Raise Go to the latest release, update dependencies, use the standard library uuid, add a vulnerability check (closes #102)

Go 1.27.1 in go.mod and in the Dockerfile's test and build images.
Every module go.mod requires is at its current release; protoc-gen-go
follows protobuf to v1.36.12 and mf.pb.go is regenerated. The standard
library uuid package replaces github.com/google/uuid; FromBytes could
only fail on a length validateUUID already checks, so that call and its
unreachable error are gone. make vulncheck runs govulncheck v1.8.0,
installed with go install at its release commit, in a vulncheck stage
of the Dockerfile; script/check does not run it. The newer go directive
switches on lint checks for strings.SplitSeq and t.Chdir, now used. A
new test pins the bytes of a seeded manifest written by an mfer built
before this change.

Model: opus-5-5

.dockerignore

@@ -17,7 +17,17 @@
 # stage that compiles runs `git describe --tags --always` on .git, which
 # does not need .git/config; that file can hold a credential, such as a
 # password in a remote URL or the token the CI checkout step stores there.
-.git/config
+# Each submodule keeps a config with the same exposure in its git directory
+# under .git/modules/, nested again for a submodule's own submodules, or in
+# its own .git directory when it keeps one.
+# KNOWN GAP: a submodule whose name has a `config` segment (`config`,
+# `deploy/config`, `config/lib`) loses its whole git directory, because
+# `**/.git/modules/**/config` also matches that segment's directory
+# under .git/modules/. Go's version stamping then fails the build;
+# nothing leaks. Name such a submodule without that segment:
+# `git submodule add --name`.
+**/.git/config
+**/.git/modules/**/config
 
 # Agent scratch: one full checkout of the repo per in-flight agent.
 # Anchored because it occurs once where agents run at the repo root.
@@ -41,7 +51,9 @@
 **/[iI][dD]_[rR][sS][aA]
 **/[iI][dD]_[dD][sS][aA]
 **/[iI][dD]_[eE][cC][dD][sS][aA]
+**/[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
 **/[iI][dD]_[eE][dD]25519
+**/[iI][dD]_[eE][dD]25519_[sS][kK]
 
 # Dependencies: restored inside the image, never copied in.
 **/node_modules
@@ -61,3 +73,9 @@
 
 # This repo's own host-built binary (make build).
 /bin/mfer
+
+# The tools script/bootstrap installs for script/gofumpt and
+# script/generate.
+/bin/gofumpt
+/bin/protoc
+/bin/protoc-gen-go

.editorconfig

@@ -10,3 +10,6 @@ insert_final_newline = true
 
 [Makefile]
 indent_style = tab
+
+[*.go]
+indent_style = tab

.gitea/workflows/check.yml

@@ -4,6 +4,6 @@ jobs:
     check:
         runs-on: ubuntu-latest
         steps:
-            # actions/checkout v4.2.2, 2026-03-16
+            # actions/checkout v4.2.2, 2026-02-22
             - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
             - run: script/cibuild

.gitignore

@@ -1,28 +1,63 @@
-/bin/mfer
+# OS
-/tmp
-/node_modules/
-
-# Generated manifest files
-/index.mf
-
-# Secrets
-.env
-.env.*
-*.key
-*.pem
-
-# OS files
 .DS_Store
 Thumbs.db
 
-# Editor files
+# Editors
 *.swp
 *.swo
 *~
+*.bak
 .idea/
 .vscode/
+*.sublime-*
 
-# Go build artifacts
+# Agent scratch (worktrees of this repo, created and destroyed by
+# in-flight tooling). Unanchored: .gitignore patterns already match at
+# every depth, so no prefix is wanted here. This is not a .dockerignore
+# entry and must not be given a `**/` prefix on the way into one.
+.claude/
+
+# Node
+node_modules/
+
+# Secrets. Unanchored like every entry above, so each matches at every
+# depth. Matching is case-sensitive on Linux, so names use character
+# ranges rather than a lowercase form that misses `Server.Key`.
+
+# Environment files. `*.env` covers bare `.env` and the `prod.env`
+# convention. Only the templates `example.env` and `sample.env` are
+# re-included below. A repository that commits any other template adds
+# its own negation after these lines, for example `!.env.example`.
+*.[eE][nN][vV]
+.[eE][nN][vV].*
+.[eE][nN][vV][rR][cC]
+!example.env
+!sample.env
+
+# Private keys and the bundles carrying them.
+*.[pP][eE][mM]
+*.[kK][eE][yY]
+*.[pP]12
+*.[pP][fF][xX]
+[iI][dD]_[rR][sS][aA]
+[iI][dD]_[dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]
+[iI][dD]_[eE][cC][dD][sS][aA]_[sS][kK]
+[iI][dD]_[eE][dD]25519
+[iI][dD]_[eE][dD]25519_[sS][kK]
+
+# Go build and test artifacts.
 *.log
 *.out
 *.test
+
+# This repo's own binary (make build), and the tools script/bootstrap
+# installs into bin/.
+/bin/mfer
+/bin/gofumpt
+/bin/protoc/
+/bin/protoc-gen-go
+
+# A manifest generated at the repo root, and local scratch.
+/index.mf
+/tmp

.golangci.yml

@@ -10,14 +10,21 @@ run:
 
 linters:
   default: all
+  enable:
+    # Successor to the deprecated gomodguard. Named explicitly, rather than
+    # left to `default: all`, because it carries the module policy below.
+    - gomodguard_v2
   disable:
     # Genuinely incompatible with project patterns
     - exhaustruct      # Requires all struct fields
-    - depguard         # Dependency allow/block lists
+    - exhaustruct_v5   # Requires all struct fields (successor to exhaustruct)
     - godot            # Requires comments to end with periods
-    - wsl              # Deprecated, replaced by wsl_v5
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
+    # Deprecated: the warning is attached to the old name, so it is
+    # silenced by disabling that name, not by enabling the successor.
+    - wsl              # Deprecated, replaced by wsl_v5
+    - gomodguard       # Deprecated, replaced by gomodguard_v2
   settings:
     lll:
       line-length: 88
@@ -28,6 +35,64 @@ linters:
       max-complexity: 15
     dupl:
       threshold: 100
+    depguard:
+      # Test-support code must not be compiled into the shipped binary. A
+      # test-support package exists to hand a test privileges the program
+      # itself must never have, so a file that is not a test must not import
+      # one. Test files, and the files inside a package whose directory name
+      # ends in `test`, are where that code belongs, and are exempt.
+      #
+      # The deny list below is the one part of this file a repository is
+      # expected to extend, and the only part it may. depguard matches an
+      # import path against a list of prefixes, so it cannot be told "any path
+      # whose last segment ends in test"; a repository's own test-support
+      # packages have to be named here one at a time, by full import path,
+      # under a module path that differs from repository to repository. Add
+      # them; change nothing else.
+      rules:
+        test-support:
+          list-mode: lax
+          files:
+            - "$all"
+            - "!$test"
+            - "!**/*test/**"
+          deny:
+            - pkg: net/http/httptest
+              desc: >-
+                Test-support code belongs in test files and in packages whose
+                directory name ends in test, not in the shipped binary.
+    # Only decisions already recorded in the Go package defaults are
+    # listed here. Every entry matches the module path exactly.
+    gomodguard_v2:
+      blocked:
+        - module: github.com/rs/zerolog
+          recommendations:
+            - log/slog
+          reason: "Structured logging is stdlib log/slog."
+        # One entry per pre-fork module path, because the later releases
+        # are separate paths. A prefix match would be shorter but would
+        # also reach github.com/go-redis/redismock, the test double for
+        # the successor these entries recommend.
+        - module: github.com/go-redis/redis
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/go-redis/redis/v7
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/go-redis/redis/v8
+          recommendations:
+            - github.com/redis/go-redis/v9
+          reason: "Pre-fork module; use the maintained go-redis v9."
+        - module: github.com/sergi/go-diff
+          recommendations:
+            - github.com/aymanbagabas/go-udiff
+          reason: "No unified diff output; use go-udiff."
+        - module: github.com/hexops/gotextdiff
+          recommendations:
+            - github.com/aymanbagabas/go-udiff
+          reason: "Unmaintained fork; use go-udiff."
 
 issues:
   max-issues-per-linter: 0

.nvmrc

@@ -0,0 +1 @@
+22.17.0

.prettierignore

@@ -1,14 +1,2 @@
-# REPO_POLICIES.md is a verbatim copy of an authoritative upstream
-# document (sneak/prompts). Local tooling must never rewrite it: any
-# reformatting is silent drift from the source of truth.
-REPO_POLICIES.md
-
-# User-owned configuration, copied verbatim from upstream. Not matched by
-# the current prettier file set, but listed so widening that set can never
-# start rewriting it.
-.golangci.yml
-
-# Dependencies and build output
 node_modules/
-vendor/
+yarn.lock
-bin/

Dockerfile

@@ -1,74 +1,74 @@
-# Lint stage — fast feedback on formatting and lint issues
+# Lint phase. The linter is invoked directly rather than through `make
-# golangci/golangci-lint:v2.12.2 (Debian-based), 2026-08-07
+# lint` or `script/lint`, which are themselves a docker build and would
-FROM golangci/golangci-lint:v2.12.2@sha256:5cceeef04e53efe1470638d4b4b4f5ceefd574955ab3941b2d9a68a8c9ad5240 AS lint
+# recurse into a daemon that does not exist in a build step.
-
+# golangci/golangci-lint:v2.14.0, 2026-09-24
+FROM golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f AS lint
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
-
 COPY . .
-
-# Go half of fmt-check only: this image has no node, so no prettier. The
-# markdown half runs in the mdfmt stage below. The image has no gofumpt
-# either; script/gofumpt builds the version it pins with `go run`.
-RUN script/gofumpt --check
-# The linter directly, not `make lint`: script/lint builds this stage, and
-# there is no docker inside this build.
 RUN golangci-lint run --config .golangci.yml ./...
 
-# Markdown/JSON format stage — prettier needs node, which the Go images
+# Test phase. -race needs cgo and so a C compiler, which the Debian Go
-# do not have. node:22.17.0-bookworm-slim (2026-08-09); ships node
+# image ships and the alpine one does not.
-# 22.17.0 and yarn 1.22.22, the versions script/bootstrap pins.
+# golang:1.27.1, 2026-10-06
-FROM node@sha256:b04ce4ae4e95b522112c2e5c52f781471a5cbc3b594527bcddedee9bc48c03a0 AS mdfmt
+FROM golang@sha256:1e93e00a31255c07e9a34c4207f3006e1501730c5323697cee7dfb827fdae44c AS test
-
-WORKDIR /src
-COPY package.json yarn.lock ./
-RUN yarn install --frozen-lockfile
-
-COPY . .
-
-# No make in this image; call the script entrypoint directly.
-RUN script/prettier --check
-
-# Build stage — tests and compilation
-# golang:1.23 (2026-03-14)
-FROM golang@sha256:60deed95d3888cc5e4d9ff8a10c54e5edc008c6ae3fba6187be6fb592e19e8c0 AS builder
-
-# Force BuildKit to run the lint and mdfmt stages by creating stage dependencies
-COPY --from=lint /src/go.sum /dev/null
-COPY --from=mdfmt /src/go.sum /dev/null
-
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
+COPY . .
+RUN go test -timeout 90s -race -cover ./... || \
+    { echo "--- Rerunning with -v for details ---"; \
+      go test -timeout 90s -race -v ./...; exit 1; }
 
+# Vulnerability check, built only by script/vulncheck (make vulncheck).
+# No stage depends on it, so the image build does not run it.
+# golang:1.27.1, 2026-10-06
+FROM golang@sha256:1e93e00a31255c07e9a34c4207f3006e1501730c5323697cee7dfb827fdae44c AS vulncheck
+# govulncheck v1.8.0, 2026-10-06
+RUN go install golang.org/x/vuln/cmd/govulncheck@709015412431dd2b5b28a53c06c70bc02d49074c
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+RUN govulncheck ./...
+
+# Build stage. Nothing is wanted from the lint or test phase; the copies
+# are what make BuildKit build them first, so this stage cannot run
+# unless lint and test passed. The Debian Go image ships git, which the
+# version step below needs.
+# golang:1.27.1, 2026-10-06
+FROM golang@sha256:1e93e00a31255c07e9a34c4207f3006e1501730c5323697cee7dfb827fdae44c AS builder
+COPY --from=lint /src/go.sum /dev/null
+COPY --from=test /src/go.sum /dev/null
+# A tar-stream context keeps the sender's file owners, which git refuses.
+RUN git config --system --add safe.directory /src
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
 COPY . .
 
-RUN make test
+# The revision `mfer version` prints, stamped into main.Gitrev: the
-
+# VERSION build arg when one is given, otherwise `git describe --tags
-# A build context sent as a tar archive, as upaas sends it, keeps its files'
+# --always` on the .git in the build context. With .git present, a
-# owners, and git refuses to read a checkout owned by another user.
+# version that is still empty, dev or unknown fails the build: git is
-RUN git config --system --add safe.directory /src
+# missing or could not read the checkout.
-
-# The revision `mfer version` prints, stamped into main.Gitrev: the VERSION
-# build argument when one is given (script/docker passes one), otherwise
-# `git describe --tags --always` of the .git the build context carries: the
-# tag on a tagged commit, tag-N-gHASH on a commit after one, the short commit
-# when no tag is reachable. git ships in this base image. A context that
-# carries .git and still yields no version fails the build.
 ARG VERSION
-RUN version="${VERSION:-$(git describe --tags --always)}"; \
+RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
-    if [ -e .git ] && { [ -z "$version" ] || [ "$version" = dev ] || \
+    if [ -e .git ]; then \
-        [ "$version" = unknown ]; }; then \
+        case "$VERSION" in ""|dev|unknown) \
-        echo "no version could be derived although the build context carries .git" >&2; \
+            echo "version is '$VERSION' although .git is present" >&2; \
-        exit 1; \
+            exit 1 ;; \
+        esac; \
     fi; \
-    cd cmd/mfer && \
+    CGO_ENABLED=0 go build -trimpath \
-    CGO_ENABLED=0 go build -tags urfave_cli_no_docs -ldflags "-X main.Gitrev=$version" -o /mfer .
+        -ldflags="-s -w -X main.Gitrev=${VERSION}" \
+        -o /mfer ./cmd/mfer/
 
 # Fail unless /mfer is statically linked: scratch has no C library to run it.
 RUN ldd /mfer 2>&1 | grep -q 'not a dynamic executable'
 
+# Runtime stage, and the last one.
 FROM scratch
 # scratch has no CA certificates; fetch needs them to verify HTTPS servers.
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/

Makefile

@@ -1,4 +1,4 @@
-.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks build generate fuzz
+.PHONY: bootstrap setup test lint fmt fmt-check check docker hooks build generate fuzz vulncheck
 
 # Makefile targets are thin shims; the implementations live in script/
 # per the scripts-to-rule-them-all pattern (see the Entrypoints section
@@ -39,3 +39,6 @@ generate:
 
 fuzz:
 	@script/fuzz
+
+vulncheck:
+	@script/vulncheck

README.md

@@ -23,7 +23,7 @@ javascript library is planned.
 
