfer/mf.proto -newer mfer/mf.pb.go 2>/dev/null)" ]; then
+        (cd mfer && go generate .)
+    fi
+}
+
 main() {
     cd "$ROOT"
+    ensure_pb
     go test -timeout 30s -race -cover ./... ||
         {
             echo "--- Rerunning with -v for details ---"