Run all linting in Docker via Dockerfile.lint (closes #90 )

script/lint now only builds the new Dockerfile.lint, which copies the repo into the pinned golangci-lint image and runs the linter as a build step, so a successful build is a clean lint. It builds with --no-cache, because a cached build runs no linter, and removes the image it tagged when it exits. The main Dockerfile lint stage calls golangci-lint directly, since make lint now needs Docker. Nothing installs or runs golangci-lint on the host any more: bootstrap and the Makefile drop the install, and script/fmt drops golangci-lint run --fix. The gofmt check script/lint repeated stays in script/fmt-check. Model: opus-5-5
2026-10-04 03:35:28 +00:00
6 changed files with 38 additions and 245 deletions
@@ -14,8 +14,8 @@ RUN touch mfer/mf.pb.go
 # Go half of fmt-check only: this image has no node, so no prettier. The
 # markdown half runs in the mdfmt stage below.
 RUN make fmt-check-go
-# The linter directly, not `make lint`: script/lint builds this stage, and
-# there is no docker inside this build.
+# The linter directly, not `make lint`: script/lint builds Dockerfile.lint,
+# and there is no docker inside this build.
 RUN golangci-lint run --config .golangci.yml ./...

 # Markdown/JSON format stage — prettier needs node, which the Go images
@@ -0,0 +1,10 @@
+# Lint image, built by script/lint: golangci-lint runs as a build step, so a
+# successful build is a clean lint. Works where the docker daemon is remote
+# and bind mounts are impossible.
+# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
+FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240
+
+WORKDIR /src
+COPY . .
+
+RUN golangci-lint run --config .golangci.yml ./...
@@ -1,12 +1,12 @@
 # mfer

-[mfer](https://git.eeqj.de/sneak/mfer) is a [WTFPL](https://wtfpl.net)-licensed
-(public domain) [Go](https://golang.org) library and command-line tool by
-[@sneak](https://sneak.berlin) that specifies and generates `.mf` manifest files
-over a directory tree to encapsulate metadata about the files — such as
-cryptographic checksums and signatures over same — to aid in archiving,
-downloading, streaming, and mirroring. It was first published in 2022. The
-manifest files' data is serialized with Google's
+[mfer](https://git.eeqj.de/sneak/mfer) is a reference implementation library and
+thin wrapper command-line utility written in [Go](https://golang.org) and first
+published in 2022 under the [WTFPL](https://wtfpl.net) (public domain) license.
+It specifies and generates `.mf` manifest files over a directory tree of files
+to encapsulate metadata about them (such as cryptographic checksums or
+signatures over same) to aid in archiving, downloading, and streaming, or
+mirroring. The manifest files' data is serialized with Google's
 [protobuf serialization format](https://developers.google.com/protocol-buffers).
 The structure of these files can be found
 [in the format specification](https://git.eeqj.de/sneak/mfer/src/branch/main/mfer/mf.proto)
@@ -21,36 +21,6 @@ This project was started by [@sneak](https://sneak.berlin) to scratch an itch in
 as a de-facto standard and be incorporated into other software. A compatible
 javascript library is planned.

-# Getting Started
-
-`mfer` builds from source with a Go 1.23+ toolchain. The generated protobuf code
-is committed, so no `protoc` toolchain is required:
-
-```sh
-git clone https://git.eeqj.de/sneak/mfer.git
-cd mfer
-go build -o bin/mfer ./cmd/mfer
-```
-
-Generate a manifest for a directory tree, verify it later, and fetch a published
-tree by URL:
-
-```sh
-# Write .index.mf, a manifest of the files under the current directory.
-bin/mfer gen .
-
-# Verify the files on disk against the manifest. Exits nonzero if any file
-# is missing or corrupted.
-bin/mfer check .index.mf
-
-# Download and cryptographically verify a tree published over HTTP: mfer
-# fetches <url>/index.mf, then downloads every file it lists.
-bin/mfer fetch https://example.com/tree/
-```
-
-Run `bin/mfer help` for the full command list, or `bin/mfer <command> --help`
-for a single command's options.
-
 # Build Status