 # Getting Started
 
-`mfer` builds from source with a Go 1.23+ toolchain. The generated protobuf code
+`mfer` builds from source with Go 1.27.1 or later. The generated protobuf code
 is committed, so no `protoc` toolchain is required:
 
 ```sh
@@ -55,9 +55,9 @@ for a single command's options.
 
 # Build Status
 
-CI runs `script/cibuild`, which builds the Docker image with `--no-cache`, so
+CI runs `script/cibuild`, which runs `script/bootstrap` and `script/check`, then
-the formatting, lint and test steps in the `Dockerfile` run on every build. The
+builds the Docker image with `--no-cache`, so the lint and test phases in the
-`main` branch must always be green.
+`Dockerfile` run on every build. The `main` branch must always be green.
 
 # Entrypoints
 
@@ -67,52 +67,62 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call them. We
 provide:
 
-- `script/bootstrap` — install all dependencies (Go, Go module download, and
+- `script/bootstrap` — install all dependencies, idempotently: Go and the
-  node/yarn plus the prettier version pinned in `package.json`/`yarn.lock`),
+  modules of `go.mod`; node (the version `.nvmrc` names, through nvm when there
-  idempotently; golangci-lint is not installed, it runs only in Docker
+  is no node on `PATH`) and yarn, plus the prettier version pinned in
+  `package.json`/`yarn.lock`; `gofumpt` v0.12.0 and `protoc-gen-go` v1.36.12,
+  installed into `bin/` with `go install`, each pinned to a commit; and `protoc`
+  33.4, unpacked into `bin/protoc` from its release archive once the archive
+  matches the sha256 the script holds for this platform. Each of those three is
+  installed again whenever the one in `bin/` reports another version.
+  golangci-lint is not installed, it runs only in Docker
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (`mfer`); used by other scripts
   such as `script/docker`
-- `script/test` — run the test suite (`go test`); one test fails when
+- `script/test` — run the test suite in Docker: builds only the `test` stage of
-  `mfer/mf.proto` no longer matches the hash `script/generate` recorded
+  the `Dockerfile`, whose build runs `go test -race`, uncached so it runs every
+  time; one test fails when `mfer/mf.proto` no longer matches the hash
+  `script/generate` recorded
 - `script/build` (`make build`) — build the `mfer` binary into `bin/mfer`,
   stamped with the revision `mfer version` prints: the output of
   `git describe --tags --always --dirty`, as `script/docker` passes it
 - `script/generate` (`make generate`) — regenerate `mfer/mf.pb.go` from
   `mfer/mf.proto` and record the hash of that `mfer/mf.proto` in
   `mfer/mf.proto.sha256`; the only thing that regenerates the committed
-  `mfer/mf.pb.go`. It needs the exact versions that wrote the committed file,
+  `mfer/mf.pb.go`. It runs the `protoc` that `script/bootstrap` unpacks into
-  and refuses to run with any other: `protoc` 33.4 (unpack
+  `bin/protoc` and the `protoc-gen-go` it installs into `bin/`, refusing any
-  `protoc-33.4-<platform>.zip` from
+  version of either but the pinned one
-  [its release](https://github.com/protocolbuffers/protobuf/releases/tag/v33.4)
-  and put its `bin/protoc` on `PATH`) and `protoc-gen-go` v1.36.11
-  (`go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.11`, which
-  installs it in `$(go env GOPATH)/bin`; `script/generate` adds that directory
-  to `PATH`)
 - `script/fuzz` — fuzz the manifest parser for one minute; run by hand
   (`make fuzz`), never by CI, while `script/test` runs its committed seed corpus
   as ordinary tests
 - `script/lint` — run `golangci-lint` in Docker: builds only the `lint` stage of
-  the `Dockerfile` (the Go format check, then the linter), uncached so it runs
+  the `Dockerfile`, whose build runs the linter, uncached so it runs every time
-  every time, then removes the image
+- `script/vulncheck` (`make vulncheck`) — run `govulncheck` in Docker: builds
+  only the `vulncheck` stage of the `Dockerfile`, uncached, which reports known
+  vulnerabilities in the code `mfer` calls, from the Go vulnerability database.
+  `script/check` does not run it, so an advisory published later never turns the
+  gate red
 - `script/fmt` — format all code and docs (writes): `script/gofumpt --write` and
   `script/prettier --write`
 - `script/gofumpt` — run `gofumpt` over every Go file in the repository in the
-  given mode, `--write` or `--check`, at the one version it pins (built on
+  given mode, `--write` or `--check`, with the `bin/gofumpt` that
-  demand by `go run`, so nothing installs it); `script/fmt`, `script/fmt-check`
+  `script/bootstrap` installs, refusing any version but the pinned one;
-  and the Docker lint stage all go through it, so they cannot disagree about Go
+  `script/fmt` and `script/fmt-check` both go through it, so they cannot
-  formatting
+  disagree about Go formatting
 - `script/prettier` — run prettier over the repository's canonical file set
   (Markdown and JSON, minus `.prettierignore`) in the given mode, `--write` or
-  `--check`; the single definition of that file set, so `script/fmt` and
+  `--check`, with the prettier version `yarn.lock` pins, run by the node on
-  `script/fmt-check` cannot disagree about it
+  `PATH` or else the one `script/bootstrap` installed through nvm; the single
+  definition of that file set, so `script/fmt` and `script/fmt-check` cannot
+  disagree about it
 - `script/fmt-check` — check formatting without writing:
   `script/gofumpt --check` plus `script/prettier --check`
 - `script/check` — run `script/test`, `script/lint`, and `script/fmt-check`
 - `script/docker` — build the Docker image tagged with the project name
-- `script/cibuild` — CI entrypoint: builds the image with the same command as
+- `script/cibuild` — CI entrypoint: runs `script/bootstrap` and `script/check`,
-  `script/docker`, uncached, so the checks in the Dockerfile run every time
+  then builds the image with the same command as `script/docker`, uncached, so
+  the lint and test phases in the `Dockerfile` run every time
 - `script/precommit` — pre-commit checks: `go mod tidy` verification, then
   `script/check`
 - `script/install-precommit` — install the git pre-commit hook that runs
@@ -256,9 +266,12 @@ are now tracked only in the [issues](https://git.eeqj.de/sneak/mfer/issues).
 
 - `mfer gen` / `mfer gen .`
     - recurses under current directory and writes out an `index.mf`
+    - records every file's mode as `0000` unless given `--include-permissions`,
+      which records each file's permission bits (`0777` at most)
 - `mfer check` / `mfer check .`
     - verifies checksums of all files in manifest, displaying error and exiting
-      nonzero if any files are missing or corrupted
+      nonzero if any files are missing or corrupted, or have permission bits
+      other than the mode the manifest records, unless that is `0000`
     - warns about each file under the base directory that the manifest does not
       list, hidden files included; with `--no-extra-files` each one is a failure
       instead
@@ -266,11 +279,18 @@ are now tracked only in the [issues](https://git.eeqj.de/sneak/mfer/issues).
     - fetches `/stuff/index.mf` and downloads all files listed in manifest into
       the current directory, or the one given with `--dest`, and assures
       cryptographic integrity of downloaded files. A file already there with the
-      size and hash the manifest lists is skipped. Once every file is in place,
+      size, hash and recorded mode the manifest lists is skipped. Once every
-      the manifest is saved there as `index.mf`, so `mfer check` can verify the
+      file is in place, the manifest is saved there as `index.mf`, so
-      tree later. A manifest that lists `index.mf` (in any letter case) or
+      `mfer check` can verify the tree later. Each file is downloaded to a temp
-      `.index.mf.tmp` at the top of the tree is refused before any file is
+      file beside it, such as `.a.txt.tmp` for `a.txt`, given the mode the
-      downloaded, since saving the manifest would replace it.
+      manifest records unless that is `0000`, then moved into place. A manifest
+      is refused before any file is downloaded if it records a mode above
+      `0777`, or lists a file where fetch writes another: at another listed file
+      or a directory one is in, at the temp file of a listed file, or at
+      `index.mf` or `.index.mf.tmp` at the top of the tree. Names are compared
+      in any letter case, on every filesystem, since on a case-insensitive one
+      `A.txt` and `a.txt` are one file; a directory two listed files are in must
+      be spelled alike in both.
 - `mfer fetch --require-signature <fingerprint> https://example.com/stuff/`
     - as above, but first refuses a manifest not signed by the key with that
       fingerprint, as `mfer check --require-signature` does, before downloading

REPO_POLICIES.md

@@ -1,6 +1,6 @@
 ---
 title: Repository Policies
-last_modified: 2026-07-06
+last_modified: 2026-10-04
 ---
 
 This document covers repository structure, tooling, and workflow standards. Code
@@ -60,17 +60,28 @@ style conventions are in separate documents:
   prerequisite since nvm requires bash. yarn is then pinned via
   `corepack prepare yarn@<version> --activate`. Never install "latest" or "lts";
   always exact versions. `script/cibuild` runs the CI build: it changes to the
-  repo root and runs `docker build .`; the Gitea workflow calls it. Four further
+  repo root, runs `script/bootstrap`, runs `script/check`, and builds the image
-  scripts are our own extensions to the standard: `script/check` runs
+  with the version; the Gitea workflow calls it. **`script/cibuild` runs
-  `script/test`, `script/lint`, and `script/fmt-check`; `script/precommit` is
+  `script/bootstrap` first**, because the workflow checks out the repo and runs
-  what the git pre-commit hook runs, and it calls `script/check`;
+  nothing else, while `script/fmt-check` runs the formatter on the host: on a
-  `script/install-precommit` installs the git pre-commit hook (the `make hooks`
+  pristine checkout with nothing installed the run dies there, after the
-  target shims to it); and `script/projectname` (literally that filename) simply
+  containerised gates have passed. **The bootstrap alone is not enough**:
-  outputs the project's name. Scripts that need the name call
+  `script/bootstrap` installs node and yarn under nvm and leaves neither on the
-  `script/projectname` — e.g. `script/docker` assembles its image tag from it —
+  `PATH` of the shell that called it, so a bare `yarn` still exits 127. The host
-  so those scripts stay byte-identical across all repos. Repo-type-specific
+  entrypoints that need yarn — `script/fmt` and `script/fmt-check` — therefore
-  pre-commit extras (e.g. `go mod tidy` verification in Go repos) belong in
+  source nvm for the pinned node version before invoking it, exactly as
-  `script/precommit`, not in the hook itself. Model scripts are at
+  `script/bootstrap`'s own install step does. A runner carrying nothing but
+  docker and git then gets through `script/check`. Four further scripts are our
+  own extensions to the standard: `script/check` runs `script/test`,
+  `script/lint` and `script/fmt-check`; `script/precommit` is what the git
+  pre-commit hook runs, and it calls `script/check`; `script/install-precommit`
+  installs the git pre-commit hook (the `make hooks` target shims to it); and
+  `script/projectname` (literally that filename) simply outputs the project's
+  name. Scripts that need the name call `script/projectname` — e.g.
+  `script/docker` assembles its image tag from it — so those scripts stay
+  byte-identical across all repos. Repo-type-specific pre-commit extras (e.g.
+  `go mod tidy` verification in Go repos) belong in `script/precommit`, not in
+  the hook itself. Model scripts are at
   `https://git.eeqj.de/sneak/prompts/raw/branch/main/script/<name>`. The README
   must document the provided scripts in an **Entrypoints** section (see the
   README requirements below).
@@ -89,87 +100,198 @@ style conventions are in separate documents:
   contributor should be able to understand the entire development workflow by
   reading the Makefile.
 
-- Every repo should have a `Dockerfile`. All Dockerfiles must run `make check`
+- Every repo should have a `Dockerfile`, and it carries the repo's gates: a
-  as a build step so the build fails if the branch is not green. For non-server
+  `lint` phase and a `test` phase, with the final stage depending on both so the
-  repos, the Dockerfile should bring up a development environment and run
+  image cannot be built unless they pass. For non-server repos the final stage
-  `make check`. For server repos, `make check` should run as an early build
+  brings up a development environment; for server repos it is the runtime image.
-  stage before the final image is assembled. Dockerfiles install development
+  The gate phases and the build stage start from their pinned base images and
-  prerequisites by running `script/bootstrap` rather than duplicating installs
+  install what those images lack either inline, as the canonical Go `Dockerfile`
-  inline; COPY `script/` and the dependency manifests (`package.json` +
+  below does for `git`, or by running `script/bootstrap`, as the `prompts`
-  `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it so the bootstrap
+  repo's own `Dockerfile` does for its yarn packages. The development
-  layer stays cached until dependencies change.
+  environment stage installs development prerequisites by running
+  `script/bootstrap` rather than duplicating its installs inline. A stage that
+  runs `script/bootstrap` COPYs `script/` and the dependency manifests
+  (`package.json` + `yarn.lock`, `go.mod` + `go.sum`, etc.) before running it.
 
-- **Dockerfiles must use a separate lint stage for fail-fast feedback.** Go
+- **Linting and testing run in Docker, as phases of the `Dockerfile`.** There is
-  repos use a multistage build where linting runs in an independent stage based
+  no separate lint file. `script/lint` and `script/test` each build one phase
