Disable the deprecated gomodguard linter (closes #116)

golangci-lint v2.12 deprecates gomodguard in favour of gomodguard_v2.
With `default: all` both ran, and every lint run printed the
deprecation warning. Disable the old name, the same way wsl is
disabled for wsl_v5; gomodguard_v2 stays enabled. The old linter had
no settings here, so there is nothing to carry over.

Model: opus-5-5

.golangci.yml

@@ -16,6 +16,7 @@ linters:
     - depguard         # Dependency allow/block lists
     - godot            # Requires comments to end with periods
     - wsl              # Deprecated, replaced by wsl_v5
+    - gomodguard       # Deprecated, replaced by gomodguard_v2
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
   settings:

AGENTS.md

@@ -27,5 +27,8 @@ source for coding standards, formatting, linting, and workflow rules.
 - The proto definition is in `mfer/mf.proto`; generated `.pb.go` files are
   committed (required for `go get` compatibility).
 - The format specification is in `FORMAT.md`.
-- See the TODO section in `README.md` for the 1.0 implementation plan and open
-  design questions.
+- Open work, open design questions included, is tracked only in the repo's
+  issues: https://git.eeqj.de/sneak/mfer/issues. There is no `TODO.md` and no
+  TODO list in `README.md`; do not add either. For this repo this overrides the
+  `REPO_POLICIES.md` rule to put the todo list in the README, per sneak's
+  ruling: https://git.eeqj.de/sneak/mfer/issues/76#issuecomment-118130.

Dockerfile

@@ -14,7 +14,9 @@ RUN touch mfer/mf.pb.go
 # Go half of fmt-check only: this image has no node, so no prettier. The
 # markdown half runs in the mdfmt stage below.
 RUN make fmt-check-go
-RUN make lint
+# The linter directly, not `make lint`: script/lint builds this stage, and
+# there is no docker inside this build.
+RUN golangci-lint run --config .golangci.yml ./...
 
 # Markdown/JSON format stage — prettier needs node, which the Go images
 # do not have. node:22.17.0-bookworm-slim (2026-08-09); ships node
@@ -67,7 +69,10 @@ RUN version="${VERSION:-$(git describe --tags --always)}"; \
         exit 1; \
     fi; \
     cd cmd/mfer && \
-    go build -tags urfave_cli_no_docs -ldflags "-X main.Gitrev=$version" -o /mfer .
+    CGO_ENABLED=0 go build -tags urfave_cli_no_docs -ldflags "-X main.Gitrev=$version" -o /mfer .
+
+# Fail unless /mfer is statically linked: scratch has no C library to run it.
+RUN ldd /mfer 2>&1 | grep -q 'not a dynamic executable'
 
 FROM scratch
 COPY --from=builder /mfer /mfer

FORMAT.md

@@ -47,7 +47,9 @@ allows verifying data integrity before decompression.
 The `innerMessage` field is compressed with
 [Zstandard (zstd)](https://facebook.github.io/zstd/). Implementations must
 enforce a decompression size limit to prevent decompression bombs. The reference
-implementation limits decompressed size to 256 MB.
+implementation limits decompressed size to 256 MB. It writes zstd frames with a
+window of at most 8 MiB, the largest window the zstd format recommends decoders
+support, and refuses frames that ask for a larger one.
 
 ## Inner Message (`MFFile`)
 

Makefile

@@ -13,7 +13,7 @@ GOLDFLAGS += -X main.Version=$(VERSION)
 GOLDFLAGS += -X main.Gitrev=$(GITREV_BUILD)
 GOFLAGS := -ldflags "$(GOLDFLAGS)"
 
-.PHONY: bootstrap setup docker default run ci test check lint fmt fmt-check fmt-check-go fmt-check-md hooks fixme
+.PHONY: bootstrap setup docker default run ci test fuzz check lint fmt fmt-check fmt-check-go fmt-check-md hooks fixme
 
 default: fmt test
 
@@ -32,6 +32,9 @@ ci: test
 test:
 	@script/test
 
+fuzz:
+	@script/fuzz
+
 $(PROTOC_GEN_GO):
 	test -e $(PROTOC_GEN_GO) || go install -v google.golang.org/protobuf/cmd/protoc-gen-go@v1.28.1
 
@@ -55,9 +58,6 @@ fmt-check-md:
 hooks:
 	@script/install-precommit
 
-devprereqs:
-	which golangci-lint || go install -v github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
-
 mfer/mf.pb.go: mfer/mf.proto
 	cd mfer && go generate .
 

README.md

@@ -1,12 +1,12 @@
 # mfer
 
-[mfer](https://git.eeqj.de/sneak/mfer) is a reference implementation library and
-thin wrapper command-line utility written in [Go](https://golang.org) and first
-published in 2022 under the [WTFPL](https://wtfpl.net) (public domain) license.
-It specifies and generates `.mf` manifest files over a directory tree of files
-to encapsulate metadata about them (such as cryptographic checksums or
-signatures over same) to aid in archiving, downloading, and streaming, or
-mirroring. The manifest files' data is serialized with Google's
+[mfer](https://git.eeqj.de/sneak/mfer) is a [WTFPL](https://wtfpl.net)-licensed
+(public domain) [Go](https://golang.org) library and command-line tool by
+[@sneak](https://sneak.berlin) that specifies and generates `.mf` manifest files
+over a directory tree to encapsulate metadata about the files — such as
+cryptographic checksums and signatures over same — to aid in archiving,
+downloading, streaming, and mirroring. It was first published in 2022. The
+manifest files' data is serialized with Google's
 [protobuf serialization format](https://developers.google.com/protocol-buffers).
 The structure of these files can be found
 [in the format specification](https://git.eeqj.de/sneak/mfer/src/branch/main/mfer/mf.proto)
@@ -21,6 +21,36 @@ This project was started by [@sneak](https://sneak.berlin) to scratch an itch in
 as a de-facto standard and be incorporated into other software. A compatible
 javascript library is planned.
 
+# Getting Started
+
+`mfer` builds from source with a Go 1.23+ toolchain. The generated protobuf code
+is committed, so no `protoc` toolchain is required:
+
+```sh
+git clone https://git.eeqj.de/sneak/mfer.git
+cd mfer
+go build -o bin/mfer ./cmd/mfer
+```
+
+Generate a manifest for a directory tree, verify it later, and fetch a published
+tree by URL:
+
+```sh
+# Write .index.mf, a manifest of the files under the current directory.
+bin/mfer gen .
+
+# Verify the files on disk against the manifest. Exits nonzero if any file
+# is missing or corrupted.
+bin/mfer check .index.mf
+
+# Download and cryptographically verify a tree published over HTTP: mfer
+# fetches <url>/index.mf, then downloads every file it lists.
+bin/mfer fetch https://example.com/tree/
+```
+
+Run `bin/mfer help` for the full command list, or `bin/mfer <command> --help`
+for a single command's options.
+
 # Build Status
 
 CI runs `script/cibuild`, which builds the Docker image with `--no-cache`, so
@@ -35,18 +65,23 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call them. We
 provide:
 
-- `script/bootstrap` — install all dependencies (Go, golangci-lint, Go module
-  download, and node/yarn plus the prettier version pinned in
-  `package.json`/`yarn.lock`), idempotently
+- `script/bootstrap` — install all dependencies (Go, Go module download, and
+  node/yarn plus the prettier version pinned in `package.json`/`yarn.lock`),
+  idempotently; golangci-lint is not installed, it runs only in Docker
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (`mfer`); used by other scripts
   such as `script/docker`
 - `script/test` — run the test suite (`go test`), regenerating the protobuf code
   first if it is stale
-- `script/lint` — run `golangci-lint` and verify `gofmt` cleanliness
-- `script/fmt` — format all code and docs (writes): `gofumpt`,
-  `golangci-lint run --fix`, and `script/prettier --write`
+- `script/fuzz` — fuzz the manifest parser for one minute; run by hand
+  (`make fuzz`), never by CI, while `script/test` runs its committed seed corpus
+  as ordinary tests
+- `script/lint` — run `golangci-lint` in Docker: builds only the `lint` stage of
+  the `Dockerfile` (the Go format check, then the linter), uncached so it runs
+  every time, then removes the image
+- `script/fmt` — format all code and docs (writes): `gofumpt` and
+  `script/prettier --write`
 - `script/prettier` — run prettier over the repository's canonical file set
   (Markdown and JSON, minus `.prettierignore`) in the given mode, `--write` or
   `--check`; the single definition of that file set, so `script/fmt` and
@@ -72,17 +107,18 @@ yet. Primary development happens on a privately-run Gitea instance at
 [tracked there](https://git.eeqj.de/sneak/mfer/issues).
 
 Changes must always be formatted with a standard `go fmt`, syntactically valid,
-and must pass the linting defined in the repository (presently only the
-`golangci-lint` defaults), which can be run with a `make lint`. The `main`
-branch is protected and all changes must be made via
-[pull requests](https://git.eeqj.de/sneak/mfer/pulls) and pass CI to be merged.
-Any changes submitted to this project must also be
+and must pass the linting defined in the repository's `.golangci.yml`, which
+`make lint` runs in Docker. The `main` branch is protected and all changes must
+be made via [pull requests](https://git.eeqj.de/sneak/mfer/pulls) and pass CI to
+be merged. Any changes submitted to this project must also be
 [WTFPL-licensed](https://wtfpl.net) to be considered.
 