 CI runs `script/cibuild`, which builds the Docker image with `--no-cache`, so
@@ -77,9 +47,8 @@ provide:
 - `script/fuzz` — fuzz the manifest parser for one minute; run by hand
  (`make fuzz`), never by CI, while `script/test` runs its committed seed corpus
  as ordinary tests
- `script/lint` — run `golangci-lint` in Docker: builds only the `lint` stage of
-  the `Dockerfile` (the Go format check, then the linter), uncached so it runs
-  every time, then removes the image
+- `script/lint` — run `golangci-lint` in Docker: builds `Dockerfile.lint`, whose
+  build runs the linter, uncached so it runs every time, then removes the image
 - `script/fmt` — format all code and docs (writes): `gofumpt` and
  `script/prettier --write`
 - `script/prettier` — run prettier over the repository's canonical file set
@@ -116,9 +85,7 @@ be merged. Any changes submitted to this project must also be
 See [`REPO_POLICIES.md`](REPO_POLICIES.md) for detailed coding standards,
 tooling requirements, and workflow conventions.

-# Rationale
-
-## The problem
+# Problem Statement

 Given a plain URL, there is no standard way to safely and programmatically
 download everything "under" that URL path. `wget -r` can traverse directory
@@ -142,7 +109,7 @@ Real issues I face:
 - when I download a large file via HTTP, I have no way of knowing if the file
  content is what it's supposed to be

-## The solution
+# Proposed Solution

 A standard, a manifest file format, and a tool for generating same.

@@ -174,28 +141,6 @@ The manifest file would do several important things:
    - maybe a bittorrent chunklist for torrent client compatibility? perhaps a
      top-level infohash for the whole manifest?

-# Design
-
-The repository is split into a reusable library and a thin command-line wrapper
-around it.
-
- `mfer/` is the reusable library and the heart of the project: it defines the
-  manifest format and implements building, scanning, checking, serialization,
-  and signing. The protobuf schema is `mfer/mf.proto`, and the generated code it
-  produces (`mfer/mf.pb.go`) is committed alongside it so the library builds
-  with `go get` and needs no `protoc` toolchain.
- `internal/cli/` holds the command implementations — `generate` (alias `gen`),
-  `check`, `freshen`, `export`, `list` (alias `ls`), `fetch`, and `version` —
-  that wire the library to the command-line interface.
- `internal/log/` provides the logging used by the commands and the library.
- `internal/bork/` provides the error the library returns when a manifest's
-  decompressed contents are not the size the manifest records.
- `cmd/mfer/` is the entrypoint: its `main` package runs `internal/cli` and
-  exits with the status it returns.
-
-Everything under `internal/` is private to this repository; only the `mfer/`
-package is intended for import by other software.
-
 # Design Goals

 - Replace SHASUMS/SHASUMS.asc files
@@ -329,9 +274,9 @@ Open work, open design questions included, is tracked in this repo's issues:
 - Issues:
  [https://git.eeqj.de/sneak/mfer/issues](https://git.eeqj.de/sneak/mfer/issues)

-# Author
+# Authors

- [@sneak](https://sneak.berlin)
+- [@sneak &lt;sneak@sneak.berlin&gt;](mailto:sneak@sneak.berlin)

 # License

@@ -5,7 +5,6 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
-	"io"
 	"math/rand"
 	"os"
 	"sync"
@@ -15,7 +14,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	urfcli "github.com/urfave/cli/v2"
-	"sneak.berlin/go/mfer/internal/log"
 	"sneak.berlin/go/mfer/mfer"
 )

@@ -29,7 +27,6 @@ const (
 	testManifest    = "/manifest.mf"
 	testFlagBase    = "--base"
 	testFlagNoExtra = "--no-extra-files"
-	testFlagVersion = "--version"
 )

 var errSimulatedWrite = errors.New("simulated write failure")
@@ -42,20 +39,12 @@ var errSimulatedWrite = errors.New("simulated write failure")
 var runMu sync.Mutex