-  on the `golangci/golangci-lint` image (pinned by hash). This stage runs
+  and nothing else:
-  `make fmt-check` and `make lint` before the full build begins. The build stage
-  then declares an explicit dependency on the lint stage via
-  `COPY --from=lint /src/go.sum /dev/null`, which forces BuildKit to complete
-  linting before proceeding to compilation and tests. This ensures lint failures
-  surface in seconds rather than minutes, without blocking on dependency
-  download or compilation in the build stage.
 
-    The standard pattern for a Go repo Dockerfile is:
+    ```sh
+    docker build --no-cache --target lint -t "$(script/projectname)-lint" .
+    docker build --no-cache --target test -t "$(script/projectname)-test" .
+    ```
+
+    **A stage that is not the last one in the file is built only when the final
+    stage's chain depends on it, or when `--target` names it.** That is why the
+    two gates are always invoked by name here, and why the final stage carries a
+    `COPY --from=` of a harmless file from each of them: without that edge a
+    plain `docker build .` builds the last stage alone and exits 0 having linted
+    and tested nothing.
+
+    **Every `docker build` in `script/` is tagged**, here and in
+    `script/cibuild` and `script/docker`. An untagged build leaves a dangling
+    image behind on every invocation, on every developer host and every CI
+    runner; a tagged one replaces the previous image.
+
+    Inside a phase the tool is invoked directly — `golangci-lint`, `go test`,
+    `eslint`, `prettier` — never through `make lint` or `script/test`, which are
+    themselves a `docker build` and would recurse into a daemon that does not
+    exist in a build step. Formatting is the exception and stays on the host:
+    `script/fmt` writes the working tree, and `script/fmt-check` is its
+    read-only twin.
+
+    **No lint verdict may come from a host invocation of the linter.** On a
+    shared host golangci-lint reads a result cache keyed on file content rather
+    than location, so a second checkout of the same content is served the first
+    one's findings, and a host-global lock in `$TMPDIR` makes concurrent runs
+    exit non-zero with `parallel golangci-lint is running` — a status a caller
+    cannot tell from real findings. Both have produced wrong verdicts in this
+    org, in both directions. A container has its own cache, its own `TMPDIR` and
+    a digest-pinned binary, so neither is reachable.
+
+- **Any build that runs checks is built with `--no-cache`.** Docker invalidates
+  a `COPY` layer only when the copied content changes, so on an unchanged tree
+  the check `RUN` is served from cache, nothing executes, and the build still
+  exits 0. Every `docker build` in `script/` therefore passes `--no-cache`:
+  `script/lint`, `script/test`, `script/cibuild` and `script/docker` are the
+  four, and there is no fifth — `script/check` runs the two gate phases and
+  `script/fmt-check`, and builds no image of its own. A bare `docker build .` is
+  not evidence that anything ran: a sub-second build reporting success is a
+  cache hit, not a result. Never invalidate by pruning — `docker builder prune`
+  and friends destroy a build cache shared with every other build on the host.
+  When a check is added or changed, prove it works by planting a defect it must
+  catch and watching the run fail on it, then revert the defect. A green run
+  alone shows neither that the check ran nor that it covers what it should.
+
+- **The gate phases are separate stages, and the build stage depends on both.**
+  The lint phase is based on the `golangci/golangci-lint` image (pinned by
+  hash), so lint failures surface in seconds rather than after a full compile,
+  and the test phase is based on the Debian Go image. The canonical Go repo
+  `Dockerfile`:
 
     ```dockerfile
-    # Lint stage — fast feedback on formatting and lint issues
+    # Lint phase
     # golangci/golangci-lint:v2.x.x, YYYY-MM-DD
     FROM golangci/golangci-lint@sha256:... AS lint
     WORKDIR /src
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    RUN make fmt-check
+    RUN golangci-lint run --config .golangci.yml ./...
-    RUN make lint
 
-    # Build stage
+    # Test phase. -race needs cgo and so a C compiler, which the Debian Go
-    # golang:1.x-alpine, YYYY-MM-DD
+    # image ships and the alpine one does not.
-    FROM golang@sha256:... AS builder
+    # golang:1.x, YYYY-MM-DD
+    FROM golang@sha256:... AS test
     WORKDIR /src
-
-    # Force BuildKit to run the lint stage before proceeding
-    COPY --from=lint /src/go.sum /dev/null
-
     COPY go.mod go.sum ./
     RUN go mod download
     COPY . .
-    RUN make test
+    RUN go test -timeout 90s -race -cover ./... || \
+        { echo "--- Rerunning with -v for details ---"; \
+          go test -timeout 90s -race -v ./...; exit 1; }
 
-    ARG VERSION=dev
+    # Build stage. Nothing is wanted from either phase above; the copies
-    RUN CGO_ENABLED=0 go build -trimpath \
+    # are what make BuildKit build them first, so this stage cannot run
-        -ldflags="-s -w -X main.Version=${VERSION}" \
+    # unless lint and test passed.
-        -o /app ./cmd/app/
+    # golang:1.x-alpine, YYYY-MM-DD
+    FROM golang@sha256:... AS builder
+    COPY --from=lint /src/go.sum /dev/null
+    COPY --from=test /src/go.sum /dev/null
+    RUN apk add --no-cache git
+    # A tar-stream context keeps the sender's file owners, which git refuses.
+    RUN git config --system --add safe.directory /src
+    WORKDIR /src
+    COPY go.mod go.sum ./
+    RUN go mod download
+    COPY . .
 
-    # Runtime stage
+    # The VERSION build arg when one is given, otherwise
+    # `git describe --tags --always` on the .git in the build context. With
+    # .git present, a version that is still empty, dev or unknown fails the
+    # build: git is missing or could not read the checkout.
+    ARG VERSION
+    RUN VERSION="${VERSION:-$(git describe --tags --always)}"; \
+        if [ -e .git ]; then \
+            case "$VERSION" in ""|dev|unknown) \
+                echo "version is '$VERSION' although .git is present" >&2; \
+                exit 1 ;; \
+            esac; \
+        fi; \
+        CGO_ENABLED=0 go build -trimpath \
+            -ldflags="-s -w -X main.Version=${VERSION}" \
+            -o /app ./cmd/app/
+
+    # Runtime stage, and the last one
     FROM alpine@sha256:...
     COPY --from=builder /app /usr/local/bin/app
     ENTRYPOINT ["app"]
     ```
 
     Key points:
-    - The lint stage uses the `golangci/golangci-lint` image directly (it
+    - The lint phase uses the `golangci/golangci-lint` image directly (it has
-      includes both Go and the linter), so there is no need to install the
+      both Go and the linter), so nothing needs installing.
-      linter separately.
+    - `COPY --from=<phase> /src/go.sum /dev/null` is a no-op copy whose only
-    - `COPY --from=lint /src/go.sum /dev/null` is a no-op file copy that creates
+      purpose is the ordering edge. BuildKit runs stages in parallel by default,
-      a stage dependency. BuildKit runs stages in parallel by default; without
+      and a stage nothing depends on is not built at all, so without these two
-      this line, the build stage would not wait for lint to finish and a lint
+      lines a red gate would not fail the build.
-      failure might not fail the overall build.
+    - Keep the runtime stage last, and if you add a stage after it, give it the
+      same two copies. A plain `docker build .` builds the last stage's chain
+      and nothing else.
     - If the project uses `//go:embed` directives that reference build artifacts
-      (e.g. a web frontend compiled in a separate stage), the lint stage must
+      (e.g. a web frontend compiled in a separate stage), the lint phase must
       create placeholder files so the embed directives resolve. Example:
       `RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css`.
-      The lint stage should not depend on the actual build output — it exists to
+    - If the project requires CGO or system libraries for linting, install them
-      fail fast.
+      in the lint phase. The `golangci/golangci-lint` image is Debian-based and
-    - If the project requires CGO or system libraries for linting (e.g.
+      has no `apk`, so install with `apt-get` under the Debian package name
-      `vips-dev`), install them in the lint stage with `apk add`.
+      (`libvips-dev`, where alpine says `vips-dev`), and delete the package
-    - The build stage runs `make test` after compilation setup. Tests run in the
+      lists in the same `RUN`, so the layer does not keep them:
-      build stage, not the lint stage, because they may require compiled
+
-      artifacts or heavier dependencies.
+        ```dockerfile
+        RUN apt-get update \
+            && apt-get install -y --no-install-recommends libvips-dev \
+            && rm -rf /var/lib/apt/lists/*
+        ```
+
+    - `.dockerignore` lets `.git` into the build context. It keeps out every git
+      `config` at any depth (`**/.git/config`, `**/.git/modules/**/config`): the
+      repository's own, each submodule's under `.git/modules/`, and that of a
+      submodule keeping its own `.git` directory. `git describe` does not need
+      them, and each can hold a credential: a password in a remote URL, or the
+      token the CI checkout step stores there. A submodule whose name has a
+      `config` segment (`config`, `deploy/config`, `config/lib`) loses its whole
+      git directory to `**/.git/modules/**/config`, and Go's version stamping
+      then fails the build: give it a name without that segment
+      (`git submodule add --name`). The stage that compiles has `git` (the
+      Debian Go image has it; an alpine one needs `apk add --no-cache git`) and
+      takes the version from the `VERSION` build argument when one is given,
+      otherwise from `git describe --tags --always`. That gives the tag on a
+      tagged commit; on a later commit, the tag, the number of commits since it
+      and the short commit (`v1.2.3-4-gabc1234`); and the short commit when no
+      tag is reachable. The stage that compiles also marks its working directory
+      safe for git (`git config --system --add safe.directory /src`): a context
+      sent as a tar stream keeps the sender's file owners, and git refuses a
+      checkout owned by another user, so the version would come out empty.
+      `ARG VERSION` has no default, and the build fails if the context carries
+      `.git` and the version still comes out empty, `dev` or `unknown`. A plain
+      `docker build .` with no build arguments must succeed; a Dockerfile that
+      refuses an empty build argument drops that refusal and keeps the argument.
 
 - Every repo should have a Gitea Actions workflow (`.gitea/workflows/`) that
-  runs `script/cibuild` (which runs `docker build .`) on push. Since the
+  runs `script/cibuild` on push, and checks out the repo as its only other step.
-  Dockerfile already runs `make check`, a successful build implies all checks
+  That script bootstraps, runs the gate phases, and then builds the image, so a
-  pass.
+  successful run means every check passed; a bare `docker build .` does not
+  carry the same guarantee, because its gate phases may come from the cache. The
+  image build is uncached and so runs the gate phases a second time. That is the
+  price of the rule above, and it is worth paying: the image that ships is built
+  from a run of its own gates rather than from a cache entry. A separate
+  workflow limited to `main` by a `branches` list under `on: push` cannot be
+  checked by review: to try a change to it, add the feature branch to that list
+  and push, then remove the branch from the list again before merging. Keep any
+  job in it that publishes behind `if: github.ref_name == 'main'`, so the run
+  from the feature branch publishes nothing.
 
 - Use platform-standard formatters: `black` for Python, `prettier` for
   JS/CSS/Markdown/HTML, `go fmt` for Go. Always use default configuration with
@@ -189,14 +311,21 @@ style conventions are in separate documents:
   module under test to verify it compiles/parses. There is no excuse for
   `make test` to be a no-op.
 
-- `make test` must complete in under 20 seconds. Add a 30-second timeout in the
+- `make test` must complete in under 60 seconds. That is the hard cap, and a
-  Makefile.
+  suite that exceeds it fails. Under 20 seconds is the target. A suite between
+  20 and 60 seconds is still green, but the overage must be filed as an
+  improvement bug against that repo. Add a 90-second timeout to the test
+  invocation (`go test -timeout 90s`). The backstop deliberately sits above the
+  hard cap so that it catches a genuinely hung test rather than a merely slow
+  one.
 
-- **`make test` should use the conditional verbose rerun pattern.** Run tests
+- **The test command should use the conditional verbose rerun pattern.** Run
-  without `-v` (verbose) first. If tests fail, automatically rerun with `-v` to
+  tests without `-v` (verbose) first. If tests fail, automatically rerun with
-  show full output. This keeps CI logs and `docker build` output clean on
+  `-v` to show full output. This keeps CI logs and `docker build` output clean
-  success (just package/suite summaries) while providing full diagnostic detail
+  on success (just package/suite summaries) while providing full diagnostic
-  on failure (every test case, every assertion). The general shell pattern:
+  detail on failure (every test case, every assertion). The command lives in the
+  `test` phase of the `Dockerfile`, since `script/test` builds that phase; the
+  Makefile form below is the same pattern for any repo-local invocation:
 
     ```makefile
     test:
@@ -209,11 +338,26 @@ style conventions are in separate documents:
 
     ```makefile
     test:
-    	@go test -timeout 30s -race -cover ./... || \
+    	@go test -count=1 -timeout 90s -race -cover ./... || \
     		{ echo "--- Rerunning with -v for details ---"; \
-    		  go test -timeout 30s -race -v ./...; exit 1; }
+    		  go test -count=1 -timeout 90s -race -v ./...; exit 1; }