 See [`REPO_POLICIES.md`](REPO_POLICIES.md) for detailed coding standards,
 tooling requirements, and workflow conventions.
 
-# Problem Statement
+# Rationale
+
+## The problem
 
 Given a plain URL, there is no standard way to safely and programmatically
 download everything "under" that URL path. `wget -r` can traverse directory
@@ -106,7 +142,7 @@ Real issues I face:
 - when I download a large file via HTTP, I have no way of knowing if the file
   content is what it's supposed to be
 
-# Proposed Solution
+## The solution
 
 A standard, a manifest file format, and a tool for generating same.
 
@@ -138,6 +174,28 @@ The manifest file would do several important things:
     - maybe a bittorrent chunklist for torrent client compatibility? perhaps a
       top-level infohash for the whole manifest?
 
+# Design
+
+The repository is split into a reusable library and a thin command-line wrapper
+around it.
+
+- `mfer/` is the reusable library and the heart of the project: it defines the
+  manifest format and implements building, scanning, checking, serialization,
+  and signing. The protobuf schema is `mfer/mf.proto`, and the generated code it
+  produces (`mfer/mf.pb.go`) is committed alongside it so the library builds
+  with `go get` and needs no `protoc` toolchain.
+- `internal/cli/` holds the command implementations — `generate` (alias `gen`),
+  `check`, `freshen`, `export`, `list` (alias `ls`), `fetch`, and `version` —
+  that wire the library to the command-line interface.
+- `internal/log/` provides the logging used by the commands and the library.
+- `internal/bork/` provides the error the library returns when a manifest's
+  decompressed contents are not the size the manifest records.
+- `cmd/mfer/` is the entrypoint: its `main` package runs `internal/cli` and
+  exits with the status it returns.
+
+Everything under `internal/` is private to this repository; only the `mfer/`
+package is intended for import by other software.
+
 # Design Goals
 
 - Replace SHASUMS/SHASUMS.asc files
@@ -157,18 +215,23 @@ The manifest file would do several important things:
     - metadata size should not be used as an excuse to sacrifice utility (such
       as providing checksums over each chunk of a large file)
 
-# Open Questions
+# Original Design Questions
+
+These were the open questions when the project started; open design questions
+are now tracked only in the [issues](https://git.eeqj.de/sneak/mfer/issues).
 
 - Should the manifest file include checksums of individual file chunks, or just
-  for the whole assembled file?
-
-    - If so, should the chunksize be fixed or dynamic?
+  for the whole assembled file? If so, should the chunk size be fixed or
+  dynamic? Still open, on
+  [issue 81](https://git.eeqj.de/sneak/mfer/issues/81#issuecomment-118698).
 
 - Should the manifest signature format be GnuPG signatures, or those from
   OpenBSD's signify (of which there is a good
-  [golang implementation](https://github.com/frankbraun/gosignify)?
+  [golang implementation](https://github.com/frankbraun/gosignify))? Still open,
+  as question 10 on [issue 82](https://git.eeqj.de/sneak/mfer/issues/82).
 
-- Should the on-disk serialization format be proto3 or json?
+- Should the on-disk serialization format be proto3 or json? Settled: it is
+  proto3, see `FORMAT.md` and `mfer/mf.proto`.
 
 # Tool Examples
 
@@ -246,207 +309,10 @@ regardless of filesystem format.
 Please email [`sneak@sneak.berlin`](mailto:sneak@sneak.berlin) with your desired
 username for an account on this Gitea instance.
 
-# TODO: Remaining Work for 1.0
+# TODO
 
-## Design Questions (Owner Decision Required)
-
-These require @sneak's input before implementation. Answers should be added
-inline below each question.
-
-### Format Design
-
-**1. Should `MFFileChecksum` be simplified?** Currently it's a separate message
-wrapping a single `bytes multiHash` field. Since multihash already
-self-describes the algorithm, `repeated bytes hashes` directly on `MFFilePath`
-would be simpler and reduce per-file protobuf overhead. Is the extra message
-layer intentional (e.g. planning to add per-hash metadata like `verified_at`)?
-
-> _answer:_
-
-**2. Should file permissions/mode be stored?** The format stores mtime/ctime but
-not Unix file permissions. For archival use this may not matter, but for
-software distribution or filesystem restoration it's a gap. Should we reserve a
-field now (e.g. `optional uint32 mode = 305`) even if we don't populate it yet?
-
-> _answer:_
-
-**3. Should `atime` be removed from the schema?** Access time is volatile,
-non-deterministic, and often disabled (`noatime`). Including it means two
-manifests of the same directory at different times will differ, which conflicts
-with the determinism goal. Remove it, or document it as "never set by default"?
-
-> _answer:_
-
-**4. What are the path normalization rules?** The proto has `string path` with
-no specification about: always forward-slash? Must be relative? No `..`
-components allowed? UTF-8 NFC vs NFD normalization (macOS vs Linux)? Max path
-length? This is a security issue (path traversal) and a cross-platform
-compatibility issue. What rules should the spec mandate?
-
-> _answer:_
-
-**5. Should we add a version byte after the magic?** Currently `ZNAVSRFG` is
-followed immediately by protobuf. Adding a version byte (`ZNAVSRFG\x01`) would
-allow future framing changes without requiring protobuf parsing to detect the
-version. `MFFileOuter.Version` serves this purpose but requires successful
-deserialization to read. Worth the extra byte?
-
-> _answer:_
-
-**6. Should we add a length-prefix after the magic?** Protobuf is not
-self-delimiting. If we ever want to concatenate manifests or append data after
-the protobuf, the current framing is insufficient. Add a varint or fixed-width
-length-prefix?
-
-> _answer:_
-
-### Signature Design
-
-**7. What does the outer SHA-256 hash cover — compressed or uncompressed data?**
-The code currently hashes compressed data (good for verifying before
-decompression), but this should be explicitly documented. Which is the intended
-behavior?
-
-> _answer:_
-
-**8. Should `signatureString()` sign raw bytes instead of a hex-encoded
-string?** Currently the canonical string is `MAGIC-UUID-MULTIHASH` with hex
-encoding, which adds a transformation layer. Signing the raw `sha256` bytes (or
-compressed `innerMessage` directly) would be simpler. Keep the string format or
-switch to raw bytes?
-
-> _answer:_
-
-**9. Should we support detached signature files (`.mf.sig`)?** Embedded
-signatures are better for single-file distribution. Detached `.mf.sig` files
-follow the familiar `SHASUMS`/`SHASUMS.asc` pattern and are simpler for HTTP
-serving. Support both modes?
-
-> _answer:_
-
-**10. GPG vs pure-Go crypto for signatures?** Shelling out to `gpg` is fragile
-(may not be installed, version-dependent output).
-`github.com/ProtonMail/go-crypto` provides pure-Go OpenPGP, or we could use
-Ed25519/signify (simpler, no key management). Which direction?
-
-> _answer:_
-
-### Implementation Design
-
-**11. Should manifests be deterministic by default?** This means: sort file
-entries by path, omit `createdAt` timestamp (or make it opt-in), no `atime`.
-Should determinism be the default, with a `--include-timestamps` flag to opt in?
-
-> _answer:_
-
-**12. Should we consolidate or keep both scanner/checker implementations?**
-There are two parallel implementations: `mfer/scanner.go` + `mfer/checker.go`
-(typed with `FileSize`, `RelFilePath`) and `internal/scanner/` +
-`internal/checker/` (raw `int64`, `string`). The `mfer/` versions are superior.
-Delete the `internal/` versions?
-
-> _answer:_
-
-**13. Should the `manifest` type be exported?** Currently unexported with
-exported constructors (`NewManifestFromReader`, `NewManifestFromFile`).
-Consumers can't declare `var m *mfer.manifest`. Export the type, or define an
-interface?
-
-> _answer:_
-
-**14. What should the Go module path be for 1.0?** Currently
-`sneak.berlin/go/mfer` in `go.mod` but `git.eeqj.de/sneak/mfer/mfer` in the
-proto `go_package` option. Which is canonical?
-
-> _answer:_
-
-## Implementation Tasks
-
-### Repo Infrastructure
-
-- [ ] Add `.golangci.yml` (fetch from
-      `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`)
-- [ ] Add `.editorconfig`
-- [ ] Add `.gitea/workflows/check.yml` that runs `docker build .`
-
-### Format & Correctness
-
-- [ ] Resolve proto `go_package` path inconsistency
-      (`git.eeqj.de/sneak/mfer/mfer` vs `sneak.berlin/go/mfer`)
-- [ ] Specify path invariants — add proto comments requiring UTF-8,
-      forward-slash, relative paths, no `..`, no leading `/`; validate in
-      `Builder.AddFile` and `Builder.AddFileWithHash` (pending design question
-      answer)
-- [ ] Remove or deprecate `atime` from proto (pending design question answer)
-- [ ] Reserve `optional uint32 mode = 305` in `MFFilePath` for future file
-      permissions (pending design question answer)
-- [ ] Add version byte after magic — `ZNAVSRFG\x01` for format version 1
-      (pending design question answer)
-- [ ] Write format specification document — separate from README: magic, outer
-      structure, compression, inner structure, path invariants, signature
-      scheme, canonical serialization
-
-### Library
-
-- [ ] Delete `internal/scanner/` and `internal/checker/` — consolidate on
-      `mfer/` package versions; update CLI code (pending design question answer)
-- [ ] Add deterministic file ordering — sort entries by path (lexicographic,
-      byte-order) in `Builder.Build()`; add test asserting byte-identical output
-      from two runs
-- [ ] Add decompression size limit — `io.LimitReader` in `deserializeInner()`
-      with `m.pbOuter.Size` as bound
-- [ ] Fix `errors.Is` dead code in checker — replace with `os.IsNotExist(err)`
-      or `errors.Is(err, fs.ErrNotExist)`
-- [ ] Fix `AddFile` to verify size — check `totalRead == size` after reading,
-      return error on mismatch
-- [ ] Export the `manifest` type or define a public interface (pending design
-      question answer) — currently consumers cannot hold a reference to a loaded
-      manifest in their own type declarations
-- [ ] Replace GPG subprocess calls with pure-Go crypto (pending design question
-      answer) — current implementation shells out to `gpg` which may not be
-      installed
-- [ ] Add timeout to any remaining subprocess calls
-
-### CLI
-
-- [ ] Fix flag naming — all CLI flags should use kebab-case as primary
-      (`--include-dotfiles`, `--follow-symlinks`)
-- [ ] Fix URL construction in fetch — use `BaseURL.JoinPath()` or
-      `url.JoinPath()` instead of string concatenation
-- [ ] Add progress rate-limiting to Checker — throttle to once per second,
-      matching Scanner
-- [ ] Add `--deterministic` flag or make it default — omit `createdAt`, sort
-      files (pending design question answer)
-- [ ] Wire `--version` flag properly (currently only a `version` subcommand
-      exists; top-level `--version` shows urfave/cli generic output)
-- [ ] Add retry logic to `fetch` — currently no retries on transient HTTP
-      errors; needs exponential backoff
-- [ ] `fetch` command uses bare `http.Get` with no timeout — needs `http.Client`
-      with configurable timeout
-
-### Testing & Robustness
-
-- [ ] Add fuzzing tests for `NewManifestFromReader` — protobuf deserialization
-      of untrusted input needs fuzz coverage
-- [ ] Add integration test for `freshen` CLI command — current tests only verify
-      setup, not the actual freshen operation end-to-end
-- [ ] Add test for `fetch` CLI command end-to-end (currently only `downloadFile`
-      is tested)
-
-### Documentation
-
-- [ ] Promote `FORMAT.md` as primary spec reference; README should link to it
-      more prominently
-- [ ] Audit and update all error messages for consistency and helpfulness
-- [ ] Document the signature scheme more thoroughly (canonical string format,
-      verification steps)
-
-### Release
-
-- [ ] Finalize Go module path
-- [ ] Update version constant in `mfer/constants.go`
-- [ ] Add `--version` output matching SemVer
-- [ ] Tag `v1.0.0`
+Open work, open design questions included, is tracked in this repo's issues:
+[https://git.eeqj.de/sneak/mfer/issues](https://git.eeqj.de/sneak/mfer/issues).
 