 // runCLI invokes RunWithOptions while holding runMu so parallel tests
-// capture their own output. Before releasing the lock it points the
-// process-global logger at io.Discard: other tests log outside the lock
-// (manifest loads, scans), and those lines must not land in this run's
-// buffers once it has returned and its test is reading them.
+// capture their own output.
 func runCLI(opts *RunOptions) int {
 	runMu.Lock()
 	defer runMu.Unlock()

-	exitCode := RunWithOptions(opts)
-
-	log.SetOutput(io.Discard, io.Discard)
-	log.Init()
-
-	return exitCode
+	return RunWithOptions(opts)
 }

 func TestMain(m *testing.M) {
@@ -113,7 +102,7 @@ func TestVersionCommand(t *testing.T) {
 	t.Parallel()

 	fs := afero.NewMemMapFs()
-	opts := testOpts([]string{testApp, cmdVersion}, fs)
+	opts := testOpts([]string{testApp, "version"}, fs)

 	exitCode := runCLI(opts)

@@ -124,117 +113,6 @@ func TestVersionCommand(t *testing.T) {
 	assert.Contains(t, stdout, "abc123")
 }

-// TestVFlagCollision covers the -v/--verbose vs --version flag interaction
-// (issue #64). Verbose owns -v; version answers to --version and -V. None of
-// these invocations may produce a parser error, and the two ways of asking
-// for the version must print the same thing.
-func TestVFlagCollision(t *testing.T) {
-	t.Parallel()
-
-	// Invocations that must print the version and exit 0.
-	versionCases := map[string][]string{
-		"long version flag":        {testApp, testFlagVersion},
-		"short version flag":       {testApp, "-V"},
-		"verbose then version":     {testApp, "-v", testFlagVersion},
-		"long verbose and version": {testApp, "--verbose", testFlagVersion},
-	}
-
-	for name, args := range versionCases {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			opts := testOpts(args, afero.NewMemMapFs())
-			exitCode := runCLI(opts)
-
-			assert.Equal(t, 0, exitCode, "stderr: %s", testStderr(t, opts))
-			assert.Contains(t, testStdout(t, opts), mfer.Version)
-			assert.NotContains(t, testStderr(t, opts), "two forms of the same flag")
-		})
-	}
-
-	// Invocations that must enable verbose and exit 0 without a parser error.
-	verboseCases := map[string][]string{
-		"short verbose flag": {testApp, "-v"},
-		"long verbose flag":  {testApp, "--verbose"},
-	}
-
-	for name, args := range verboseCases {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			opts := testOpts(args, afero.NewMemMapFs())
-			exitCode := runCLI(opts)
-
-			assert.Equal(t, 0, exitCode, "stderr: %s", testStderr(t, opts))
-			assert.Contains(t, testStdout(t, opts), cmdGenerate,
-				"root should show help listing subcommands")
-		})
-	}
-}
-
-// TestVersionFlagAndCommandMatch asserts that "mfer --version" and
-// "mfer version" produce identical output (issue #64).
-func TestVersionFlagAndCommandMatch(t *testing.T) {
-	t.Parallel()
-
-	flagOpts := testOpts([]string{testApp, testFlagVersion}, afero.NewMemMapFs())
-	require.Equal(t, 0, runCLI(flagOpts))
-
-	cmdOpts := testOpts([]string{testApp, cmdVersion}, afero.NewMemMapFs())
-	require.Equal(t, 0, runCLI(cmdOpts))
-
-	assert.Equal(t, testStdout(t, flagOpts), testStdout(t, cmdOpts))
-}
-
-// TestRootVerbosityFlags asserts that -q and -v given before any subcommand
-// name take effect: in the root itself, and in the fetch and export
-// subcommands (issue #64). It does not run in parallel: other tests log
-// outside runMu (manifest loads, scans), and a line logged while one of these
-// runs is in progress lands in its output.
-//
-//nolint:paralleltest // see above
-func TestRootVerbosityFlags(t *testing.T) {
-	t.Run("quiet with no subcommand hides the banner", func(t *testing.T) {
-		loud := testOpts([]string{testApp}, afero.NewMemMapFs())
-		require.Equal(t, 0, runCLI(loud))
-		assert.Contains(t, testStdout(t, loud), banner)
-
-		quiet := testOpts([]string{testApp, "-q"}, afero.NewMemMapFs())
-		require.Equal(t, 0, runCLI(quiet))
-		assert.Contains(t, testStdout(t, quiet), cmdGenerate)
-		assert.NotContains(t, testStdout(t, quiet), banner)
-	})
-
-	t.Run("quiet before fetch hides the banner", func(t *testing.T) {
-		opts := testOpts([]string{testApp, "-q", cmdFetch}, afero.NewMemMapFs())
-
-		assert.Equal(t, 1, runCLI(opts))
-		assert.Contains(t, testStderr(t, opts), errURLRequired.Error())
-		assert.NotContains(t, testStdout(t, opts), banner)
-	})
-
-	t.Run("verbose twice before fetch enables debug logging", func(t *testing.T) {
-		opts := testOpts([]string{testApp, "-v", "-v", cmdFetch}, afero.NewMemMapFs())
-
-		assert.Equal(t, 1, runCLI(opts))
-		assert.Contains(t, testStderr(t, opts), "fetchManifestOperation()")
-	})
-
-	t.Run("quiet before export hides the manifest summary", func(t *testing.T) {
-		fs := afero.NewMemMapFs()
-		manifest := buildTestManifest(t, map[string][]byte{"a.txt": []byte("a")})
-		require.NoError(t, afero.WriteFile(fs, testManifest, manifest, 0o644))
-
-		loud := testOpts([]string{testApp, cmdExport, testManifest}, fs)
-		require.Equal(t, 0, runCLI(loud))
-		assert.Contains(t, testStderr(t, loud), "loaded manifest")
-
-		quiet := testOpts([]string{testApp, "-q", cmdExport, testManifest}, fs)
-		require.Equal(t, 0, runCLI(quiet))
-		assert.NotContains(t, testStderr(t, quiet), "loaded manifest")
-	})
-}
-
 func TestHelpCommand(t *testing.T) {
 	t.Parallel()