     ```
 
+    `-count=1` is required on both invocations: it defeats Go's test _result_
+    cache, so neither run can report a stored pass in place of running the
+    tests. It leaves the build cache alone, so it costs the runtime of the suite
+    and no recompilation.
+
+    That cache is Go's own, separate from Docker's layer cache. Go stores a
+    passing result in its cache directory (`GOCACHE`), and when the same tests
+    run again on unchanged code it prints that result, marked `(cached)`,
+    without running them. That matters on a developer's machine, where this
+    target runs and the directory lasts from one run to the next. The `test`
+    phase of the `Dockerfile` needs no `-count=1`: its base image holds no
+    result for this repo's tests and nothing before its `go test` step runs a
+    test, so there is nothing to replay. `--no-cache` (above) is what makes that
+    step run on an unchanged tree.
+
     Python example:
 
     ```makefile
@@ -239,10 +383,84 @@ style conventions are in separate documents:
   must be in `.gitignore`. No exceptions.
 
 - `.gitignore` should be comprehensive from the start: OS files (`.DS_Store`),
-  editor files (`.swp`, `*~`), language build artifacts, and `node_modules/`.
+  editor files (`.swp`, `*~`), in-repo agent scratch directories (`.claude/`),
-  Fetch the standard `.gitignore` from
+  language build artifacts, and `node_modules/`. Fetch the standard `.gitignore`
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when setting up
+  from `https://git.eeqj.de/sneak/prompts/raw/branch/main/.gitignore` when
-  a new repo.
+  setting up a new repo. These patterns are written to `.gitignore`'s own
+  semantics, in which an unanchored pattern already matches at every depth; they
+  are not a `.dockerignore` and must not be transplanted into one unmodified.
+
+- **`.dockerignore` does not use `.gitignore` semantics, and copying patterns
+  across unmodified leaves secrets in the build context.** Docker matches with
+  `moby/patternmatcher`: `filepath.Match` semantics plus a `**` extension, so
+  `*` does not cross `/` and a pattern without a leading `**/` is anchored at
+  the build-context root. A `.dockerignore` listing `.env`, `*.pem` and `*.key`
+  therefore excludes only the copies at the repository root, while `config/.env`
+  and `certs/server.key` still reach the context and can land in an image layer
+  — which is more dangerous than a short file with no secret patterns at all,
+  because it reads as solved and stops anyone looking. Give every
+  depth-independent pattern the `**/` prefix and leave only genuinely
+  root-anchored entries unprefixed: `.claude`, and the repo's own host-built
+  binary, written `/myapp` and never `**/myapp`, which would also match
+  `cmd/myapp/` and delete the package directory from the context. Matching is
+  case-sensitive, and an ALL-CAPS twin per pattern still misses `Server.Key`, so
+  secret names use character ranges — `**/*.[kK][eE][yY]`, `**/*.[pP][eE][mM]`,
+  and likewise for `.envrc` and the extensionless SSH keys. Where such a pattern
+  also catches something the build needs, re-include it with a negation
+  (`!docs/example.env`); deleting the pattern reopens the exposure for every
+  other file it covers. Fetch the standard `.dockerignore` from
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.dockerignore` and extend
+  it with the repo's own artifacts.
+
+- **In-repo agent scratch belongs in both files, written to each file's own
+  semantics.** `.claude/` holds one worktree per in-flight agent — an entire
+  additional checkout of the repo — so under `COPY . .` the build context
+  inflates by a multiple of the repo and another session's unreviewed work can
+  be copied into an image layer. In `.gitignore` the entry is `.claude/`,
+  unanchored. In `.dockerignore` it is `.claude`, anchored and with **no** `**/`
+  prefix, because the prefixed form would also delete any nested directory of
+  that name from the build. Anchoring carries a known gap that the canonical
+  `.dockerignore` states in its own comment, since consuming repos receive the
+  file and not the tracker: the directory is created in the agent's working
+  directory, so a repo running agents in subdirectories still ships
+  `services/api/.claude/` and must add its own anchored entry there.
+
+- **A plain `docker build .` of a clone stamps the version that
+  `git describe --tags --always` gives**, derived from the `.git` in the build
+  context as the canonical `Dockerfile` above shows. Without its failure check,
+  a missing `git` or an unreadable checkout would leave `-X main.Version=` empty
+  and the build would still exit 0. `script/docker` and `script/cibuild` pass
+  the version they compute on the host; it takes precedence. They do this
+  byte-identically across repos:
+
+    ```sh
+    # Own line: a failing command substitution inside an argument does not
+    # trip `set -e`, so the inline form degrades to an empty constant.
+    version="$(git describe --tags --always --dirty 2>/dev/null || true)"
+    [ -n "$version" ] || version="unknown"
+    docker build --no-cache \
+        --build-arg VERSION="$version" \
+        -t "$(script/projectname)" .
+    ```
+
+    `--always` makes an untagged repo yield an abbreviated commit hash rather
+    than failing, and the `[ -n "$version" ]` line is the single place the
+    fallback is applied — a live check that fires on a build from an export with
+    no `.git` and on a repository with no commits yet. Do not fold it into the
+    substitution as `|| echo unknown`, which makes the guard unreachable. The
+    Dockerfile's side is `ARG VERSION` in the stage that compiles, declared
+    there because `ARG` is stage-scoped; passing `VERSION` to a repo whose
+    Dockerfile declares no such `ARG` is ignored and costs nothing, which is why
+    the scripts stay byte-identical. One consequence for CI: the standard
+    checkout action clones shallow and fetches no tags, so a repo that embeds a
+    tag-derived version must set `fetch-depth: 0` on its checkout step.
+
+- **Verify `.dockerignore` by enumerating the image, not by reading the
+  patterns.** Plant files at the root _and_ at least two directories deep, build
+  a probe image that does `COPY . .`, and list what actually landed
+  (`docker run --rm --entrypoint find IMAGE /app`). The `transferring context`
+  size is not a substitute: a nested secret is a few bytes, and BuildKit
+  transfers only the delta from the previous build.
 
 - **No build artifacts in version control.** Code-derived data (compiled
   bundles, minified output, generated assets) must never be committed to the
@@ -258,9 +476,56 @@ style conventions are in separate documents:
 - Make all changes on a feature branch. You can do whatever you want on a
   feature branch.
 
-- `.golangci.yml` is standardized and must _NEVER_ be modified by an agent, only
+- `.golangci.yml` is standardized. The vendored copy in a consuming repo must
-  manually by the user. Fetch from
+  _NEVER_ be modified by an agent: fetch it from
-  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml`.
+  `https://git.eeqj.de/sneak/prompts/raw/branch/main/.golangci.yml` and keep it
+  byte-identical, so that no repo can quietly loosen its own linting. Linter
+  configuration changes are made to the canonical copy in the `prompts` repo and
+  reach consuming repos by re-vendoring; an agent may open a PR against
+  canonical, which only the user merges. One list is exempt from byte-identity,
+  because it cannot be written once for every repo: the `deny` list of the
+  `test-support` depguard rule, where a repo names its own test-support packages
+  by full import path. A repo adds entries there and changes nothing else, and a
+  re-vendor carries its entries forward. The canonical golangci-lint version is
+  v2.14.0 (released 2026-09-24), pinned as the digest of the lint phase's base
+  image
+  (`golangci/golangci-lint@sha256:ad862ba6b3798cbe0fd9fd7408d498fd74fbd2623a92406b2fd3898faf0bf98f`,
+  which reports `2.14.0 built with go1.27.0 from 114493f9`). A module's `go`
+  directive must not name a newer Go minor version than the one golangci-lint
+  was built with, or golangci-lint refuses to lint it: this release lints
+  `go 1.27.1` but not `go 1.28`. That digest is the only pin, since no repo
+  installs golangci-lint on the host. A repo sets the lint phase digest to the
+  one named here and re-vendors `.golangci.yml` in the same commit, whichever of
+  the two prompted the change: the canonical copy can name linters that an older
+  golangci-lint rejects, and a newer golangci-lint can add linters that
+  `default: all` switches on until the canonical copy disables them.
+
+- **`script/bootstrap` installs a pinned tool by comparing versions, never by
+  testing presence.** An `if ! command -v <tool>; then install; fi` guard tests
+  `PATH` only, so on an already-provisioned machine the pin is inert and a
+  version bump is a silent no-op — while the Dockerfile, installing into a clean
+  image, gets the pinned version, so a local `make check` and `make docker` can
+  disagree about what the tool even is. The canonical form:
+    - compares the installed version against the pin over the **whole** version
+      token; a parser that stops at the first `-` reports `2.12.2` for a host
+      running `2.12.2-rc1` and skips the install;
+    - treats absent, non-zero, empty or unrecognised `--version` output as a
+      mismatch, so the failure direction is a redundant install and never a
+      skipped one;
+    - after installing, re-resolves the binary the way callers do — `hash -r`,
+      then through `PATH`, not through the directory the installer wrote to —
+      and fails naming the resolved path, since an install that a shadowing
+      binary hides succeeds while changing nothing any caller sees;
+    - is actually called, and prints the version on both success paths: a
+      function defined and never invoked has the same exit status and the same
+      empty output as one that worked.
+
+    Keep it POSIX sh: no arrays, no `[[`, no `grep -P`.
+
+    A Go tool a repo needs on the host is installed with `go install` pinned to
+    a commit hash (`go install <package>@<commit hash>`). It is never tracked as
+    a `go.mod` tool dependency or through a `tools.go` file, either of which
+    pulls the tool's own dependencies into the repo's `go.mod` and `go.sum`.
 
 - When pinning images or packages by hash, add a comment above the reference
   with the version and date (YYYY-MM-DD).
@@ -374,12 +639,14 @@ style conventions are in separate documents:
   settings.
 
 - Avoid putting files in the repo root unless necessary. Root should contain
-  only project-level config files (`README.md`, `Makefile`, `Dockerfile`,
+  only project-level config files (`README.md`, `AGENTS.md`, `Makefile`,
-  `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`, and
+  `Dockerfile`, `LICENSE`, `.gitignore`, `.editorconfig`, `REPO_POLICIES.md`,
-  language-specific config). Everything else goes in a subdirectory. Canonical
+  and language-specific config). Everything else goes in a subdirectory.
-  subdirectory names:
+  Canonical subdirectory names:
     - `bin/` — executable scripts and tools
-    - `cmd/` — Go command entrypoints
+    - `cmd/` — Go command entrypoints; thin only: one `main.go` per binary whose
+      body is a single call into `internal/` or `pkg/`, no project logic in
+      `cmd/`
     - `configs/` — configuration templates and examples
     - `deploy/` — deployment manifests (k8s, compose, terraform)
     - `docs/` — documentation and markdown (README.md stays in root)
@@ -406,3 +673,7 @@ style conventions are in separate documents:
     - Go: `go.mod`, `go.sum`, `.golangci.yml`
     - JS: `package.json`, `yarn.lock`, `.prettierrc`, `.prettierignore`
     - Python: `pyproject.toml`
+
+- Guidance for coding agents lives in one `AGENTS.md` at the repository root. It
+  is never committed under a file or directory named after one agent tool, such
+  as `CLAUDE.md` or `.claude/`, and never split into separate memory files.

docs/FORMAT.md

@@ -6,8 +6,11 @@ Version 1.0
 
 An `.mf` file is a binary manifest that describes a directory tree of files,
 including their paths, sizes, and cryptographic checksums. It supports optional
-GPG signatures for integrity verification and optional timestamps for metadata
+GPG signatures for integrity verification and optional timestamps and file
-preservation.
+permissions for metadata preservation.
+
+Nothing goes in the 1.0 manifest that 1.0 does not read or write: no field is
+reserved or kept for later use.
 
 ## File Structure
 
@@ -50,7 +53,7 @@ enforce a decompression size limit to prevent decompression bombs. The reference
 implementation limits decompressed size to 256 MB. It writes zstd frames with a
 window of at most 8 MiB, the largest window the zstd format recommends decoders
 support, and refuses frames that ask for a larger one. It also refuses an inner
-message whose file entries, hashes, timestamps and MIME types, counted at 160,
+message whose file entries, hashes, timestamps and MIME types, counted at 176,
 112, 64 and 16 bytes each, add up to more than 8 times its size.
 
 ## Inner Message (`MFFile`)
@@ -77,9 +80,21 @@ Each file entry contains:
 | `mimeType` | 301    | string (optional)         | MIME type                           |
 | `mtime`    | 302    | Timestamp (optional)      | Modification time                   |
 | `ctime`    | 303    | Timestamp (optional)      | Change time (inode metadata change) |
+| `mode`     | 304    | uint32                    | Permission bits (see File Mode)     |
 
-Field 304 (`atime`) has been removed from the specification. Access time is
+## File Mode
-volatile and non-deterministic; it is not useful for integrity verification.
+
+`mode` holds a file's Unix permission bits, the nine `rwx` bits, so it is never
+above `0777` (octal); the setuid, setgid and sticky bits are never recorded.
+Writers record `0000` unless whoever creates the manifest asks for permissions.