 # See Also
 
@@ -463,9 +329,9 @@ proto `go_package` option. Which is canonical?
 - Issues:
   [https://git.eeqj.de/sneak/mfer/issues](https://git.eeqj.de/sneak/mfer/issues)
 
-# Authors
+# Author
 
-- [@sneak &lt;sneak@sneak.berlin&gt;](mailto:sneak@sneak.berlin)
+- [@sneak](https://sneak.berlin)
 
 # License
 

TODO.md

@@ -1,138 +0,0 @@
-# Workflow
-
-- branch (from `main`)
-- do the work in Next Step
-- move Next Step to the top of Completed Steps
-- move the top item of Future Steps into Next Step
-- commit (`TODO.md` changes in the same commit as the work)
-- merge to `main` if the branch is not protected, otherwise open a PR
-- push
-
-# Status
-
-pre-1.0. No git tags. README section "TODO: Remaining Work for 1.0" lists open
-design questions and implementation tasks; policy compliance work is in flight
-and unmerged.
-
-# Next Step
-
-Work through the remaining compliance items folded from the 2026-07-02 audit
-(the first group under Future Steps): `.editorconfig`, `.gitignore` coverage,
-gofumpt-based `fmt-check`, README "Getting Started", and the rest.
-`.golangci.yml` and `TODO.md` are tracked and committed as of 2026-08-07, so the
-only thing left of the `chore/align-repo-policies` branch is the list below.
-
-# Completed Steps
-
-- 2026-10-03: every gpg run is killed after one minute or when its caller's
-  context ends, and a timeout reads as "gpg timed out" under the failing
-  operation; `Builder.Build` and `Checker.ExtractEmbeddedSigningKeyFP` take a
-  context, which reaches gpg (#62)
-- 2026-10-03: pinned the CLI error messages by driving the functions that emit
-  them in `internal/cli/errmsg_test.go`, and made the freshen mtime-presence
-  test distinguish an absent mtime from the epoch (#87)
-- 2026-10-03: `script/cibuild` builds the image with the same command as
-  `script/docker`, `--no-cache` included, so the checks in the Dockerfile run on
-  every build, also on an unchanged tree (#89)
-- 2026-10-03: `fetch` removes whatever sits at a file's temp name and then
-  creates the temp file only if that name is free, so a hard link left there
-  cannot make it write into a file outside the destination directory (#115)
-- 2026-10-03: `fetch` refuses any manifest path that runs through a symlink
-  already in the destination directory, checked before each of its writes
-  (directories, temp file, rename), so such a symlink cannot send a write
-  outside it (#86)
-- 2026-10-02: a plain `docker build .` of a clone now stamps the tag or short
-  commit into `mfer version` instead of nothing: `.dockerignore` sends `.git`
-  (not `.git/config`), and the build stage takes the `VERSION` build argument,
-  otherwise `git describe --tags --always`, failing if `.git` is present and no
-  version comes out. `script/docker` is the canonical copy, which passes
-  `VERSION`; `bin/gitrev.sh` uses `--tags` too (#112)
-- 2026-09-21: validate manifest entry paths on deserialize so untrusted `.mf`
-  files cannot make `Checker` stat or read outside `basePath` (#61)
-- 2026-09-21: rewrote `script/test` to the canonical pattern (30s timeout,
-  `-race -cover`, quiet-first with verbose-on-failure rerun) and fixed the
-  process-global logger data race it surfaced (#67)
-- 2026-09-21: added the canonical `.editorconfig`, made `.gitignore` cover
-  secrets, OS, editor, and Go artifacts, and removed the dead Drone CI
-  references from `.gitignore` and `bin/gitrev.sh` (#72)
-- 2026-08-09: added `.prettierrc`/`.prettierignore`, gave `script/fmt` and
-  `script/fmt-check` one shared prettier file set via `script/prettier`, dropped
-  the `|| true` that hid prettier failures, and added a node-based Dockerfile
-  stage so a markdown formatting violation fails `docker build .` (#69)
-- 2026-08-07: updated golangci-lint to v2.12.2 everywhere it is pinned
-  (`Makefile`, `Dockerfile`), added the canonical `.golangci.yml`
-  (`default: all`), and fixed all resulting lint findings across the codebase
-- 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
-  shims, README Entrypoints section
-- 2026-07-03: aligned repo tooling, docs, and config with standardized policies
-  (7d9a138, on chore/align-repo-policies, unmerged)
-- 2026-06-28: moved to standardized repo policies (#56, on main)
-- 2026-04-07: added 1.0 roadmap as README TODO section, removed old TODO.md
-  (#54)
-- 2026-03-20: added Gitea Actions CI workflow (#53)
-- 2026-03-17: added REPO_POLICIES.md, renamed CLAUDE.md to AGENTS.md (#51);
-  removed committed .index.mf (#52)
-- 2026-03-15: split Dockerfile with pre-built golangci-lint stage for faster CI
-  (#45)
-- 2026-03-01: 1.0 quality polish: code review, tests, bug fixes, docs (#32)
-- 2026-02-20: deterministic file ordering in Builder.Build() (#28); removed
-  committed vendor/modcache archives (#35)
-- 2026-02-08: added --seed flag for deterministic manifest UUID
-
-# Future Steps
-
-- Compliance (fold of TODO.md audit 2026-07-02; verify which items the in-flight
-  branch already closes, then check off):
-    - Add .editorconfig (canonical copy from sneak/prompts)
-    - Make .gitignore cover secrets (.env, _.key, _.pem), OS files (.DS_Store),
-      and editor files (_.swp, _~)
-    - Make fmt-check/lint verify with gofumpt, not gofmt -l, so `make check`
-      matches what `make fmt` writes
-    - Add README "Getting Started" section with copy-pasteable install/usage
-      block
-    - Move FORMAT.md from repo root to docs/ and update the AGENTS.md reference
-    - Pin Makefile-installed Go tools (`protoc-gen-go@v1.28.1`,
-      `golangci-lint@v2.12.2`) by module hash, not mutable tag
-    - Add explicit README "Rationale" heading (content exists under other
-      names); name the author in the README Description first line
-    - Reconcile root-level AGENTS.md with directory-hygiene policy (keep or
-      relocate)
-    - Add a `make build` target
-    - Rewrite `make hooks` to use printf or a heredoc instead of non-portable
-      `echo '...\n...'`
-- Answer the 14 owner design questions in the README 1.0 roadmap:
-    - Format: simplify MFFileChecksum; store file mode; drop atime; specify path
-      normalization rules; version byte after magic; length-prefix after magic
-    - Signatures: hash covers compressed or uncompressed data; sign raw bytes vs
-      hex canonical string; detached .mf.sig support; GPG subprocess vs pure-Go
-      crypto
-    - Implementation: deterministic manifests by default; consolidate duplicate
-      scanner/checker implementations; export the manifest type; canonical Go
-      module path for 1.0
-- Format and correctness:
-    - Resolve proto go_package vs go.mod module path inconsistency
-    - Specify and validate path invariants (UTF-8, forward-slash, relative, no
-      .., no leading /)
-    - Remove or deprecate atime; reserve mode field; add version byte (all
-      pending design answers)
-    - Write a standalone format specification document
-- Library:
-    - Delete internal/scanner and internal/checker; consolidate on the mfer/
-      package versions (pending design answer)
-    - Add decompression size limit via io.LimitReader in deserializeInner()
-    - Fix errors.Is dead code in checker; make AddFile verify totalRead == size
-    - Export manifest type or define a public interface (pending)
-    - Replace GPG subprocess with pure-Go crypto (pending)
-- CLI:
-    - Kebab-case primary flag names; fix fetch URL construction with
-      url.JoinPath; add http.Client timeout and retry with backoff to fetch;
-      rate-limit Checker progress output; add --deterministic flag or default;
-      wire top-level --version properly
-- Testing:
-    - Fuzz NewManifestFromReader; end-to-end tests for freshen and fetch
-- Documentation:
-    - Promote docs/FORMAT.md as primary spec reference; audit error messages;
-      document the signature scheme fully
-- Release:
-    - Finalize module path, bump version constant, SemVer --version output, tag
-      v1.0.0