@@ -19,7 +19,6 @@ const (
 	cmdCheck    = "check"
 	cmdExport   = "export"
 	cmdFetch    = "fetch"
-	cmdVersion  = "version"

 	flagProgress = "progress"

@@ -69,12 +68,6 @@ func (mfa *CLIApp) VersionString() string {
 	return mfer.Version
 }

-// printVersion writes the version line shared by the --version flag and the
-// version subcommand, so both produce identical output.
-func (mfa *CLIApp) printVersion() {
-	_, _ = fmt.Fprintf(mfa.Stdout, "%s version %s\n", mfa.appname, mfa.VersionString())
-}
-
 func (mfa *CLIApp) printBanner() {
 	if log.GetLevel() <= log.InfoLevel {
 		_, _ = fmt.Fprintln(mfa.Stdout, banner)
@@ -85,34 +78,20 @@ func (mfa *CLIApp) printBanner() {
 	}
 }

-// setVerbosity sets the log level from -v and -q, given before the subcommand
-// name (the root's copies), after it (the subcommand's own copies), or both.
-// urfave/cli reads a flag from the nearest command that defines it, so each
-// command in the lineage is asked. The highest -v count wins rather than the
-// sum, because a subcommand without its own copies reads the root's.
 func (mfa *CLIApp) setVerbosity(c *cli.Context) {
 	_, present := os.LookupEnv("MFER_DEBUG")

-	verbosity := 0
-	quiet := false
-
-	for _, ctx := range c.Lineage() {
-		verbosity = max(verbosity, ctx.Count("verbose"))
-		quiet = quiet || ctx.Bool("quiet")
-	}
-
 	switch {
 	case present:
 		log.EnableDebugLogging()
-	case quiet:
+	case c.Bool("quiet"):
 		log.SetLevel(log.ErrorLevel)
 	default:
-		log.SetLevelFromVerbosity(verbosity)
+		log.SetLevelFromVerbosity(c.Count("verbose"))
 	}
 }