+`0000`, the proto3 default, means no mode was recorded: readers never check or
+apply it.
+
+The reference implementation records modes when `gen` or `freshen` is given
+`--include-permissions`. `check` fails a file whose permission bits differ from
+a recorded mode other than `0000`. `fetch` sets a recorded mode other than
+`0000` on each file it writes, and refuses a manifest that records a mode above
+`0777` before it requests any file.
 
 ## Path Rules
 
@@ -130,7 +145,7 @@ By default, manifests are generated deterministically:
 
 - File entries are sorted by `path` in **lexicographic byte order**
 - `createdAt` is omitted unless explicitly requested
-- `atime` is never included (field removed from schema)
+- `mode` is `0000` unless explicitly requested
 
 This ensures that two independent runs over the same directory tree produce
 byte-identical `.mf` files (assuming file contents and metadata have not

go.mod

@@ -1,35 +1,28 @@
 module sneak.berlin/go/mfer
 
-go 1.23
+go 1.27.1
 
 require (
 	github.com/davecgh/go-spew v1.1.1
-	github.com/dustin/go-humanize v1.0.1
+	github.com/dustin/go-humanize v1.1.0
-	github.com/google/uuid v1.1.2
+	github.com/klauspost/compress v1.20.1
-	github.com/klauspost/compress v1.18.2
 	github.com/multiformats/go-multihash v0.2.3
-	github.com/spf13/afero v1.8.0
+	github.com/spf13/afero v1.15.0
-	github.com/stretchr/testify v1.8.1
+	github.com/stretchr/testify v1.12.1
-	github.com/urfave/cli/v2 v2.27.7
+	github.com/urfave/cli/v3 v3.14.0
-	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211
+	golang.org/x/term v0.46.0
-	google.golang.org/protobuf v1.28.1
+	google.golang.org/protobuf v1.36.12
 )
 
 require (
-	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
+	github.com/klauspost/cpuid/v2 v2.4.0 // indirect
-	github.com/klauspost/cpuid/v2 v2.0.9 // indirect
+	github.com/minio/sha256-simd v1.0.1 // indirect
-	github.com/kr/pretty v0.2.0 // indirect
+	github.com/mr-tron/base58 v1.3.0 // indirect
-	github.com/minio/sha256-simd v1.0.0 // indirect
+	github.com/multiformats/go-varint v0.1.0 // indirect
-	github.com/mr-tron/base58 v1.2.0 // indirect
-	github.com/multiformats/go-varint v0.0.6 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
-	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
-	golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e // indirect
+	golang.org/x/crypto v0.57.0 // indirect
-	golang.org/x/sys v0.1.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
-	golang.org/x/text v0.3.6 // indirect
+	golang.org/x/text v0.42.0 // indirect
-	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+	lukechampine.com/blake3 v1.4.1 // indirect
-	gopkg.in/yaml.v3 v3.0.1 // indirect
-	lukechampine.com/blake3 v1.1.6 // indirect
 )

go.sum

@@ -1,491 +1,40 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
-cloud.google.com/go v0.44.1/go.mod h1:iSa0KzasP4Uvy3f1mN/7PiObzGgflwredwwASm/v6AU=
-cloud.google.com/go v0.44.2/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.44.3/go.mod h1:60680Gw3Yr4ikxnPRS/oxxkBccT6SA1yMk63TGekxKY=
-cloud.google.com/go v0.45.1/go.mod h1:RpBamKRgapWJb87xiFSdk4g1CME7QZg3uwTez+TSTjc=
-cloud.google.com/go v0.46.3/go.mod h1:a6bKKbmY7er1mI7TEI4lsAkts/mkhTSZK8w33B4RAg0=
-cloud.google.com/go v0.50.0/go.mod h1:r9sluTvynVuxRIOHXQEHMFffphuXHOMZMycpNR5e6To=
-cloud.google.com/go v0.52.0/go.mod h1:pXajvRH/6o3+F9jDHZWQ5PbGhn+o8w9qiu/CffaVdO4=
-cloud.google.com/go v0.53.0/go.mod h1:fp/UouUEsRkN6ryDKNW/Upv/JBKnv6WDthjR6+vze6M=
-cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bPc=
-cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
-cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
-cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
-cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
-cloud.google.com/go v0.75.0/go.mod h1:VGuuCn7PG0dwsd5XPVm2Mm3wlh3EL55/79EKB6hlPTY=
-cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
-cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
-cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
-cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
-cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
-cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
-cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
-cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
-cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
-cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
-cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
-cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
-cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
-cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
-cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
-dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
-github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
-github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
-github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.1.0 h1:dbKTrvD0klcbBV/h4AWJdMuZogJACoMlvWIWZ5b2xWg=
-github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
+github.com/dustin/go-humanize v1.1.0/go.mod h1:hc1CvRkJMsgxqjmjMQF3QNRAZBwY8AXBAzKYoSX9sFI=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/klauspost/compress v1.20.1 h1:T7kKElXUMXrUJ2E9QhQhxFtcK5rPyLdsGZvdbLMPdiQ=
-github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
+github.com/klauspost/compress v1.20.1/go.mod h1:LUdAzn7YLVvxLpc7y3V1m40wESHTgc1422pwwBSKYuI=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/klauspost/cpuid/v2 v2.4.0 h1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/klauspost/cpuid/v2 v2.4.0/go.mod h1:19jmZ9mjzoF//ddRSUsv0zfBTJWh3QJh9FNxZTMrGxU=
-github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
+github.com/minio/sha256-simd v1.0.1 h1:6kaan5IFmwTNynnKKpDHe6FWHohJOHhCPchzK49dzMM=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/minio/sha256-simd v1.0.1/go.mod h1:Pz6AKMiUdngCLpeTL/RJY1M9rUuPMYujV5xJjtbRSN8=
-github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/mr-tron/base58 v1.3.0 h1:K6Y13R2h+dku0wOqKtecgRnBUBPrZzLZy5aIj8lCcJI=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/mr-tron/base58 v1.3.0/go.mod h1:2BuubE67DCSWwVfx37JWNG8emOC0sHEU4/HpcYgCLX8=
-github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
-github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
-github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.4/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
-github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
-github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
-github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
-github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/pprof v0.0.0-20201218002935-b9804c9f04c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/uuid v1.1.2 h1:EVhdT+1Kseyi1/pUmXKaFxYsDNy9RQYkMWRH68J/W7Y=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
-github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/google-cloud-go-testing v0.0.0-20200911160855-bcd43fbb19e8/go.mod h1:dvDLG8qkwmyD9a/MJJN3XJcT3xFxOKAvTZGvuZmac9g=
-github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
-github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
-github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uqnapk=
-github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
-github.com/klauspost/cpuid/v2 v2.0.4/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.0.9 h1:lgaqFMSdTdQYdZ04uHyN2d/eKdOMyi2YLSvlQIBFYa4=
-github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0 h1:s5hAObm+yFO5uHYt5dYjxi2rXrsnmRpJx4OYvIWUaQs=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/minio/sha256-simd v1.0.0 h1:v1ta+49hkWZyvaKwrQB8elexRqm6Y0aMLjCNsrYxo6g=
-github.com/minio/sha256-simd v1.0.0/go.mod h1:OuYzVNI5vcoYIAmbIvHPl3N3jUzVedXbKy5RFepssQM=
-github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
-github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
 github.com/multiformats/go-multihash v0.2.3 h1:7Lyc8XfX/IY2jWb/gI7JP+o7JEq9hOa7BFvVU9RSh+U=
 github.com/multiformats/go-multihash v0.2.3/go.mod h1:dXgKXCXjBzdscBLk9JkjINiEsCKRVch90MdaGiKsvSM=
-github.com/multiformats/go-varint v0.0.6 h1:gk85QWKxh3TazbLxED/NlDVv8+q+ReFJk7Y2W/KhfNY=
+github.com/multiformats/go-varint v0.1.0 h1:i2wqFp4sdl3IcIxfAonHQV9qU5OsZ4Ts9IOoETFs5dI=
-github.com/multiformats/go-varint v0.0.6/go.mod h1:3Ls8CIEsrijN6+B7PbrXRPxHRPuXSrVKRY101jdMZYE=
+github.com/multiformats/go-varint v0.1.0/go.mod h1:5KVAVXegtfmNQQm/lCY+ATvDzvJJhSkUlGQV9wgObdI=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/sftp v1.13.1/go.mod h1:3HaPG6Dq1ILlpPZRO0HVMrsydcdLt6HRDccSgb87qRg=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
-github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/spaolacci/murmur3 v1.1.0 h1:7c1g84S4BPRrfL5Xrdp6fOJ206sU9y293DDHaoy0bLI=
 github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/afero v1.8.0 h1:5MmtuhAgYeU6qpa7w7bP0dv6MBYuup0vekhSpSkoq60=
+github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I=
-github.com/spf13/afero v1.8.0/go.mod h1:CtAatgMJh6bJEIs48Ay/FOnkljP3WeGUG0MC1RfAqwo=
+github.com/spf13/afero v1.15.0/go.mod h1:NC2ByUVxtQs4b3sIUphxK0NioZnmxgyCrfzeuq8lxMg=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/urfave/cli/v3 v3.14.0 h1:a8414NQlHJs0c/iBsulKLzlES0n/lEAskbL2LKpU4/s=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/urfave/cli/v3 v3.14.0/go.mod h1:vXn6HxPNccJSzQr2QvwVncOKrgYGIHU0HY5h8B2nQj4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
-github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
-github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
-github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
-github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
+golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
-github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
-github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
-github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
-github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+lukechampine.com/blake3 v1.4.1 h1:I3Smz7gso8w4/TunLKec6K2fn+kyKtDxr/xcQEN84Wg=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+lukechampine.com/blake3 v1.4.1/go.mod h1:QFosUxmjB8mnrWFSNwKmvxHpfY72bmD2tQ0kBMM3kwo=
-go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
-go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
-go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
-golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e h1:T8NU3HyQ8ClP4SEE+KbFlg6n0NhuTsN4MyznaarGsZM=
-golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
-golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
-golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
-golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
-golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
-golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
-golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190409202823-959b441ac422/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
-golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
-golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200222125558-5a598a2470a0/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200301022130-244492dfa37a/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210225134936-a50acf3fe073/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.1.0 h1:kunALQeHf1/185U1i0GOB/fy1IPRDDpuoOOqRReG57U=
-golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 h1:JGgROgKl9N8DuW20oFS5gxc+lE67/N3FcwmBPMe7ArY=
-golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6 h1:aRYxNxv6iGQlyVaZmk6ZgYEDa+Jg18DxebPSrd6bg1M=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191130070609-6e064ea0cf2d/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191216173652-a0e659d51361/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20191227053925-7b8e75db28f4/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200117161641-43d50277825c/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200122220014-bf1340f18c4a/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200204074204-1cc6d1ef6c74/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200207183749-b753a1ba74fa/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200212150539-ea181f53ac56/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200224181240-023911ca70b2/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200227222343-706bc42d1f0d/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
-golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
-golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
-golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210108195828-e2f9c7f1fc8e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
-google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
-google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.9.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
-google.golang.org/api v0.13.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.14.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.15.0/go.mod h1:iLdEw5Ide6rF15KTC1Kkl0iskquN2gFfn9o9XIsbkAI=
-google.golang.org/api v0.17.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.18.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.19.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.20.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.22.0/go.mod h1:BwFmGc8tA3vsd7r/7kR8DY7iEEGSU04BFxCo5jP/sfE=
-google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
-google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
-google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
-google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
-google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
-google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
-google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
-google.golang.org/genproto v0.0.0-20191108220845-16a3f7862a1a/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
-google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
-google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200224152610-e50cd9704f63/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
-google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210108203827-ffc7fda8c3d7/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20210226172003-ab064af71705/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