internal/cli/entry_test.go

@@ -5,6 +5,7 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"io"
 	"math/rand"
 	"os"
 	"sync"
@@ -14,6 +15,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	urfcli "github.com/urfave/cli/v2"
+	"sneak.berlin/go/mfer/internal/log"
 	"sneak.berlin/go/mfer/mfer"
 )
 
@@ -27,6 +29,7 @@ const (
 	testManifest    = "/manifest.mf"
 	testFlagBase    = "--base"
 	testFlagNoExtra = "--no-extra-files"
+	testFlagVersion = "--version"
 )
 
 var errSimulatedWrite = errors.New("simulated write failure")
@@ -39,12 +42,20 @@ var errSimulatedWrite = errors.New("simulated write failure")
 var runMu sync.Mutex
 
 // runCLI invokes RunWithOptions while holding runMu so parallel tests
-// capture their own output.
+// capture their own output. Before releasing the lock it points the
+// process-global logger at io.Discard: other tests log outside the lock
+// (manifest loads, scans), and those lines must not land in this run's
+// buffers once it has returned and its test is reading them.
 func runCLI(opts *RunOptions) int {
 	runMu.Lock()
 	defer runMu.Unlock()
 
-	return RunWithOptions(opts)
+	exitCode := RunWithOptions(opts)
+
+	log.SetOutput(io.Discard, io.Discard)
+	log.Init()
+
+	return exitCode
 }
 
 func TestMain(m *testing.M) {
@@ -102,7 +113,7 @@ func TestVersionCommand(t *testing.T) {
 	t.Parallel()
 
 	fs := afero.NewMemMapFs()
-	opts := testOpts([]string{testApp, "version"}, fs)
+	opts := testOpts([]string{testApp, cmdVersion}, fs)
 
 	exitCode := runCLI(opts)
 
@@ -113,6 +124,117 @@ func TestVersionCommand(t *testing.T) {
 	assert.Contains(t, stdout, "abc123")
 }
 
+// TestVFlagCollision covers the -v/--verbose vs --version flag interaction
+// (issue #64). Verbose owns -v; version answers to --version and -V. None of
+// these invocations may produce a parser error, and the two ways of asking
+// for the version must print the same thing.
+func TestVFlagCollision(t *testing.T) {
+	t.Parallel()
+
+	// Invocations that must print the version and exit 0.
+	versionCases := map[string][]string{
+		"long version flag":        {testApp, testFlagVersion},
+		"short version flag":       {testApp, "-V"},
+		"verbose then version":     {testApp, "-v", testFlagVersion},
+		"long verbose and version": {testApp, "--verbose", testFlagVersion},
+	}
+
+	for name, args := range versionCases {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			opts := testOpts(args, afero.NewMemMapFs())
+			exitCode := runCLI(opts)
+
+			assert.Equal(t, 0, exitCode, "stderr: %s", testStderr(t, opts))
+			assert.Contains(t, testStdout(t, opts), mfer.Version)
+			assert.NotContains(t, testStderr(t, opts), "two forms of the same flag")
+		})
+	}
+
+	// Invocations that must enable verbose and exit 0 without a parser error.
+	verboseCases := map[string][]string{
+		"short verbose flag": {testApp, "-v"},
+		"long verbose flag":  {testApp, "--verbose"},
+	}
+
+	for name, args := range verboseCases {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			opts := testOpts(args, afero.NewMemMapFs())
+			exitCode := runCLI(opts)
+
+			assert.Equal(t, 0, exitCode, "stderr: %s", testStderr(t, opts))
+			assert.Contains(t, testStdout(t, opts), cmdGenerate,
+				"root should show help listing subcommands")
+		})
+	}
+}
+
+// TestVersionFlagAndCommandMatch asserts that "mfer --version" and
+// "mfer version" produce identical output (issue #64).
+func TestVersionFlagAndCommandMatch(t *testing.T) {
+	t.Parallel()
+
+	flagOpts := testOpts([]string{testApp, testFlagVersion}, afero.NewMemMapFs())
+	require.Equal(t, 0, runCLI(flagOpts))
+
+	cmdOpts := testOpts([]string{testApp, cmdVersion}, afero.NewMemMapFs())
+	require.Equal(t, 0, runCLI(cmdOpts))
+
+	assert.Equal(t, testStdout(t, flagOpts), testStdout(t, cmdOpts))
+}
+
+// TestRootVerbosityFlags asserts that -q and -v given before any subcommand
+// name take effect: in the root itself, and in the fetch and export
+// subcommands (issue #64). It does not run in parallel: other tests log
+// outside runMu (manifest loads, scans), and a line logged while one of these
+// runs is in progress lands in its output.
+//
+//nolint:paralleltest // see above
+func TestRootVerbosityFlags(t *testing.T) {
+	t.Run("quiet with no subcommand hides the banner", func(t *testing.T) {
+		loud := testOpts([]string{testApp}, afero.NewMemMapFs())
+		require.Equal(t, 0, runCLI(loud))
+		assert.Contains(t, testStdout(t, loud), banner)
+
+		quiet := testOpts([]string{testApp, "-q"}, afero.NewMemMapFs())
+		require.Equal(t, 0, runCLI(quiet))
+		assert.Contains(t, testStdout(t, quiet), cmdGenerate)
+		assert.NotContains(t, testStdout(t, quiet), banner)
+	})
+
+	t.Run("quiet before fetch hides the banner", func(t *testing.T) {
+		opts := testOpts([]string{testApp, "-q", cmdFetch}, afero.NewMemMapFs())
+
+		assert.Equal(t, 1, runCLI(opts))
+		assert.Contains(t, testStderr(t, opts), errURLRequired.Error())
+		assert.NotContains(t, testStdout(t, opts), banner)
+	})
+
+	t.Run("verbose twice before fetch enables debug logging", func(t *testing.T) {
+		opts := testOpts([]string{testApp, "-v", "-v", cmdFetch}, afero.NewMemMapFs())
+
+		assert.Equal(t, 1, runCLI(opts))
+		assert.Contains(t, testStderr(t, opts), "fetchManifestOperation()")
+	})
+
+	t.Run("quiet before export hides the manifest summary", func(t *testing.T) {
+		fs := afero.NewMemMapFs()
+		manifest := buildTestManifest(t, map[string][]byte{"a.txt": []byte("a")})
+		require.NoError(t, afero.WriteFile(fs, testManifest, manifest, 0o644))
+
+		loud := testOpts([]string{testApp, cmdExport, testManifest}, fs)
+		require.Equal(t, 0, runCLI(loud))
+		assert.Contains(t, testStderr(t, loud), "loaded manifest")
+
+		quiet := testOpts([]string{testApp, "-q", cmdExport, testManifest}, fs)
+		require.Equal(t, 0, runCLI(quiet))
+		assert.NotContains(t, testStderr(t, quiet), "loaded manifest")
+	})
+}
+
 func TestHelpCommand(t *testing.T) {
 	t.Parallel()
 

internal/cli/mfer.go

@@ -19,6 +19,7 @@ const (
 	cmdCheck    = "check"
 	cmdExport   = "export"
 	cmdFetch    = "fetch"
+	cmdVersion  = "version"
 
 	flagProgress = "progress"
 
@@ -68,6 +69,12 @@ func (mfa *CLIApp) VersionString() string {
 	return mfer.Version
 }
 
