Take the version from the git tag, not a constant (closes #80)

`mfer version`, `mfer --version` and the banner print the revision the
build stamps into main.Gitrev or, when it stamped none (as after
`go install` of a tag), the main module's version from
runtime/debug.ReadBuildInfo. The banner no longer shows a release date.

mfer.Version and mfer.ReleaseDate go, with main.Version and the version
field and parameter in internal/cli that nothing read. A program using
the library reads the module version from its own build information.
The README says where the version comes from.

Judgement call: a binary with no build information prints "unknown",
the word script/build already uses when git describe gives nothing.

Model: opus-5-5

docs/FORMAT.md

@@ -174,10 +174,6 @@ also refuses a manifest whose `signingPubKey` holds a DSA key or subkey, or any
 secret key or subkey, since checking the self-signatures of a DSA key or the
 numbers of a secret key can take hours when those numbers are very large.
 
-A signing key that has expired does not make the signature bad, because a
-manifest outlives its key. A signature past its own expiry time is not good,
-whether or not the key has expired too.
-
 ## Deterministic Serialization
 
 By default, manifests are generated deterministically:

internal/cli/entry_test.go

@@ -157,17 +157,6 @@ func TestVersionFromBuildInfo(t *testing.T) {
 	assert.Equal(t, "mfer version "+info.Main.Version+"\n", testStdout(t, opts))
 }
 
-// TestModuleVersionEmpty covers build information that holds no module
-// version, as in a build with GO111MODULE=off, and a binary with no build
-// information at all. Both report "unknown": an empty version would print
-// nothing after "mfer version" and drop the --version flag.
-func TestModuleVersionEmpty(t *testing.T) {
-	t.Parallel()
-
-	assert.Equal(t, "unknown", moduleVersion(&debug.BuildInfo{}, true))
-	assert.Equal(t, "unknown", moduleVersion(nil, false))
-}
-
 // TestVFlagCollision covers the -v/--verbose vs --version flag interaction
 // (issue #64). Verbose owns -v; version answers to --version and -V. None of
 // these invocations may produce a parser error, and the two ways of asking

internal/cli/mfer.go

@@ -94,14 +94,8 @@ func (mfa *CLIApp) VersionString() string {
 		return mfa.gitrev
 	}
 
-	return moduleVersion(debug.ReadBuildInfo())
-}
-
-// moduleVersion returns the main module's version from the binary's build
-// information, or "unknown" when the binary has none or it holds no version,
-// as in a build with GO111MODULE=off.
-func moduleVersion(info *debug.BuildInfo, ok bool) string {
-	if !ok || info.Main.Version == "" {
+	info, ok := debug.ReadBuildInfo()
+	if !ok {
 		return "unknown"
 	}
 

mfer/openpgp.go

@@ -8,7 +8,6 @@ import (
 	"io"
 	"slices"
 	"strings"
-	"time"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
@@ -243,10 +242,10 @@ func fingerprint(key *openpgp.Entity) string {
 	return strings.ToUpper(hex.EncodeToString(key.PrimaryKey.Fingerprint))
 }
 
-// verifySignature checks that signature is one good, unexpired OpenPGP
-// signature over data, made by the one primary key in pubKey or one of its
-// subkeys, and returns that primary key's fingerprint. signature and pubKey
-// may each be armored or binary.
+// verifySignature checks that signature is one good OpenPGP signature
+// over data, made by the one primary key in pubKey or one of its subkeys,
+// and returns that primary key's fingerprint. signature and pubKey may each
+// be armored or binary.
 func verifySignature(data, signature, pubKey []byte) (string, error) {
 	key, err := readOneKey(pubKey, "embedded public key block", true)
 	if err != nil {
@@ -267,16 +266,10 @@ func verifySignature(data, signature, pubKey []byte) (string, error) {
 		return "", fmt.Errorf("%w, found %d", errNotOneSignature, sigs)
 	}
 
-	sig, _, err := openpgp.VerifyDetachedSignature(openpgp.EntityList{key},
+	_, err = openpgp.CheckDetachedSignature(openpgp.EntityList{key},
 		bytes.NewReader(data), bytes.NewReader(sigData), nil)
 	// A manifest outlives its signing key, so a signature by a key that
-	// has expired since is still good, unless the signature has expired
-	// itself. The library does not check that once it finds the key
-	// expired.
-	if errors.Is(err, pgperrors.ErrKeyExpired) && sig.SigExpired(time.Now()) {
-		err = pgperrors.ErrSignatureExpired
-	}
-
+	// has expired since is still good.
 	if err != nil && !errors.Is(err, pgperrors.ErrKeyExpired) {
 		return "", fmt.Errorf("verify signature: %w", err)
 	}

mfer/openpgp_test.go

@@ -18,7 +18,6 @@ import (
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
 	"github.com/ProtonMail/go-crypto/openpgp/elgamal"
-	pgperrors "github.com/ProtonMail/go-crypto/openpgp/errors"
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
@@ -417,10 +416,8 @@ func TestVerifySignature(t *testing.T) {
 	assert.Error(t, err)
 }
 
-// TestVerifySignatureKeyExpiredSince verifies two signatures made in 2020
-// by a key that expired a day after it was made. A signature with no
-// expiry time is still good. One that expired an hour after it was made is
-// refused, although the key has expired too.
+// TestVerifySignatureKeyExpiredSince verifies a signature made in 2020 by
+// a key that expired a day after it was made. The signature is still good.
 func TestVerifySignatureKeyExpiredSince(t *testing.T) {
 	t.Parallel()
 
@@ -432,14 +429,9 @@ func TestVerifySignatureKeyExpiredSince(t *testing.T) {
 	key := newTestKey(t, config)
 	data := []byte("signed in 2020")
 
-	var sig, expiringSig bytes.Buffer
+	var sig bytes.Buffer
 
 	require.NoError(t, openpgp.ArmoredDetachSign(&sig, key, bytes.NewReader(data), config))
-	require.NoError(t, openpgp.ArmoredDetachSign(&expiringSig, key,
-		bytes.NewReader(data), &packet.Config{
-			Time:            config.Time,
-			SigLifetimeSecs: uint32(time.Hour.Seconds()),
-		}))
 
 	pubKey, err := armoredPublicKey(key)
 	require.NoError(t, err)
@@ -447,9 +439,6 @@ func TestVerifySignatureKeyExpiredSince(t *testing.T) {
 	signer, err := verifySignature(data, sig.Bytes(), pubKey)
 	require.NoError(t, err)
 	assert.Equal(t, fingerprint(key), signer)
-
-	_, err = verifySignature(data, expiringSig.Bytes(), pubKey)
-	require.ErrorIs(t, err, pgperrors.ErrSignatureExpired)
 }
 
 func TestManifestSignatureVerification(t *testing.T) {