-google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.27.1/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKal+60=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
-google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.28.1 h1:d0NfwRgPtno5B1Wa6L2DAG+KivqkdutMf1UhdNx175w=
-google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
-gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
-honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-lukechampine.com/blake3 v1.1.6 h1:H3cROdztr7RCfoaTpGZFQsrqvweFLrqS73j7L7cmR5c=
-lukechampine.com/blake3 v1.1.6/go.mod h1:tkKEOtDkNtklkXtLNEOGNq5tcV90tJiA1vAA12R78LA=
-rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
-rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
-rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=

internal/cli/check.go

@@ -16,7 +16,7 @@ import (
 
 	"github.com/dustin/go-humanize"
 	"github.com/spf13/afero"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 	"sneak.berlin/go/mfer/internal/log"
 	"sneak.berlin/go/mfer/mfer"
 )
@@ -96,8 +96,10 @@ func findManifest(fs afero.Fs, dir string) (string, error) {
 
 // fetchManifestToTemp downloads a manifest URL to a temporary file and
 // returns the temp file path. The caller is responsible for removing it.
-func (mfa *CLIApp) fetchManifestToTemp(url string) (string, error) {
+func (mfa *CLIApp) fetchManifestToTemp(
-	rc, fetchErr := mfa.openManifestReader(url)
+	ctx context.Context, url string,
+) (string, error) {
+	rc, fetchErr := mfa.openManifestReader(ctx, url)
 	if fetchErr != nil {
 		return "", fetchErr
 	}
@@ -208,13 +210,15 @@ func countCheckFailures(
 // findExtraFiles reports files present on disk but absent from the
 // manifest, and anything the search cannot read: each is a failure under
 // --no-extra-files, otherwise a warning.
-func findExtraFiles(ctx *cli.Context, chk *mfer.Checker, failures *int64) error {
+func findExtraFiles(
+	ctx context.Context, cmd *cli.Command, chk *mfer.Checker, failures *int64,
+) error {
 	extraResults := make(chan mfer.Result, 1)
 	extraDone := make(chan struct{})
 
 	go func() {
 		for result := range extraResults {
-			if ctx.Bool("no-extra-files") {
+			if cmd.Bool("no-extra-files") {
 				*failures++
 
 				log.Infof("%s: %s (%s)", result.Status, result.Path, result.Message)
@@ -226,7 +230,7 @@ func findExtraFiles(ctx *cli.Context, chk *mfer.Checker, failures *int64) error
 		close(extraDone)
 	}()
 
-	err := chk.FindExtraFiles(ctx.Context, extraResults)
+	err := chk.FindExtraFiles(ctx, extraResults)
 	if err != nil {
 		return fmt.Errorf("failed to check for extra files: %w", err)
 	}
@@ -238,7 +242,9 @@ func findExtraFiles(ctx *cli.Context, chk *mfer.Checker, failures *int64) error
 
 // runCheck runs the manifest check with progress and result reporting
 // and returns the number of failures.
-func runCheck(ctx *cli.Context, chk *mfer.Checker, showProgress bool) (int64, error) {
+func runCheck(
+	ctx context.Context, cmd *cli.Command, chk *mfer.Checker, showProgress bool,
+) (int64, error) {
 	// Set up results channel
 	results := make(chan mfer.Result, 1)
 
@@ -264,7 +270,7 @@ func runCheck(ctx *cli.Context, chk *mfer.Checker, showProgress bool) (int64, er
 	go countCheckFailures(results, &failures, done)
 
 	// Run check
-	err := chk.Check(ctx.Context, results, progress)
+	err := chk.Check(ctx, results, progress)
 
 	progressWg.Wait()
 
@@ -275,7 +281,7 @@ func runCheck(ctx *cli.Context, chk *mfer.Checker, showProgress bool) (int64, er
 	// Wait for results processing to complete
 	<-done
 
-	err = findExtraFiles(ctx, chk, &failures)
+	err = findExtraFiles(ctx, cmd, chk, &failures)
 	if err != nil {
 		return 0, err
 	}
@@ -283,17 +289,19 @@ func runCheck(ctx *cli.Context, chk *mfer.Checker, showProgress bool) (int64, er
 	return failures, nil
 }
 
-func (mfa *CLIApp) checkManifestOperation(ctx *cli.Context) error {
+func (mfa *CLIApp) checkManifestOperation(
+	ctx context.Context, cmd *cli.Command,
+) error {
 	log.Debug("checkManifestOperation()")
 
-	manifestPath, err := mfa.resolveManifestArg(ctx)
+	manifestPath, err := mfa.resolveManifestArg(cmd)
 	if err != nil {
 		return fmt.Errorf("check: %w", err)
 	}
 
 	// URL manifests need to be downloaded to a temp file for the checker
 	if isHTTPURL(manifestPath) {
-		tmpPath, tmpErr := mfa.fetchManifestToTemp(manifestPath)
+		tmpPath, tmpErr := mfa.fetchManifestToTemp(ctx, manifestPath)
 		if tmpErr != nil {
 			return fmt.Errorf("check: %w", tmpErr)
 		}
@@ -303,12 +311,13 @@ func (mfa *CLIApp) checkManifestOperation(ctx *cli.Context) error {
 		manifestPath = tmpPath
 	}
 
-	basePath := ctx.String("base")
+	basePath := cmd.String("base")
-	showProgress := ctx.Bool("progress")
+	showProgress := cmd.Bool("progress")
 
 	log.Infof("checking manifest %s with base %s", manifestPath, basePath)
 
 	// Create checker
+	//nolint:contextcheck // mfer loads a manifest without a context
 	chk, err := mfer.NewChecker(&mfer.CheckerOptions{
 		ManifestPath: manifestPath,
 		BasePath:     basePath,
@@ -319,9 +328,9 @@ func (mfa *CLIApp) checkManifestOperation(ctx *cli.Context) error {
 	}
 
 	// Check signature requirement
-	requiredSigner := ctx.String(flagRequireSignature)
+	requiredSigner := cmd.String(flagRequireSignature)
 	if requiredSigner != "" {
-		err = verifyRequiredSigner(ctx.Context, chk, requiredSigner)
+		err = verifyRequiredSigner(ctx, chk, requiredSigner)
 		if err != nil {
 			return err
 		}
@@ -330,7 +339,7 @@ func (mfa *CLIApp) checkManifestOperation(ctx *cli.Context) error {
 	log.Infof("manifest contains %d files, %s", chk.FileCount(),
 		humanize.IBytes(safeUint64(int64(chk.TotalBytes()))))
 
-	failures, err := runCheck(ctx, chk, showProgress)
+	failures, err := runCheck(ctx, cmd, chk, showProgress)
 	if err != nil {
 		return err
 	}

internal/cli/entry_test.go

@@ -3,6 +3,7 @@ package cli
 
 import (
 	"bytes"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
@@ -18,7 +19,7 @@ import (
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	urfcli "github.com/urfave/cli/v2"
+	urfcli "github.com/urfave/cli/v3"
 	"sneak.berlin/go/mfer/internal/log"
 	"sneak.berlin/go/mfer/mfer"
 )
@@ -264,8 +265,9 @@ func commandsTakingVerbose() [][]string {
 }
 
 // TestVerboseCount asserts that one -v or --verbose gives verbose output and
-// two -v give debug output (issue #125). urfave/cli before v2.25.5 counted a
+// two -v, or -v and --verbose, give debug output (issue #125). urfave/cli
-// flag given by its alias twice, so one -v gave debug output.
+// before v2.25.5 counted a flag given by its alias twice, so one -v gave debug
+// output.
 func TestVerboseCount(t *testing.T) {
 	t.Parallel()
 
@@ -276,6 +278,7 @@ func TestVerboseCount(t *testing.T) {
 		{[]string{"-v"}, log.VerboseLevel},
 		{[]string{testFlagVerbose}, log.VerboseLevel},
 		{[]string{"-v", "-v"}, log.DebugLevel},
+		{[]string{"-v", testFlagVerbose}, log.DebugLevel},
 	}
 
 	for _, command := range commandsTakingVerbose() {
@@ -313,28 +316,6 @@ func TestCombinedShortVerboseRefused(t *testing.T) {
 	}
 }
 
-// TestShortAndLongVerboseRefused asserts that -v and --verbose given together
-// are refused (issue #125): urfave/cli v2 refuses a flag given under two of its
-// names, and one flag with an alias keeps help and parsing simple.
-func TestShortAndLongVerboseRefused(t *testing.T) {
-	t.Parallel()
-
-	for _, command := range commandsTakingVerbose() {
-		args := slices.Concat(command, []string{"-v", testFlagVerbose})
-
-		t.Run(strings.Join(args, " "), func(t *testing.T) {
-			t.Parallel()
-
-			opts := testOpts(args, afero.NewMemMapFs())
-			exitCode, level := runCLIWithLevel(opts)
-
-			assert.Equal(t, 1, exitCode)
-			assert.Contains(t, testStderr(t, opts), "Cannot use two forms of the same flag")
-			assert.Equal(t, log.InfoLevel, level)
-		})
-	}
-}
-
 func TestHelpCommand(t *testing.T) {
 	t.Parallel()
 
@@ -373,6 +354,39 @@ func TestGenerateCommand(t *testing.T) {
 	assert.True(t, exists)
 }
 
+// TestGenerateSeededManifestBytes pins the exact bytes `gen --seed` writes
+// for a fixed tree, so that a Go or dependency update that changes what
+// mfer writes fails here. testdata/seeded.mf was written by an mfer built
+// before such an update. The tree has enough files that zstd compresses
+// the manifest instead of storing it as it is.
+func TestGenerateSeededManifestBytes(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewMemMapFs()
+	start := time.Date(2025, 6, 1, 0, 0, 0, 0, time.UTC)
+
+	for i := range 200 {
+		path := fmt.Sprintf("/testdir/d%d/f%03d.txt", i%10, i)
+		mtime := start.Add(time.Duration(i) * time.Second)
+
+		require.NoError(t, fs.MkdirAll(filepath.Dir(path), 0o755))
+		writeTestFile(t, fs, path, fmt.Sprintf("file %d\n", i))
+		require.NoError(t, fs.Chtimes(path, mtime, mtime))
+	}
+
+	opts := testOpts([]string{
+		testApp, cmdGenerate, "-q", "--seed", "mfer", "-o", testOutput, testDir,
+	}, fs)
+	require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
+
+	got, err := afero.ReadFile(fs, testOutput)
+	require.NoError(t, err)
+
+	want, err := os.ReadFile("testdata/seeded.mf")
+	require.NoError(t, err)
+	assert.Equal(t, want, got)
+}
+
 func TestGenerateAndCheckCommand(t *testing.T) {
 	t.Parallel()
 
@@ -394,6 +408,98 @@ func TestGenerateAndCheckCommand(t *testing.T) {
 	assert.Equal(t, 0, exitCode, "check failed: %s", testStderr(t, opts))
 }
 
+// TestGenerateRecordsModeOnlyWhenAsked runs gen with and without
+// --include-permissions: without it every mode is recorded as 0000, with
+// it each file's permission bits. list -l and export show the recorded
+// modes.
+func TestGenerateRecordsModeOnlyWhenAsked(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewMemMapFs()
+	require.NoError(t, fs.MkdirAll(testDir, 0o755))
+	writeTestFile(t, fs, "/testdir/notes.txt", "hello world")
+	writeTestFile(t, fs, "/testdir/run.sh", "#!/bin/sh\n")
+	require.NoError(t, fs.Chmod("/testdir/run.sh", 0o755))
+
+	for _, tc := range []struct {
+		flags []string
+		want  map[string]string // recorded mode by path
+	}{
+		{nil, map[string]string{"notes.txt": "0000", "run.sh": "0000"}},
+		{
+			[]string{"--" + flagIncludePermissions},
+			map[string]string{"notes.txt": "0644", "run.sh": "0755"},
+		},
+	} {
+		opts := testOpts(slices.Concat(
+			[]string{testApp, cmdGenerate, "-q", "-f", "-o", testOutput}, tc.flags,
+			[]string{testDir},
+		), fs)
+		require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
+
+		opts = testOpts([]string{testApp, cmdList, "-l", testOutput}, fs)
+		require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
+
+		listed := map[string]string{}
+		out := strings.TrimSuffix(testStdout(t, opts), "\n")
+
+		for line := range strings.SplitSeq(out, "\n") {
+			fields := strings.Split(line, "\t") // mode, size, mtime, path
+			require.Len(t, fields, 4, line)
+			listed[fields[3]] = fields[0]
+		}
+
+		assert.Equal(t, tc.want, listed, "list -l %v", tc.flags)
+
+		opts = testOpts([]string{testApp, cmdExport, testOutput}, fs)
+		require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
+
+		var entries []ExportEntry
+		require.NoError(t, json.Unmarshal([]byte(testStdout(t, opts)), &entries))
+
+		exported := map[string]string{}
+		for _, e := range entries {
+			exported[e.Path] = e.Mode
+		}
+
+		assert.Equal(t, tc.want, exported, "export %v", tc.flags)
+	}
+}
+
+// TestCheckComparesRecordedMode changes a file's mode after gen: check
+// must fail on it when gen recorded the file's mode, and pass when gen
+// recorded 0000.
+func TestCheckComparesRecordedMode(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		flags    []string
+		exitCode int
+	}{
+		{nil, 0},
+		{[]string{"--" + flagIncludePermissions}, 1},
+	} {
+		fs := afero.NewMemMapFs()
+		require.NoError(t, fs.MkdirAll(testDir, 0o755))
+		writeTestFile(t, fs, testFile1, "hello world")
+
+		opts := testOpts(slices.Concat(
+			[]string{testApp, cmdGenerate, "-q", "-o", testMF}, tc.flags,
+			[]string{testDir},
+		), fs)
+		require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
+
+		require.NoError(t, fs.Chmod(testFile1, 0o600))
+
+		opts = testOpts([]string{testApp, cmdCheck, testFlagBase, testDir, testMF}, fs)
+		assert.Equal(t, tc.exitCode, runCLI(opts), "%v: %s", tc.flags, testStderr(t, opts))
+
+		if tc.exitCode != 0 {
+			assert.Contains(t, testStderr(t, opts), "MODE_MISMATCH: file1.txt")
+		}
+	}
+}
+
 // sharedWriter appends to a buffer shared with other sharedWriters, so
 // output written to stdout and stderr is kept in the order it was written.
 // Each write first waits for delay.
@@ -1190,6 +1296,22 @@ func TestGenerateValidatesInputPaths(t *testing.T) {
 	})
 }
 
+// TestFlagAfterArgumentIsArgument asserts that flags are read only before a
+// command's first argument: after it, -v is a path, not the verbose flag.
+func TestFlagAfterArgumentIsArgument(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewMemMapFs()
+	require.NoError(t, fs.MkdirAll(testDir, 0o755))
+	writeTestFile(t, fs, testFile1, "content")
+
+	opts := testOpts([]string{testApp, cmdGenerate, testDir, "-v"}, fs)
+	exitCode := runCLI(opts)
+
+	assert.Equal(t, 1, exitCode)
+	assert.Contains(t, testStderr(t, opts), "path does not exist: -v")
+}
+
 func TestCheckDetectsManifestCorruption(t *testing.T) {
 	t.Parallel()
 

internal/cli/errmsg_test.go

@@ -4,7 +4,6 @@ package cli
 import (
 	"bytes"
 	"context"
-	"flag"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -15,7 +14,7 @@ import (
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	urfcli "github.com/urfave/cli/v2"
+	urfcli "github.com/urfave/cli/v3"
 	"sneak.berlin/go/mfer/mfer"
 )
 
@@ -163,7 +162,7 @@ func signedManifest(t *testing.T, files map[string][]byte) []byte {
 
 	for path, content := range files {
 		_, err = b.AddFile(mfer.RelFilePath(path), mfer.FileSize(len(content)),
-			mfer.ModTime{}, bytes.NewReader(content), nil)
+			mfer.ModTime{}, 0, bytes.NewReader(content), nil)
 		require.NoError(t, err)
 	}
 
@@ -195,13 +194,17 @@ func signedChecker(t *testing.T, manifest []byte) *mfer.Checker {
 func TestPathDoesNotExistMessage(t *testing.T) {
 	t.Parallel()
 
-	set := flag.NewFlagSet("gen", flag.ContinueOnError)