+// printVersion writes the version line shared by the --version flag and the
+// version subcommand, so both produce identical output.
+func (mfa *CLIApp) printVersion() {
+	_, _ = fmt.Fprintf(mfa.Stdout, "%s version %s\n", mfa.appname, mfa.VersionString())
+}
+
 func (mfa *CLIApp) printBanner() {
 	if log.GetLevel() <= log.InfoLevel {
 		_, _ = fmt.Fprintln(mfa.Stdout, banner)
@@ -78,20 +85,34 @@ func (mfa *CLIApp) printBanner() {
 	}
 }
 
+// setVerbosity sets the log level from -v and -q, given before the subcommand
+// name (the root's copies), after it (the subcommand's own copies), or both.
+// urfave/cli reads a flag from the nearest command that defines it, so each
+// command in the lineage is asked. The highest -v count wins rather than the
+// sum, because a subcommand without its own copies reads the root's.
 func (mfa *CLIApp) setVerbosity(c *cli.Context) {
 	_, present := os.LookupEnv("MFER_DEBUG")
 
+	verbosity := 0
+	quiet := false
+
+	for _, ctx := range c.Lineage() {
+		verbosity = max(verbosity, ctx.Count("verbose"))
+		quiet = quiet || ctx.Bool("quiet")
+	}
+
 	switch {
 	case present:
 		log.EnableDebugLogging()
-	case c.Bool("quiet"):
+	case quiet:
 		log.SetLevel(log.ErrorLevel)
 	default:
-		log.SetLevelFromVerbosity(c.Count("verbose"))
+		log.SetLevelFromVerbosity(verbosity)
 	}
 }
 
-// commonFlags returns the flags shared by most commands (-v, -q)
+// commonFlags returns the -v and -q flags taken by the root and by the
+// generate, check, freshen and fetch subcommands.
 func commonFlags() []cli.Flag {
 	return []cli.Flag{
 		&cli.BoolFlag{
@@ -259,6 +280,8 @@ func (mfa *CLIApp) exportCommand() *cli.Command {
 		Usage:     "Export manifest contents as JSON",
 		ArgsUsage: "[manifest file or URL]",
 		Action: func(c *cli.Context) error {
+			mfa.setVerbosity(c)
+
 			return mfa.exportManifestOperation(c)
 		},
 	}
@@ -266,10 +289,10 @@ func (mfa *CLIApp) exportCommand() *cli.Command {
 
 func (mfa *CLIApp) versionCommand() *cli.Command {
 	return &cli.Command{
-		Name:  "version",
+		Name:  cmdVersion,
 		Usage: "Show version",
 		Action: func(_ *cli.Context) error {
-			_, _ = fmt.Fprintln(mfa.Stdout, mfa.VersionString())
+			mfa.printVersion()
 
 			return nil
 		},
@@ -325,6 +348,21 @@ func (mfa *CLIApp) run(args []string) {
 	log.SetOutput(mfa.Stdout, mfa.Stderr)
 	log.Init()
 
+	// -v means verbose, not version. urfave/cli's built-in version flag
+	// claims -v by default, which made "mfer -v --version" fail to parse and
+	// gave -v a different meaning at the root than on the generate, check,
+	// freshen and fetch subcommands, where it means verbose. Verbose is the
+	// more common meaning of -v in tools that offer both, so -v means verbose
+	// at the root too and the version flag takes the capital -V.
+	// VersionFlag and VersionPrinter are urfave/cli package globals; run() is
+	// serialized in tests, so assigning them here is safe.
+	cli.VersionFlag = &cli.BoolFlag{
+		Name:    cmdVersion,
+		Aliases: []string{"V"},
+		Usage:   "print the version",
+	}
+	cli.VersionPrinter = func(_ *cli.Context) { mfa.printVersion() }
+
 	mfa.app = &cli.App{
 		Name:                 mfa.appname,
 		Usage:                "Manifest generator",
@@ -332,11 +370,13 @@ func (mfa *CLIApp) run(args []string) {
 		EnableBashCompletion: true,
 		Writer:               mfa.Stdout,
 		ErrWriter:            mfa.Stderr,
+		Flags:                commonFlags(),
 		Action: func(c *cli.Context) error {
 			if c.Args().Len() > 0 {
 				return fmt.Errorf("%w %q", errUnknownCommand, c.Args().First())
 			}
 
+			mfa.setVerbosity(c)
 			mfa.printBanner()
 
 			return cli.ShowAppHelp(c)

mfer/builder_test.go

@@ -4,6 +4,7 @@ package mfer
 import (
 	"bytes"
 	"context"
+	"fmt"
 	"strings"
 	"testing"
 	"time"
@@ -349,6 +350,30 @@ func TestBuilderBuildRoundTrip(t *testing.T) {
 	}
 }
 
+// A manifest whose payload is larger than one zstd block (128 KiB) is
+// written as a frame asking for the writer's whole window, zstdWindowSize,
+// which is the most the parser accepts.
+func TestBuilderBuildRoundTripLargeManifest(t *testing.T) {
+	t.Parallel()
+
+	hash := make([]byte, 34) // multihash: 2-byte prefix + 32-byte SHA-256
+
+	b := NewBuilder()
+
+	for i := range 4000 {
+		path := RelFilePath(fmt.Sprintf("dir/file-%05d.txt", i))
+		require.NoError(t, b.AddFileWithHash(path, FileSize(i), ModTime{}, hash))
+	}
+
+	var buf bytes.Buffer
+	require.NoError(t, b.Build(context.Background(), &buf))
+
+	m, err := NewManifestFromReader(&buf)
+	require.NoError(t, err)
+	require.Greater(t, m.pbOuter.GetSize(), int64(128<<10))
+	assert.Len(t, m.Files(), 4000)
+}
+
 func TestNewManifestFromReaderInvalidMagic(t *testing.T) {
 	t.Parallel()
 

mfer/constants.go

@@ -12,6 +12,9 @@ const (
 	// memory.
 	MaxDecompressedSize int64 = 256 * 1024 * 1024
 
+	// zstdWindowSize is the zstd window zstd.SpeedBestCompression gives mfer's writer.
+	zstdWindowSize = 8 << 20
+
 	// uuidLength is the length in bytes of a binary UUID.
 	uuidLength = 16
 )

mfer/deserialize.go

@@ -114,7 +114,18 @@ func (m *manifest) verifyOuterIntegrity() error {
 func (m *manifest) decompressInner() ([]byte, error) {
 	bb := bytes.NewBuffer(m.pbOuter.GetInnerMessage())
 
-	zr, err := zstd.NewReader(bb)
+	// By default the decoder decodes a payload under 128 KiB in full,
+	// each frame up to the decoder's limit, before the LimitReader below
+	// reads any of it. Decoding synchronously and never in full makes it
+	// decode only what the LimitReader asks for. It also sets aside a new
+	// buffer for each frame that asks for a larger window than the frames
+	// before it, even a frame holding no data. Refusing windows above
+	// zstdWindowSize keeps each buffer to a little over zstdWindowSize, and
+	// the buffers of frames holding no data to about 16 times it in total.
+	zr, err := zstd.NewReader(bb,
+		zstd.WithDecoderConcurrency(1),
+		zstd.WithDecodeBuffersBelow(0),
+		zstd.WithDecoderMaxWindow(zstdWindowSize))
 	if err != nil {
 		return nil, fmt.Errorf("deserialize: zstd reader: %w", err)
 	}

mfer/deserialize_fuzz_test.go

@@ -0,0 +1,83 @@
+//nolint:testpackage // white-box tests exercise unexported internals
+package mfer
+
+import (
+	"bytes"
+	"runtime"
+	"testing"
+
+	"google.golang.org/protobuf/proto"
+)
+
+// FuzzNewManifestFromReader feeds arbitrary bytes to the manifest parser.
+// `make test` runs it on the seed corpus in
+// testdata/fuzz/FuzzNewManifestFromReader; `make fuzz` searches for new
+// inputs.
+//
+// For every input the parser must return a manifest or an error, not both
+// and not neither, and must not allocate more than a fixed multiple of its
+// input and of the decompressed data it may read, plus room for the
+// decoder's window buffers. A panic or a hang fails the test on its own.
+func FuzzNewManifestFromReader(f *testing.F) {
+	// A signed manifest makes the parser write the key and signature to a
+	// temporary directory and run gpg on them. With gpg off the PATH and
+	// temporary files kept in the test's own directory, no process is
+	// started and nothing is written elsewhere; such input ends in an
+	// error instead.
+	f.Setenv("PATH", "")
+	f.Setenv("TMPDIR", f.TempDir())
+
+	f.Fuzz(func(t *testing.T, data []byte) {
+		var before, after runtime.MemStats
+
+		runtime.ReadMemStats(&before)
+
+		m, err := NewManifestFromReader(bytes.NewReader(data))
+
+		runtime.ReadMemStats(&after)
+
+		if (m == nil) == (err == nil) {
+			t.Fatalf("got manifest %p and error %v, want exactly one", m, err)
+		}
+
+		// The parser reads at most the declared size plus one byte of
+		// decompressed data, and never more than MaxDecompressedSize.
+		decompressed := uint64(MaxDecompressedSize)
+
+		outer := new(MFFileOuter)
+		if validateMagic(data) &&
+			proto.Unmarshal(data[len(MAGIC):], outer) == nil {
+			size := outer.GetSize()
+			if size > 0 && size < MaxDecompressedSize {
+				decompressed = uint64(size) + 1
+			}
+		}
+
+		// It also keeps a few copies of its input. Buffers grow by
+		// copying, so reaching those sizes allocates a few times them in
+		// total: sixteen times the input and the decompressed data leaves
+		// room for that.
+		//
+		// The decoder also sets aside a new buffer of one to two times the
+		// window for each frame that asks for a larger window than the
+		// frames before it, and refuses windows above zstdWindowSize. A
+		// frame that gives its content size instead of a window has that
+		// size as its window, refused above zstdWindowSize like any other.
+		// Frames asking for every window size up to that make it set aside
+		// about 16 times zstdWindowSize in total; 24 times leaves room.
+		//
+		// The seed whose frame claims 8 GiB fails if the decoder sets that
+		// size aside; the seed whose frames ask for ever larger windows
+		// fails if the decoder accepts windows of twice zstdWindowSize; the
+		// seed whose two frames together exceed MaxDecompressedSize fails
+		// if the decoder decodes them in full instead of stopping at the
+		// declared size.
+		limit := 16*(uint64(len(data))+decompressed) + 24*zstdWindowSize
+
+		allocated := after.TotalAlloc - before.TotalAlloc
+		if allocated > limit {
+			t.Fatalf("allocated %d bytes for %d bytes of input, limit %d",
+				allocated, len(data), limit)
+		}
+	})
+}