-// commonFlags returns the -v and -q flags taken by the root and by the
-// generate, check, freshen and fetch subcommands.
+// commonFlags returns the flags shared by most commands (-v, -q)
 func commonFlags() []cli.Flag {
 	return []cli.Flag{
 		&cli.BoolFlag{
@@ -280,8 +259,6 @@ func (mfa *CLIApp) exportCommand() *cli.Command {
 		Usage:     "Export manifest contents as JSON",
 		ArgsUsage: "[manifest file or URL]",
 		Action: func(c *cli.Context) error {
-			mfa.setVerbosity(c)
-
 			return mfa.exportManifestOperation(c)
 		},
 	}
@@ -289,10 +266,10 @@ func (mfa *CLIApp) exportCommand() *cli.Command {

 func (mfa *CLIApp) versionCommand() *cli.Command {
 	return &cli.Command{
-		Name:  cmdVersion,
+		Name:  "version",
 		Usage: "Show version",
 		Action: func(_ *cli.Context) error {
-			mfa.printVersion()
+			_, _ = fmt.Fprintln(mfa.Stdout, mfa.VersionString())

 			return nil
 		},
@@ -348,21 +325,6 @@ func (mfa *CLIApp) run(args []string) {
 	log.SetOutput(mfa.Stdout, mfa.Stderr)
 	log.Init()

-	// -v means verbose, not version. urfave/cli's built-in version flag
-	// claims -v by default, which made "mfer -v --version" fail to parse and
-	// gave -v a different meaning at the root than on the generate, check,
-	// freshen and fetch subcommands, where it means verbose. Verbose is the
-	// more common meaning of -v in tools that offer both, so -v means verbose
-	// at the root too and the version flag takes the capital -V.
-	// VersionFlag and VersionPrinter are urfave/cli package globals; run() is
-	// serialized in tests, so assigning them here is safe.
-	cli.VersionFlag = &cli.BoolFlag{
-		Name:    cmdVersion,
-		Aliases: []string{"V"},
-		Usage:   "print the version",
-	}
-	cli.VersionPrinter = func(_ *cli.Context) { mfa.printVersion() }
-
 	mfa.app = &cli.App{
 		Name:                 mfa.appname,
 		Usage:                "Manifest generator",
@@ -370,13 +332,11 @@ func (mfa *CLIApp) run(args []string) {
 		EnableBashCompletion: true,
 		Writer:               mfa.Stdout,
 		ErrWriter:            mfa.Stderr,
-		Flags:                commonFlags(),
 		Action: func(c *cli.Context) error {
 			if c.Args().Len() > 0 {
 				return fmt.Errorf("%w %q", errUnknownCommand, c.Args().First())
 			}

-			mfa.setVerbosity(c)
 			mfa.printBanner()

 			return cli.ShowAppHelp(c)
@@ -1,8 +1,8 @@
 #!/bin/sh
-# script/lint: run golangci-lint, in Docker only. Builds the lint stage of
-# the Dockerfile, whose build runs the linter, so a successful build is a
-# clean lint. --no-cache because a cached build runs no linter. The image
-# is removed afterwards, whatever the outcome.
+# script/lint: run golangci-lint, in Docker only. Builds Dockerfile.lint,
+# whose build runs the linter, so a successful build is a clean lint.
+# --no-cache because a cached build runs no linter. The image is removed
+# afterwards, whatever the outcome.
 set -eu

 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -14,7 +14,7 @@ main() {
    image="$("$SCRIPT_DIR/projectname")-lint:$$"
    # A failed build leaves no image, so there is nothing to remove then.
    trap 'docker image rm "$image" >/dev/null 2>&1 || true' EXIT INT TERM
-    docker build --no-cache --target lint -t "$image" .
+    docker build --no-cache -f Dockerfile.lint -t "$image" .
 }

 main "$@"