-	require.NoError(t, set.Parse([]string{"nope"}))
-
 	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
-	ctx := urfcli.NewContext(nil, set, nil)
+	cmd := &urfcli.Command{
+		Name: cmdGenerate,
+		Action: func(_ context.Context, c *urfcli.Command) error {
+			_, err := mfa.collectInputPaths(c.Args())
 
-	_, err := mfa.collectInputPaths(ctx.Args())
+			return err
+		},
+	}
+
+	err := cmd.Run(context.Background(), []string{cmdGenerate, "nope"})
 	require.ErrorIs(t, err, errPathNotExist)
 	assert.EqualError(t, err, "path does not exist: nope")
 }
@@ -214,18 +217,22 @@ func TestOutputFileExistsMessage(t *testing.T) {
 	require.NoError(t, afero.WriteFile(fs, "/d/f.txt", []byte("hi"), 0o644))
 	require.NoError(t, afero.WriteFile(fs, "/out.mf", []byte("old"), 0o644))
 
-	set := flag.NewFlagSet("gen", flag.ContinueOnError)
-	set.String("output", "", "")
-	set.Bool("force", false, "")
-	require.NoError(t, set.Parse([]string{"/d"}))
-	require.NoError(t, set.Set("output", "/out.mf"))
-
 	mfa := &CLIApp{Fs: fs}
-	ctx := urfcli.NewContext(nil, set, nil)
+	cmd := &urfcli.Command{
+		Name: cmdGenerate,
+		Flags: []urfcli.Flag{
+			&urfcli.StringFlag{Name: "output"},
+			&urfcli.BoolFlag{Name: "force"},
+		},
+		Action: mfa.generateManifestOperation,
+	}
 
 	// generateManifestOperation writes to the process-global logger during
 	// enumeration, so serialize with the other CLI runs.
-	err := runLocked(func() error { return mfa.generateManifestOperation(ctx) })
+	err := runLocked(func() error {
+		return cmd.Run(context.Background(),
+			[]string{cmdGenerate, "--output", "/out.mf", "/d"})
+	})
 	require.ErrorIs(t, err, errOutputExists)
 	assert.EqualError(t, err,
 		"output file /out.mf already exists (use --force to overwrite)")
@@ -250,7 +257,7 @@ func TestUnknownCommandMessage(t *testing.T) {
 	err := runLocked(func() error {
 		mfa.run([]string{testApp})
 
-		return mfa.app.Run([]string{testApp, "bogus"})
+		return mfa.app.Run(context.Background(), []string{testApp, "bogus"})
 	})
 	require.ErrorIs(t, err, errUnknownCommand)
 	assert.EqualError(t, err, `unknown command "bogus"`)
@@ -267,7 +274,7 @@ func TestManifestLoaderHTTPStatusMessage(t *testing.T) {
 
 	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
 
-	_, err := mfa.openManifestReader(server.URL + "/foo.mf")
+	_, err := mfa.openManifestReader(context.Background(), server.URL+"/foo.mf")
 	require.ErrorIs(t, err, errHTTPStatus)
 	assert.EqualError(t, err,
 		"failed to fetch "+server.URL+"/foo.mf: HTTP 404")
@@ -284,17 +291,13 @@ func TestFetchManifestHTTPStatusMessage(t *testing.T) {
 
 	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
 
-	set := flag.NewFlagSet(cmdFetch, flag.ContinueOnError)
+	cmd := mfa.fetchCommand()
-	for _, f := range mfa.fetchCommand().Flags {
+	cmd.Action = mfa.fetchManifestOperation
-		require.NoError(t, f.Apply(set))
-	}
-
-	require.NoError(t, set.Parse([]string{server.URL}))
-
-	ctx := urfcli.NewContext(nil, set, nil)
 
 	// fetchManifestOperation logs to the process-global logger.
-	err := runLocked(func() error { return mfa.fetchManifestOperation(ctx) })
+	err := runLocked(func() error {
+		return cmd.Run(context.Background(), []string{cmdFetch, server.URL})
+	})
 	require.ErrorIs(t, err, errHTTPStatus)
 	assert.EqualError(t, err, "failed to fetch manifest: HTTP 404")
 }
@@ -320,14 +323,13 @@ func TestFetchFileHTTPStatusMessage(t *testing.T) {
 func TestURLRequiredMessage(t *testing.T) {
 	t.Parallel()
 
-	set := flag.NewFlagSet("fetch", flag.ContinueOnError)
-	require.NoError(t, set.Parse([]string{}))
-
 	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
-	ctx := urfcli.NewContext(nil, set, nil)
+	cmd := &urfcli.Command{Name: cmdFetch, Action: mfa.fetchManifestOperation}
 
 	// fetchManifestOperation logs to the process-global logger.
-	err := runLocked(func() error { return mfa.fetchManifestOperation(ctx) })
+	err := runLocked(func() error {
+		return cmd.Run(context.Background(), []string{cmdFetch})
+	})
 	require.ErrorIs(t, err, errURLRequired)
 	assert.EqualError(t, err, "URL argument required")
 }

internal/cli/export.go

@@ -1,12 +1,13 @@
 package cli
 
 import (
+	"context"
 	"encoding/hex"
 	"encoding/json"
 	"fmt"
 	"time"
 
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 	"sneak.berlin/go/mfer/mfer"
 )
 
@@ -17,21 +18,25 @@ type ExportEntry struct {
 	Hashes []string `json:"hashes"`
 	Mtime  *string  `json:"mtime,omitempty"`
 	Ctime  *string  `json:"ctime,omitempty"`
+	Mode   string   `json:"mode"` // octal, "0000" when none was recorded
 }
 
-func (mfa *CLIApp) exportManifestOperation(ctx *cli.Context) error {
+func (mfa *CLIApp) exportManifestOperation(
-	pathOrURL, err := mfa.resolveManifestArg(ctx)
+	ctx context.Context, cmd *cli.Command,
+) error {
+	pathOrURL, err := mfa.resolveManifestArg(cmd)
 	if err != nil {
 		return fmt.Errorf("export: %w", err)
 	}
 
-	rc, err := mfa.openManifestReader(pathOrURL)
+	rc, err := mfa.openManifestReader(ctx, pathOrURL)
 	if err != nil {
 		return fmt.Errorf("export: %w", err)
 	}
 
 	defer func() { _ = rc.Close() }()
 
+	//nolint:contextcheck // mfer loads a manifest without a context
 	manifest, err := mfer.NewManifestFromReader(rc)
 	if err != nil {
 		return fmt.Errorf("export: failed to parse manifest: %w", err)
@@ -45,6 +50,7 @@ func (mfa *CLIApp) exportManifestOperation(ctx *cli.Context) error {
 			Path:   f.GetPath(),
 			Size:   f.GetSize(),
 			Hashes: make([]string, 0, len(f.GetHashes())),
+			Mode:   fmt.Sprintf("%04o", f.GetMode()),
 		}
 
 		for _, h := range f.GetHashes() {

internal/cli/export_test.go

@@ -132,7 +132,7 @@ func TestListFromHTTPURL(t *testing.T) {
 
 	exitCode := runCLI(&RunOptions{
 		Appname: testApp,
-		Args:    []string{testApp, "list", server.URL + "/index.mf"},
+		Args:    []string{testApp, cmdList, server.URL + "/index.mf"},
 		Stdin:   &bytes.Buffer{},
 		Stdout:  &stdout,
 		Stderr:  &stderr,

internal/cli/fetch.go

@@ -20,7 +20,7 @@ import (
 	"github.com/dustin/go-humanize"
 	"github.com/multiformats/go-multihash"
 	"github.com/spf13/afero"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 	"sneak.berlin/go/mfer/internal/log"
 	"sneak.berlin/go/mfer/mfer"
 )
@@ -91,10 +91,13 @@ var (
 	// errHashMismatch indicates a downloaded file whose hash matches no
 	// manifest hash.
 	errHashMismatch = errors.New("hash mismatch")
-	// errManifestNameListed indicates a manifest that lists a file where
+	// errNameClash indicates a manifest that lists a file where fetch
-	// fetch saves the manifest.
+	// writes another file.
-	errManifestNameListed = errors.New(
+	errNameClash = errors.New(
-		"manifest lists a file where fetch saves the manifest")
+		"manifest lists a file where fetch writes another file")
+	// errModeOutOfRange indicates a manifest that lists a mode with more
+	// than the permission bits, such as setuid.
+	errModeOutOfRange = errors.New("manifest lists a mode outside 0777")
 )
 
 // DownloadProgress reports the progress of a single file download.
@@ -292,11 +295,11 @@ func downloadManifestFiles(
 }
 
 // alreadyPresent reports whether localPath under dest is a regular file
-// with the size and one of the hashes the manifest lists for entry. It
+// with the size, the recorded mode if any, and one of the hashes the
-// hashes the whole file, since a matching size alone would accept a
+// manifest lists for entry. It hashes the whole file, since a matching
-// corrupted or partly written one. A file it cannot read, or reaches only
+// size alone would accept a corrupted or partly written one. A file it
-// through a symlink, is not present: fetch downloads it, and the download
+// cannot read, or reaches only through a symlink, is not present: fetch
-// reports the problem.
+// downloads it, and the download reports the problem.
 func alreadyPresent(dest, localPath string, entry *mfer.MFFilePath) bool {
 	if checkNoSymlinks(dest, localPath) != nil {
 		return false
@@ -309,6 +312,12 @@ func alreadyPresent(dest, localPath string, entry *mfer.MFFilePath) bool {
 		return false
 	}
 
+	// A recorded mode of 0 means none was recorded.
+	if entry.GetMode() != 0 &&
+		info.Mode().Perm() != os.FileMode(entry.GetMode()).Perm() {
+		return false
+	}
+
 	// G304: localPath is a relative path that sanitizePath keeps inside
 	// dest as text, and checkNoSymlinks just found no symlink in it.
 	f, err := os.Open(path) //nolint:gosec // G304: see comment above
@@ -328,19 +337,21 @@ func alreadyPresent(dest, localPath string, entry *mfer.MFFilePath) bool {
 	return verifyDownloadedHash(h.Sum(nil), entry) == nil
 }
 
-func (mfa *CLIApp) fetchManifestOperation(ctx *cli.Context) error {
+func (mfa *CLIApp) fetchManifestOperation(
+	ctx context.Context, cmd *cli.Command,
+) error {
 	log.Debug("fetchManifestOperation()")
 
-	if ctx.Args().Len() == 0 {
+	if cmd.Args().Len() == 0 {
 		return errURLRequired
 	}
 
-	timeout := ctx.Duration(flagTimeout)
+	timeout := cmd.Duration(flagTimeout)
 	if timeout <= 0 {
 		return errInvalidTimeout
 	}
 
-	manifestURL, err := resolveManifestURL(ctx.Args().Get(0))
+	manifestURL, err := resolveManifestURL(cmd.Args().Get(0))
 	if err != nil {
 		return fmt.Errorf("invalid URL: %w", err)
 	}
@@ -350,7 +361,7 @@ func (mfa *CLIApp) fetchManifestOperation(ctx *cli.Context) error {
 		firstDelay: firstRetryDelay,
 	}
 
-	manifestData, files, err := fetchManifest(ctx, client, manifestURL)
+	manifestData, files, err := fetchManifest(ctx, cmd, client, manifestURL)
 	if err != nil {
 		return err
 	}
@@ -361,7 +372,7 @@ func (mfa *CLIApp) fetchManifestOperation(ctx *cli.Context) error {
 		return err
 	}
 
-	dest := ctx.String(flagDest)
+	dest := cmd.String(flagDest)
 
 	err = os.MkdirAll(dest, dirPerms)
 	if err != nil {
@@ -379,7 +390,7 @@ func (mfa *CLIApp) fetchManifestOperation(ctx *cli.Context) error {
 
 	// Download each file
 	downloaded, downloadedBytes, dlErr := downloadManifestFiles(
-		ctx.Context, client, baseURL, dest, files, progress)
+		ctx, client, baseURL, dest, files, progress)
 
 	close(progress)
 	<-done
@@ -412,11 +423,11 @@ func (mfa *CLIApp) fetchManifestOperation(ctx *cli.Context) error {
 
 // fetchManifest downloads the manifest at manifestURL and parses it,
 // enforcing --require-signature if it is given and refusing a manifest
-// that lists a file where it will be saved. It returns the manifest as
+// that lists a file where fetch writes another or a mode outside 0777. It
-// downloaded, to be saved once the files are in place, and the files it
+// returns the manifest as downloaded, to be saved once the files are in
-// lists.
+// place, and the files it lists.
 func fetchManifest(
-	ctx *cli.Context, client retryingClient, manifestURL string,
+	ctx context.Context, cmd *cli.Command, client retryingClient, manifestURL string,
 ) ([]byte, []*mfer.MFFilePath, error) {
 	log.Infof("fetching manifest from %s", manifestURL)
 
@@ -425,7 +436,7 @@ func fetchManifest(
 	// manifest.
 	var manifestData []byte
 
-	err := client.get(ctx.Context, manifestURL, func(resp *http.Response) error {
+	err := client.get(ctx, manifestURL, func(resp *http.Response) error {
 		var readErr error
 
 		manifestData, readErr = io.ReadAll(resp.Body)
@@ -437,12 +448,13 @@ func fetchManifest(
 	}
 
 	// Parse manifest
+	//nolint:contextcheck // mfer loads a manifest without a context
 	manifest, err := mfer.NewManifestFromReader(bytes.NewReader(manifestData))
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to parse manifest: %w", err)
 	}
 
-	requiredSigner := ctx.String(flagRequireSignature)
+	requiredSigner := cmd.String(flagRequireSignature)
 	if requiredSigner != "" {
 		err = verifyFetchedSigner(ctx, manifestData, requiredSigner)
 		if err != nil {
@@ -452,29 +464,70 @@ func fetchManifest(
 
 	files := manifest.Files()
 
-	err = checkManifestNameUnlisted(files)
+	err = checkNoNameClash(files)
 	if err != nil {
 		return nil, nil, err
 	}
 
+	// fetch sets each recorded mode on the file it writes, so a mode above
+	// 0777, which could carry setuid, setgid or sticky bits, is refused
+	// before any file is requested.
+	for _, f := range files {
+		if f.GetMode() > uint32(os.ModePerm) {
+			return nil, nil, fmt.Errorf("%w: %s (%#o)",
+				errModeOutOfRange, f.GetPath(), f.GetMode())
+		}
+	}
+
 	log.Infof("manifest contains %d files", len(files))
 
 	return manifestData, files, nil
 }
 
-// checkManifestNameUnlisted returns an error if files lists a file or
+// checkNoNameClash returns an error if files lists a file, or a directory
-// directory at the top of the tree under the name fetch saves the
+// a file is in, under a name where fetch writes another file: another
-// manifest as, or under that name's temp file. Saving the manifest would
+// listed file, a directory another listed file is in, the temp file it
-// replace or remove it, or fail once every file was downloaded, leaving a
+// downloads a listed file to, or, at the top of the tree, the saved
-// tree check rejects. Names are compared ignoring case, since on a
+// manifest or its temp file. fetch would remove or replace what is
-// case-insensitive filesystem INDEX.MF and index.mf are one file.
+// listed there, or fail partway, leaving a tree check rejects. Names are
-func checkManifestNameUnlisted(files []*mfer.MFFilePath) error {
+// compared ignoring case, on every filesystem, since on a
-	for _, f := range files {
+// case-insensitive one A.txt and a.txt are one file.
-		top, _, _ := strings.Cut(filepath.Clean(f.GetPath()), string(filepath.Separator))
+func checkNoNameClash(files []*mfer.MFFilePath) error {
+	sep := string(filepath.Separator)
 
-		if strings.EqualFold(top, defaultManifestName) ||
+	// written maps each name fetch writes, in lower case, to the file or
-			strings.EqualFold(top, tempPathFor(defaultManifestName)) {
+	// directory it writes there.
-			return fmt.Errorf("%w: %s", errManifestNameListed, f.GetPath())
+	written := map[string]string{
+		defaultManifestName:              "the saved manifest",
+		tempPathFor(defaultManifestName): "the saved manifest's temp file",
+	}
+
+	for _, f := range files {
+		tmpPath := tempPathFor(filepath.Clean(f.GetPath()))
+		written[strings.ToLower(tmpPath)] = "the temp file for " + f.GetPath()
+	}
+