mfer/gpg_test.go

@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
+	"syscall"
 	"testing"
 	"time"
 
@@ -425,36 +426,51 @@ func TestGPGTimeoutKillsGPG(t *testing.T) {
 	assert.Contains(t, err.Error(), "gpg sign failed: gpg timed out")
 }
 
-// TestGPGTimeoutWhenChildHoldsOutput uses a fake gpg that runs sleep as a
+// TestGPGCancelWhenChildHoldsOutput uses a fake gpg that runs sleep as a
 // child instead of exec-ing it, the way a wrapper script around the real
 // gpg might. Killing the fake gpg leaves sleep holding its stdout and
-// stderr open; the call must still return shortly after the deadline
-// instead of waiting for sleep to exit. The fake gpg writes the process ID
-// of sleep to a file so that the test can kill it before returning.
-func TestGPGTimeoutWhenChildHoldsOutput(t *testing.T) {
-	pidFile := filepath.Join(t.TempDir(), "sleep.pid")
+// stderr open; the call must still return once ctx ends instead of waiting
+// for sleep to exit. The fake gpg writes the process ID of sleep to a named
+// pipe; the test ends ctx only after reading it, so sleep is running by
+// then, and kills sleep before returning.
+func TestGPGCancelWhenChildHoldsOutput(t *testing.T) {
+	pidPipe := filepath.Join(t.TempDir(), "sleep.pid")
+	require.NoError(t, syscall.Mkfifo(pidPipe, 0o600))
+	// sleep outlasts the 10 s wait below, so a call that waits for it fails.
 	t.Setenv("PATH", fakeGPGPath(t,
-		"#!/bin/sh\nsleep 3 &\necho $! >'"+pidFile+"'\nwait\n"))
-	t.Cleanup(func() {
-		pid, err := os.ReadFile(pidFile) //nolint:gosec // G304: path inside t.TempDir()
-		require.NoError(t, err)
+		"#!/bin/sh\nsleep 60 &\necho $! >'"+pidPipe+"'\nwait\n"))
 
-		n, err := strconv.Atoi(strings.TrimSpace(string(pid)))
-		require.NoError(t, err)
-
-		sleep, err := os.FindProcess(n)
-		require.NoError(t, err)
-		require.NoError(t, sleep.Kill())
-	})
-
-	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	start := time.Now()
-	_, err := gpgSign(ctx, []byte("data"), GPGKeyID("any"))
-	require.ErrorIs(t, err, context.DeadlineExceeded)
-	assert.Less(t, time.Since(start), 3*time.Second,
-		"the call waited for the child holding gpg's output to exit")
+	signErr := make(chan error, 1)
+
+	go func() {
+		_, err := gpgSign(ctx, []byte("data"), GPGKeyID("any"))
+		signErr <- err
+	}()
+
+	pid, err := os.ReadFile(pidPipe) //nolint:gosec // G304: path inside t.TempDir()
+	require.NoError(t, err)
+
+	n, err := strconv.Atoi(strings.TrimSpace(string(pid)))
+	require.NoError(t, err)
+
+	sleep, err := os.FindProcess(n)
+	require.NoError(t, err)
+	t.Cleanup(func() { require.NoError(t, sleep.Kill()) })
+
+	cancel()
+
+	// The call should return about gpgWaitDelay (one second) after the
+	// cancel. 10 s is far above that and well under the 30 s test timeout,
+	// which would abort the whole package before the cleanup kills sleep.
+	select {
+	case err := <-signErr:
+		require.ErrorIs(t, err, context.Canceled)
+	case <-time.After(10 * time.Second):
+		t.Fatal("the call waited for the child holding gpg's output to exit")
+	}
 }
 
 // TestBuildPassesContextToSigning checks that a caller can cancel the gpg

mfer/scanner_test.go

@@ -304,46 +304,19 @@ func TestScannerEnumerateFS(t *testing.T) {
 func TestSendEnumerateStatusNonBlocking(t *testing.T) {
 	t.Parallel()
 
-	// Channel with no buffer - send should not block
+	// Nobody receives, so a blocking send would hang the test into its timeout.
 	ch := make(chan EnumerateStatus)
 
-	// This should not block
-	done := make(chan bool)
-
-	go func() {
-		sendEnumerateStatus(ch, EnumerateStatus{FilesFound: 1})
-
-		done <- true
-	}()
-
-	select {
-	case <-done:
-		// Success - did not block
-	case <-time.After(100 * time.Millisecond):
-		t.Fatal("sendEnumerateStatus blocked on full channel")
-	}
+	sendEnumerateStatus(ch, EnumerateStatus{FilesFound: 1})
 }
 
 func TestSendScanStatusNonBlocking(t *testing.T) {
 	t.Parallel()
 
-	// Channel with no buffer - send should not block
+	// Nobody receives, so a blocking send would hang the test into its timeout.
 	ch := make(chan ScanStatus)
 
-	done := make(chan bool)
-
-	go func() {
-		sendScanStatus(ch, ScanStatus{ScannedFiles: 1})
-
-		done <- true
-	}()
-
-	select {
-	case <-done:
-		// Success - did not block
-	case <-time.After(100 * time.Millisecond):
-		t.Fatal("sendScanStatus blocked on full channel")
-	}
+	sendScanStatus(ch, ScanStatus{ScannedFiles: 1})
 }
 
 func TestSendStatusNilChannel(t *testing.T) {

mfer/testdata/fuzz/FuzzNewManifestFromReader/empty

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("")

mfer/testdata/fuzz/FuzzNewManifestFromReader/magic-then-garbage

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("ZNAVSRFGy[i\x04\xe5O\x82A\x1d\xf4\xb0\xe2z7:U\xee\xa3\xf9\xd6m\xacZ\x9b\xce\x1d\xd9/{@\x1d\xa5y[i\x04\xe5O\x82A\x1d\xf4\xb0\xe2z7:U\xee\xa3\xf9\xd6m\xacZ\x9b\xce\x1d\xd9/{@\x1d\xa5")

mfer/testdata/fuzz/FuzzNewManifestFromReader/minimal

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("ZNAVSRFG\xa8\x06\x01\xb0\x06\x01\xb8\x06V\xc2\x06 \xa3\xf7\x97\xa7\xf3\x87:\x90)\\ӊj\xb9\xf7\xfaTJ\x1b\xe7:\xee\xbe\"V\xe0:\x8d(Z\xd6%\xca\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3\xba\fc(\xb5/\xfd\x04\x00\xb1\x02\x00\xa0\x06\x01\xaa\x06=\n\x05a.txt\x10\x01\x1a$\n\"\x12 ʗ\x81\x12\xca\x1b\xbd\xca\xfa\xc21\xb3\x9a#\xdcM\xa7\x86\xef\xf8\x14|Nr\xb9\x80w\x85\xaf\xeeH\xbb\xf2\x12\v\b\x80\x92\xb8Ø\xfe\xff\xff\xff\x01\xb2\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3s\xeeG\x80")

mfer/testdata/fuzz/FuzzNewManifestFromReader/signed

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("ZNAVSRFG\xa8\x06\x01\xb0\x06\x01\xb8\x06V\xc2\x06 \xa3\xf7\x97\xa7\xf3\x87:\x90)\\ӊj\xb9\xf7\xfaTJ\x1b\xe7:\xee\xbe\"V\xe0:\x8d(Z\xd6%\xca\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3\xba\fc(\xb5/\xfd\x04\x00\xb1\x02\x00\xa0\x06\x01\xaa\x06=\n\x05a.txt\x10\x01\x1a$\n\"\x12 ʗ\x81\x12\xca\x1b\xbd\xca\xfa\xc21\xb3\x9a#\xdcM\xa7\x86\xef\xf8\x14|Nr\xb9\x80w\x85\xaf\xeeH\xbb\xf2\x12\v\b\x80\x92\xb8Ø\xfe\xff\xff\xff\x01\xb2\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3s\xeeG\x80\xca\f\xe8\x03-----BEGIN PGP SIGNATURE-----\n\niQEzBAABCgAdFiEET1Yr+4Y/3GtRtO6IhypRF2zvI64FAmrBIXAACgkQhypRF2zv\nI67BQAf/QrpX2MjY15YGMGkjR5oIhnx/YV96aGYZyZThzb+l/R/N75iVFVkhX21d\nZhQqdCsORrodTPAXic2g2UGVXP9PhNMh7n6Wm3LsvQYjrRQGrQnqtCkut+3tUt8K\n7pt4OAnnwRSieaVImA1COmzxIrQQKNOs6UkgmAstGuPV0XZoeDiSG8TUYJ/vieCn\np5hC0FFXtzfw4NtkxSmkewE0xBxIwFCA/RfSHCGH3m5K+tRz41vMEgGbL1iEp6+V\nuBaoEc4hqCgEt+Af2pA8VHfqeu2vKiwggOpYpaILXZKVqH9+tWHL1EBv9t0vTsYE\n9D57euuR9+kOdngYNPieP1yn5dOSHg==\n=kvgL\n-----END PGP SIGNATURE-----\n\xd2\f(4F562BFB863FDC6B51B4EE88872A51176CEF23AE\xda\f\xb5\a-----BEGIN PGP PUBLIC KEY BLOCK-----\n\nmQENBGrBIW8BCADESetN5EdxIe7Fafgxl99Yoo5cOexf7wJyYT0wfUYlRaxt3neR\nhir7LOfH4PZWWoDx7qghxCS4+vs7yGypl6JOm7jnJlhn4HneDa2zeIlgGW2TamyE\nua9KPWBQqkFOYmKPmzp+KnL6ncnBLR5mDkNKFyON812KVvteu6Dp/DNk4Meufe44\nWWr49LSFZa9gEbmRCoQGKby9F0H0yIi4FAc74VdQudy0+fMKcfkKjEvByMzlbBEK\n92Hq3sRFzWd3kvPliNjZTmlh5n5m9aBhMpoy3GkKy8gpDdFc6NLA9iAJe7oNMriR\nkVoa5EjQL1xCXAiAWTYA9NScFfU/574sCTxZABEBAAG0Hk1GRVIgVGVzdCBLZXkg\nPHRlc3RAbWZlci50ZXN0PokBTwQTAQoAORYhBE9WK/uGP9xrUbTuiIcqURds7yOu\nBQJqwSFvAxsvBAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRCHKlEXbO8jrjml\nCAC8wUK9wmvxq0+NZUpFyP+P29klLZYzBDaBrLPJFs0GjnG4kvfUAktWx0Ro80F7\ncjTJ4f44XjDj4glvSjbe2VaDnZl9FTfzUfG+xjD4462NgntQ4fHk/uG4F6d1ikWx\nkEoMpIn1PlSMas1jTQSGlxUr+zFwWuUbGq4n6hRxEnwLlwJlwQt/Aw1vPDYuPDE3\nOYDhJIAJyP+6e9W8ToaAG9byg/22KA1u1qxnNQqsx5Tped2VltAzdYub+yeCuNc8\nIUo5ILo/fQq3GM5sUEaHjPolv88WlDm3vcdbSbDoh5m2inDtg5zuUKJwu32UGu8l\nKoTjp4nxgQGy5WmeBzs4Hdm/\n=TCB8\n-----END PGP PUBLIC KEY BLOCK-----\n")

mfer/testdata/fuzz/FuzzNewManifestFromReader/size-above-payload

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("ZNAVSRFG\xa8\x06\x01\xb0\x06\x01\xb8\x06!\xc2\x06 \x91\x90*\xa5>\fݐ \x87\xbeaL\xc1\x05?\x0eR\xc18\xa4eՕ\xa95\xb9KʺoZ\xca\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3\xba\f-(\xb5/\xfd\x04\x00\x01\x01\x00\xa0\x06\x01\xaa\x06\a\n\x05a.txt\xb2\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3a[k'")

mfer/testdata/fuzz/FuzzNewManifestFromReader/size-below-payload

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("ZNAVSRFG\xa8\x06\x01\xb0\x06\x01\xb8\x06\x1f\xc2\x06 \x91\x90*\xa5>\fݐ \x87\xbeaL\xc1\x05?\x0eR\xc18\xa4eՕ\xa95\xb9KʺoZ\xca\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3\xba\f-(\xb5/\xfd\x04\x00\x01\x01\x00\xa0\x06\x01\xaa\x06\a\n\x05a.txt\xb2\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3a[k'")

mfer/testdata/fuzz/FuzzNewManifestFromReader/truncated-at-172

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("ZNAVSRFG\xa8\x06\x01\xb0\x06\x01\xb8\x06V\xc2\x06 \xa3\xf7\x97\xa7\xf3\x87:\x90)\\ӊj\xb9\xf7\xfaTJ\x1b\xe7:\xee\xbe\"V\xe0:\x8d(Z\xd6%\xca\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3\xba\fc(\xb5/\xfd\x04\x00\xb1\x02\x00\xa0\x06\x01\xaa\x06=\n\x05a.txt\x10\x01\x1a$\n\"\x12 ʗ\x81\x12\xca\x1b\xbd\xca\xfa\xc21\xb3\x9a#\xdcM\xa7\x86\xef\xf8\x14|Nr\xb9\x80w\x85\xaf\xeeH\xbb\xf2\x12\v\b\x80\x92\xb8Ø\xfe\xff\xff\xff\x01\xb2\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3s\xeeG")

mfer/testdata/fuzz/FuzzNewManifestFromReader/truncated-at-20

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("ZNAVSRFG\xa8\x06\x01\xb0\x06\x01\xb8\x06V\xc2\x06 ")

mfer/testdata/fuzz/FuzzNewManifestFromReader/truncated-at-4

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("ZNAV")

mfer/testdata/fuzz/FuzzNewManifestFromReader/truncated-at-8

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("ZNAVSRFG")

mfer/testdata/fuzz/FuzzNewManifestFromReader/truncated-at-86

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("ZNAVSRFG\xa8\x06\x01\xb0\x06\x01\xb8\x06V\xc2\x06 \xa3\xf7\x97\xa7\xf3\x87:\x90)\\ӊj\xb9\xf7\xfaTJ\x1b\xe7:\xee\xbe\"V\xe0:\x8d(Z\xd6%\xca\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3\xba\fc(\xb5/\xfd\x04\x00\xb1\x02\x00\xa0\x06\x01")

mfer/testdata/fuzz/FuzzNewManifestFromReader/wrong-magic

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("ZNAVSRFX\xa8\x06\x01\xb0\x06\x01\xb8\x06V\xc2\x06 \xa3\xf7\x97\xa7\xf3\x87:\x90)\\ӊj\xb9\xf7\xfaTJ\x1b\xe7:\xee\xbe\"V\xe0:\x8d(Z\xd6%\xca\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3\xba\fc(\xb5/\xfd\x04\x00\xb1\x02\x00\xa0\x06\x01\xaa\x06=\n\x05a.txt\x10\x01\x1a$\n\"\x12 ʗ\x81\x12\xca\x1b\xbd\xca\xfa\xc21\xb3\x9a#\xdcM\xa7\x86\xef\xf8\x14|Nr\xb9\x80w\x85\xaf\xeeH\xbb\xf2\x12\v\b\x80\x92\xb8Ø\xfe\xff\xff\xff\x01\xb2\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3s\xeeG\x80")

mfer/testdata/fuzz/FuzzNewManifestFromReader/zstd-frame-claims-8gib

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("ZNAVSRFG\xa8\x06\x01\xb0\x06\x01\xb8\x06\x01\xc2\x06 \xd6aQ\xa4\x85\xc0+\xbb\xca\x11\x11\a<\x019\x97\xb3\xbb3\xd0 \xd5U\xfa!\xaeAf<N@\x9d\xca\x06\x10\x93\x85\vpu\x85\xe4\x04\xe4\x95\x1a=\xdc\x1f\x05\xa3\xba\f\x12(\xb5/\xfd\xc0\x00\x00\x00\x00\x00\x02\x00\x00\x00\v\x00\x00\x00")

mfer/testdata/fuzz/FuzzNewManifestFromReader/zstd-frames-growing-windows

@@ -0,0 +1,2 @@
+go test fuzz v1
+[]byte("ZNAVSRFG\xa8\x06\x01\xb0\x06\x01\xb8\x06\x01\xc2\x06 \xc8g?\xa0\xc9\xc5]\xb57M\xe5O#\x04\xb2\x12\xc6)@=\xd2\xf3f/͉~\x10\x15\xfbkD\xca\x06\x10o\x1c*N;]L~\x9a\x8b\x1d.?@Qb\xba\f\x89\t(\xb5/\xfd\x00\x00\x01\x00\x00(\xb5/\xfd\x00\x01\x01\x00\x00(\xb5/\xfd\x00\x02\x01\x00\x00(\xb5/\xfd\x00\x03\x01\x00\x00(\xb5/\xfd\x00\x04\x01\x00\x00(\xb5/\xfd\x00\x05\x01\x00\x00(\xb5/\xfd\x00\x06\x01\x00\x00(\xb5/\xfd\x00\a\x01\x00\x00(\xb5/\xfd\x00\b\x01\x00\x00(\xb5/\xfd\x00\t\x01\x00\x00(\xb5/\xfd\x00\n\x01\x00\x00(\xb5/\xfd\x00\v\x01\x00\x00(\xb5/\xfd\x00\f\x01\x00\x00(\xb5/\xfd\x00\r\x01\x00\x00(\xb5/\xfd\x00\x0e\x01\x00\x00(\xb5/\xfd\x00\x0f\x01\x00\x00(\xb5/\xfd\x00\x10\x01\x00\x00(\xb5/\xfd\x00\x11\x01\x00\x00(\xb5/\xfd\x00\x12\x01\x00\x00(\xb5/\xfd\x00\x13\x01\x00\x00(\xb5/\xfd\x00\x14\x01\x00\x00(\xb5/\xfd\x00\x15\x01\x00\x00(\xb5/\xfd\x00\x16\x01\x00\x00(\xb5/\xfd\x00\x17\x01\x00\x00(\xb5/\xfd\x00\x18\x01\x00\x00(\xb5/\xfd\x00\x19\x01\x00\x00(\xb5/\xfd\x00\x1a\x01\x00\x00(\xb5/\xfd\x00\x1b\x01\x00\x00(\xb5/\xfd\x00\x1c\x01\x00\x00(\xb5/\xfd\x00\x1d\x01\x00\x00(\xb5/\xfd\x00\x1e\x01\x00\x00(\xb5/\xfd\x00\x1f\x01\x00\x00(\xb5/\xfd\x00 \x01\x00\x00(\xb5/\xfd\x00!\x01\x00\x00(\xb5/\xfd\x00\"\x01\x00\x00(\xb5/\xfd\x00#\x01\x00\x00(\xb5/\xfd\x00$\x01\x00\x00(\xb5/\xfd\x00%\x01\x00\x00(\xb5/\xfd\x00&\x01\x00\x00(\xb5/\xfd\x00'\x01\x00\x00(\xb5/\xfd\x00(\x01\x00\x00(\xb5/\xfd\x00)\x01\x00\x00(\xb5/\xfd\x00*\x01\x00\x00(\xb5/\xfd\x00+\x01\x00\x00(\xb5/\xfd\x00,\x01\x00\x00(\xb5/\xfd\x00-\x01\x00\x00(\xb5/\xfd\x00.\x01\x00\x00(\xb5/\xfd\x00/\x01\x00\x00(\xb5/\xfd\x000\x01\x00\x00(\xb5/\xfd\x001\x01\x00\x00(\xb5/\xfd\x002\x01\x00\x00(\xb5/\xfd\x003\x01\x00\x00(\xb5/\xfd\x004\x01\x00\x00(\xb5/\xfd\x005\x01\x00\x00(\xb5/\xfd\x006\x01\x00\x00(\xb5/\xfd\x007\x01\x00\x00(\xb5/\xfd\x008\x01\x00\x00(\xb5/\xfd\x009\x01\x00\x00(\xb5/\xfd\x00:\x01\x00\x00(\xb5/\xfd\x00;\x01\x00\x00(\xb5/\xfd\x00<\x01\x00\x00(\xb5/\xfd\x00=\x01\x00\x00(\xb5/\xfd\x00>\x01\x00\x00(\xb5/\xfd\x00?\x01\x00\x00(\xb5/\xfd\x00@\x01\x00\x00(\xb5/\xfd\x00A\x01\x00\x00(\xb5/\xfd\x00B\x01\x00\x00(\xb5/\xfd\x00C\x01\x00\x00(\xb5/\xfd\x00D\x01\x00\x00(\xb5/\xfd\x00E\x01\x00\x00(\xb5/\xfd\x00F\x01\x00\x00(\xb5/\xfd\x00G\x01\x00\x00(\xb5/\xfd\x00H\x01\x00\x00(\xb5/\xfd\x00I\x01\x00\x00(\xb5/\xfd\x00J\x01\x00\x00(\xb5/\xfd\x00K\x01\x00\x00(\xb5/\xfd\x00L\x01\x00\x00(\xb5/\xfd\x00M\x01\x00\x00(\xb5/\xfd\x00N\x01\x00\x00(\xb5/\xfd\x00O\x01\x00\x00(\xb5/\xfd\x00P\x01\x00\x00(\xb5/\xfd\x00Q\x01\x00\x00(\xb5/\xfd\x00R\x01\x00\x00(\xb5/\xfd\x00S\x01\x00\x00(\xb5/\xfd\x00T\x01\x00\x00(\xb5/\xfd\x00U\x01\x00\x00(\xb5/\xfd\x00V\x01\x00\x00(\xb5/\xfd\x00W\x01\x00\x00(\xb5/\xfd\x00X\x01\x00\x00(\xb5/\xfd\x00Y\x01\x00\x00(\xb5/\xfd\x00Z\x01\x00\x00(\xb5/\xfd\x00[\x01\x00\x00(\xb5/\xfd\x00\\\x01\x00\x00(\xb5/\xfd\x00]\x01\x00\x00(\xb5/\xfd\x00^\x01\x00\x00(\xb5/\xfd\x00_\x01\x00\x00(\xb5/\xfd\x00`\x01\x00\x00(\xb5/\xfd\x00a\x01\x00\x00(\xb5/\xfd\x00b\x01\x00\x00(\xb5/\xfd\x00c\x01\x00\x00(\xb5/\xfd\x00d\x01\x00\x00(\xb5/\xfd\x00e\x01\x00\x00(\xb5/\xfd\x00f\x01\x00\x00(\xb5/\xfd\x00g\x01\x00\x00(\xb5/\xfd\x00h\x01\x00\x00(\xb5/\xfd\x00i\x01\x00\x00(\xb5/\xfd\x00j\x01\x00\x00(\xb5/\xfd\x00k\x01\x00\x00(\xb5/\xfd\x00l\x01\x00\x00(\xb5/\xfd\x00m\x01\x00\x00(\xb5/\xfd\x00n\x01\x00\x00(\xb5/\xfd\x00o\x01\x00\x00(\xb5/\xfd\x00p\x01\x00\x00(\xb5/\xfd\x00q\x01\x00\x00(\xb5/\xfd\x00r\x01\x00\x00(\xb5/\xfd\x00s\x01\x00\x00(\xb5/\xfd\x00t\x01\x00\x00(\xb5/\xfd\x00u\x01\x00\x00(\xb5/\xfd\x00v\x01\x00\x00(\xb5/\xfd\x00w\x01\x00\x00(\xb5/\xfd\x00x\x01\x00\x00(\xb5/\xfd\x00y\x01\x00\x00(\xb5/\xfd\x00z\x01\x00\x00(\xb5/\xfd\x00{\x01\x00\x00(\xb5/\xfd\x00|\x01\x00\x00(\xb5/\xfd\x00}\x01\x00\x00(\xb5/\xfd\x00~\x01\x00\x00(\xb5/\xfd\x00\x7f\x01\x00\x00(\xb5/\xfd\x00\x80\x01\x00\x00")

script/bootstrap

@@ -140,12 +140,7 @@ main() {
 
     # ---- Go repos ----
     if missing go; then pkg_install go golang go go; fi
-    # golangci-lint: packaged in nix, brew, and apk. On apt there is no
-    # package: download a specific release archive from GitHub and
-    # verify its hash (verify_sha256), never curl | sh.
-    if missing golangci-lint; then
-        pkg_install golangci-lint golangci-lint golangci-lint golangci-lint
-    fi
+    # No golangci-lint: script/lint runs it in Docker only.
     go mod download
 
     # ---- Python repos ----

script/fmt

@@ -19,7 +19,6 @@ main() {
     cd "$ROOT"
     ensure_pb
     gofumpt -l -w mfer internal cmd
-    golangci-lint run --fix
     # Markdown and JSON, over the same file set script/fmt-check verifies.
     "$SCRIPT_DIR/prettier" --write
 }

script/fuzz

@@ -0,0 +1,17 @@
+#!/bin/sh
+# script/fuzz: fuzz the manifest parser for one minute. Run by hand only:
+# script/test already runs the committed seed corpus as ordinary tests,
+# and CI never fuzzes. An input that fails is written to
+# mfer/testdata/fuzz/FuzzNewManifestFromReader/; once the parser is fixed,
+# commit it there as a regression seed.
+set -eu
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    go test -run '^$' -fuzz '^FuzzNewManifestFromReader$' \
+        -fuzztime 1m -parallel 2 ./mfer
+}
+
+main "$@"

script/lint

@@ -1,17 +1,20 @@
 #!/bin/sh
-# script/lint: run the linter.
+# script/lint: run golangci-lint, in Docker only. Builds the lint stage of
+# the Dockerfile, whose build runs the linter, so a successful build is a
+# clean lint. --no-cache because a cached build runs no linter. The image
+# is removed afterwards, whatever the outcome.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    golangci-lint run
-    if [ -n "$(gofmt -l .)" ]; then
-        echo "gofmt: files need formatting:" >&2
-        gofmt -l . >&2
-        exit 1
-    fi
+    # Tagged per run, so concurrent runs never remove each other's image.
+    image="$("$SCRIPT_DIR/projectname")-lint:$$"
+    # A failed build leaves no image, so there is nothing to remove then.
+    trap 'docker image rm "$image" >/dev/null 2>&1 || true' EXIT INT TERM
+    docker build --no-cache --target lint -t "$image" .
 }
 
 main "$@"