+	for _, f := range files {
+		// Look up and add each directory on the file's path, then the
+		// file itself. Only the same directory, spelled alike, may
+		// already be there.
+		parts := strings.Split(filepath.Clean(f.GetPath()), sep)
+		last := len(parts) - 1
+
+		for i := range parts {
+			name := strings.Join(parts[:i+1], sep)
+
+			what := "the directory " + name
+			if i == last {
+				what = "the file " + f.GetPath()
+			}
+
+			other, ok := written[strings.ToLower(name)]
+			if ok && (i == last || other != what) {
+				return fmt.Errorf("%w: %s (%s)", errNameClash, f.GetPath(), other)
+			}
+
+			written[strings.ToLower(name)] = what
 		}
 	}
 
@@ -486,7 +539,7 @@ func checkManifestNameUnlisted(files []*mfer.MFFilePath) error {
 // its manifest from a file, so the manifest is handed to it as a file in
 // memory.
 func verifyFetchedSigner(
-	ctx *cli.Context, manifestData []byte, requiredSigner string,
+	ctx context.Context, manifestData []byte, requiredSigner string,
 ) error {
 	memFs := afero.NewMemMapFs()
 	manifestPath := "/" + defaultManifestName
@@ -496,6 +549,7 @@ func verifyFetchedSigner(
 		return err
 	}
 
+	//nolint:contextcheck // mfer loads a manifest without a context
 	chk, err := mfer.NewChecker(&mfer.CheckerOptions{
 		ManifestPath: manifestPath,
 		BasePath:     "/",
@@ -505,7 +559,7 @@ func verifyFetchedSigner(
 		return fmt.Errorf("failed to load manifest: %w", err)
 	}
 
-	return verifyRequiredSigner(ctx.Context, chk, requiredSigner)
+	return verifyRequiredSigner(ctx, chk, requiredSigner)
 }
 
 // saveManifest writes the fetched manifest into dest under the default
@@ -585,7 +639,7 @@ func sanitizePath(p string) (string, error) {
 func checkNoSymlinks(dest, p string) error {
 	current := dest
 
-	for _, part := range strings.Split(p, string(filepath.Separator)) {
+	for part := range strings.SplitSeq(p, string(filepath.Separator)) {
 		current = filepath.Join(current, part)
 
 		info, err := os.Lstat(current)
@@ -831,6 +885,19 @@ func saveResponse(
 		return err
 	}
 
+	// A recorded mode of 0 means none was recorded. Of any other, only the
+	// permission bits are set, whatever the umask, so setuid, setgid and
+	// sticky never are, whichever caller passed the entry.
+	if entry.GetMode() != 0 {
+		err = out.Chmod(os.FileMode(entry.GetMode()).Perm())
+		if err != nil {
+			_ = out.Close()
+			_ = os.Remove(filepath.Join(dest, tmpPath))
+
+			return fmt.Errorf("failed to set mode: %w", err)
+		}
+	}
+
 	// Set up hash computation
 	h := sha256.New()
 

internal/cli/fetch_test.go

@@ -4,7 +4,7 @@ package cli
 import (
 	"bytes"
 	"context"
-	"flag"
+	"crypto/sha256"
 	"fmt"
 	"io"
 	"maps"
@@ -19,11 +19,14 @@ import (
 	"sync/atomic"
 	"testing"
 	"time"
+	"uuid"
 
+	"github.com/klauspost/compress/zstd"
+	"github.com/multiformats/go-multihash"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	urfcli "github.com/urfave/cli/v2"
+	"google.golang.org/protobuf/proto"
 	"sneak.berlin/go/mfer/mfer"
 )
 
@@ -183,12 +186,7 @@ func chdirTemp(t *testing.T) string {
 	t.Helper()
 
 	destDir := t.TempDir()
-
+	t.Chdir(destDir)
-	origDir, err := os.Getwd()
-	require.NoError(t, err)
-
-	require.NoError(t, os.Chdir(destDir))
-	t.Cleanup(func() { _ = os.Chdir(origDir) })
 
 	return destDir
 }
@@ -1176,23 +1174,339 @@ func TestFetchRefusesListedManifestName(t *testing.T) {
 		t.Run(listed, func(t *testing.T) {
 			t.Parallel()
 
-			// Built directly rather than scanned, since a scan lists no
+			files := map[string][]byte{listed: []byte("listed")}
-			// hidden files and never a path starting with "./".
-			content := []byte("listed")
-			builder := mfer.NewBuilder()
-			_, err := builder.AddFile(mfer.RelFilePath(listed), mfer.FileSize(len(content)),
-				mfer.ModTime(time.Now()), bytes.NewReader(content), nil)
-			require.NoError(t, err)
 
-			var manifest bytes.Buffer
+			assertFetchRefused(t, builtManifest(t, files), files,
-			require.NoError(t, builder.Build(context.Background(), &manifest))
+				"manifest lists a file where fetch writes another file: "+listed)
-
-			assertFetchRefused(t, manifest.Bytes(), map[string][]byte{listed: content},
-				"manifest lists a file where fetch saves the manifest: "+listed)
 		})
 	}
 }
 
+// TestFetchRefusesListedTempName fetches manifests that list a.txt and
+// .a.txt.tmp, the temp file fetch downloads a.txt to, at the top of the
+// tree and in a directory. Downloading a.txt would remove .a.txt.tmp, so
+// fetch must refuse the manifest before it creates the destination or
+// requests any file. README with .README.tmp checks that temp names are
+// compared ignoring case. A manifest that lists only one of the two is
+// fetched in full.
+func TestFetchRefusesListedTempName(t *testing.T) {
+	t.Parallel()
+
+	for _, dir := range []string{"", "sub/"} {
+		for file, tmp := range map[string]string{
+			dir + "a.txt":  dir + ".a.txt.tmp",
+			dir + "README": dir + ".README.tmp",
+		} {
+			both := map[string][]byte{
+				file: []byte("a file"),
+				tmp:  []byte("a file at its temp name"),
+			}
+
+			t.Run(file+" and "+tmp, func(t *testing.T) {
+				t.Parallel()
+
+				assertFetchRefused(t, builtManifest(t, both), both,
+					"manifest lists a file where fetch writes another file: "+
+						tmp+" (the temp file for "+file+")")
+			})
+
+			for listed, content := range both {
+				t.Run("only "+listed, func(t *testing.T) {
+					t.Parallel()
+
+					files := map[string][]byte{listed: content}
+					manifest := builtManifest(t, files)
+
+					server := httptest.NewServer(fetchTestHandler(manifest, files))
+					defer server.Close()
+
+					dest := t.TempDir()
+
+					opts := testOpts([]string{
+						testApp, cmdFetch, "-q", "--" + flagDest, dest, server.URL,
+					}, afero.NewOsFs())
+					require.Equal(t, 0, runCLI(opts), testStderr(t, opts))
+
+					want := maps.Clone(files)
+					want[defaultManifestName] = manifest
+					assert.Equal(t, want, filesUnder(t, dest))
+				})
+			}
+		}
+	}
+}
+
+// TestFetchRefusesNamesEqualIgnoringCase fetches manifests that list two
+// paths that are one name on a case-insensitive filesystem. Fetched
+// there, of two such files, at the top of the tree or in a directory,
+// one replaces the other and fetch exits 0. A file and a directory
+// another file is in stop fetch partway with a non-zero exit, leaving a
+// partial tree. Two spellings of one directory put both files in one
+// directory, one of them under a spelling the manifest does not list,
+// and check reports that file as not in the manifest. So fetch must
+// refuse each on every filesystem before it creates the destination or
+// requests any file. A file and a directory with the same name, and a
+// file listed twice, are refused the same way. A manifest whose names
+// differ in more than letter case is fetched in full.
+func TestFetchRefusesNamesEqualIgnoringCase(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct{ first, second, message string }{
+		{"X.txt", "x.txt", "x.txt (the file X.txt)"},
+		{"sub/X.txt", "sub/x.txt", "sub/x.txt (the file sub/X.txt)"},
+		{"Dir", "dir/x", "dir/x (the file Dir)"},
+		{"Dir/a.txt", "dir/b.txt", "dir/b.txt (the directory Dir)"},
+		{"dir", "dir/x", "dir/x (the file dir)"},
+		{"./x.txt", "x.txt", "x.txt (the file ./x.txt)"},
+	} {
+		t.Run(tc.first+" and "+tc.second, func(t *testing.T) {
+			t.Parallel()
+
+			files := map[string][]byte{
+				tc.first:  []byte("the first file"),
+				tc.second: []byte("the second file"),
+			}
+
+			assertFetchRefused(t, builtManifest(t, files), files,
+				"manifest lists a file where fetch writes another file: "+tc.message)
+		})
+	}
+
+	t.Run("names that differ in more than letter case", func(t *testing.T) {
+		t.Parallel()
+
+		files := map[string][]byte{
+			"A.txt":     []byte("at the top"),
+			"B.txt":     []byte("also at the top"),
+			"dir/a.txt": []byte("in a directory"),
+			"dir/b.txt": []byte("in the same directory"),
+		}
+		manifest := builtManifest(t, files)
+
+		server := httptest.NewServer(fetchTestHandler(manifest, files))
+		defer server.Close()
+
+		dest := t.TempDir()
+
+		opts := testOpts([]string{
+			testApp, cmdFetch, "-q", "--" + flagDest, dest, server.URL,
+		}, afero.NewOsFs())
+		require.Equal(t, 0, runCLI(opts), testStderr(t, opts))
+
+		want := maps.Clone(files)
+		want[defaultManifestName] = manifest
+		assert.Equal(t, want, filesUnder(t, dest))
+	})
+}
+
+// TestFetchSetsRecordedMode fetches a tree whose manifest records the
+// modes 0640 and 0755. Each file must get its mode whatever the umask, and
+// check must pass on the result. After one file's mode is changed, a
+// second fetch must download that file again, and only it, to restore its
+// mode.
+func TestFetchSetsRecordedMode(t *testing.T) {
+	t.Parallel()
+
+	files := map[string][]byte{
+		testFileTxt: []byte("a file"),
+		"tool.sh":   []byte("#!/bin/sh\n"),
+	}
+	modes := map[string]os.FileMode{testFileTxt: 0o640, "tool.sh": 0o755}
+
+	sourceFs := afero.NewMemMapFs()
+	for p, content := range files {
+		require.NoError(t, afero.WriteFile(sourceFs, "/"+p, content, modes[p]))
+	}
+
+	scanner := mfer.NewScannerWithOptions(&mfer.ScannerOptions{
+		Fs:                 sourceFs,
+		IncludePermissions: true,
+	})
+	require.NoError(t, scanner.EnumerateFS(sourceFs, "/", nil))
+
+	var manifest bytes.Buffer
+	require.NoError(t, scanner.ToManifest(context.Background(), &manifest, nil))
+
+	tree := fetchTestHandler(manifest.Bytes(), files)
+
+	var (
+		mu        sync.Mutex
+		requested []string
+	)
+
+	server := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			mu.Lock()
+
+			requested = append(requested, r.URL.Path)
+
+			mu.Unlock()
+
+			tree.ServeHTTP(w, r)
+		}))
+	defer server.Close()
+
+	dest := t.TempDir()
+	fetch := []string{testApp, cmdFetch, "-q", "--" + flagDest, dest, server.URL}
+
+	opts := testOpts(fetch, afero.NewOsFs())
+	require.Equal(t, 0, runCLI(opts), testStderr(t, opts))
+
+	for p, mode := range modes {
+		info, err := os.Stat(filepath.Join(dest, p))
+		require.NoError(t, err)
+		assert.Equal(t, mode, info.Mode().Perm(), p)
+	}
+
+	opts = testOpts([]string{
+		testApp, cmdCheck, "-q", testFlagBase, dest,
+		filepath.Join(dest, defaultManifestName),
+	}, afero.NewOsFs())
+	require.Equal(t, 0, runCLI(opts), testStderr(t, opts))
+
+	require.NoError(t, os.Chmod(filepath.Join(dest, testFileTxt), 0o600))
+
+	mu.Lock()
+	requested = nil
+	mu.Unlock()
+
+	opts = testOpts(fetch, afero.NewOsFs())
+	require.Equal(t, 0, runCLI(opts), testStderr(t, opts))
+
+	info, err := os.Stat(filepath.Join(dest, testFileTxt))
+	require.NoError(t, err)
+	assert.Equal(t, os.FileMode(0o640), info.Mode().Perm())
+
+	mu.Lock()
+	defer mu.Unlock()
+
+	assert.ElementsMatch(t,
+		[]string{"/" + defaultManifestName, "/" + testFileTxt}, requested)
+}
+
+// TestFetchRefusesModeOutsidePermissionBits fetches manifests that record
+// a mode with the setuid bit, once as Unix writes it (04755) and once as
+// Go keeps it in os.FileMode. fetch must refuse both before it creates the
+// destination or requests any file.
+func TestFetchRefusesModeOutsidePermissionBits(t *testing.T) {
+	t.Parallel()
+
+	files := map[string][]byte{testFileTxt: []byte("a file")}
+
+	assertFetchRefused(t, manifestWithMode(t, testFileTxt, files[testFileTxt], 0o4755),
+		files, "manifest lists a mode outside 0777: file.txt (04755)")
+
+	assertFetchRefused(t,
+		manifestWithMode(t, testFileTxt, files[testFileTxt],
+			uint32(os.ModeSetuid|0o755)),
+		files, "manifest lists a mode outside 0777: file.txt (040000755)")
+}
+
+// TestDownloadFileSetsOnlyPermissionBits downloads a file whose entry
+// records mode 0755 together with setuid, setgid or sticky, as Go keeps
+// them in os.FileMode. fetchManifest would refuse such an entry; called
+// directly, downloadFile must still set only the permission bits.
+func TestDownloadFileSetsOnlyPermissionBits(t *testing.T) {
+	t.Parallel()
+
+	content := []byte("#!/bin/sh\n")
+
+	digest := sha256.Sum256(content)
+	hash, err := multihash.Encode(digest[:], multihash.SHA2_256)
+	require.NoError(t, err)
+
+	server := httptest.NewServer(
+		http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			_, _ = w.Write(content)
+		}))
+	defer server.Close()
+
+	for _, special := range []os.FileMode{os.ModeSetuid, os.ModeSetgid, os.ModeSticky} {
+		entry := &mfer.MFFilePath{
+			Path:   testFileTxt,
+			Size:   int64(len(content)),
+			Hashes: []*mfer.MFFileChecksum{{MultiHash: hash}},
+			Mode:   uint32(special | 0o755),
+		}
+
+		dest := t.TempDir()
+
+		err := downloadFile(context.Background(), testClient(),
+			server.URL+"/"+testFileTxt, dest, testFileTxt, entry, nil)
+		require.NoError(t, err, special)
+
+		info, err := os.Stat(filepath.Join(dest, testFileTxt))
+		require.NoError(t, err)
+		assert.Equal(t, os.FileMode(0o755), info.Mode(), special)
+	}
+}
+
+// manifestWithMode returns a manifest listing one file, path, with content
+// and the given recorded mode. It is assembled by hand, since the builder
+// never records a mode outside 0777.
+func manifestWithMode(t *testing.T, path string, content []byte, mode uint32) []byte {
+	t.Helper()
+
+	digest := sha256.Sum256(content)
+	hash, err := multihash.Encode(digest[:], multihash.SHA2_256)
+	require.NoError(t, err)
+
+	id := uuid.NewV4()
+
+	inner, err := proto.Marshal(&mfer.MFFile{
+		Version: mfer.MFFile_VERSION_ONE,
+		Files: []*mfer.MFFilePath{{
+			Path:   path,
+			Size:   int64(len(content)),
+			Hashes: []*mfer.MFFileChecksum{{MultiHash: hash}},
+			Mode:   mode,
+		}},
+		Uuid: id[:],
+	})
+	require.NoError(t, err)
+
+	encoder, err := zstd.NewWriter(nil)
+	require.NoError(t, err)
+
+	compressed := encoder.EncodeAll(inner, nil)
+	require.NoError(t, encoder.Close())
+
+	sum := sha256.Sum256(compressed)
+
+	outer, err := proto.Marshal(&mfer.MFFileOuter{
+		Version:         mfer.MFFileOuter_VERSION_ONE,
+		CompressionType: mfer.MFFileOuter_COMPRESSION_ZSTD,
+		Size:            int64(len(inner)),
+		Sha256:          sum[:],
+		Uuid:            id[:],
+		InnerMessage:    compressed,
+	})
+	require.NoError(t, err)
+
+	return append([]byte(mfer.MAGIC), outer...)
+}
+
+// builtManifest returns a manifest of files, built directly rather than
+// scanned, since a scan lists no hidden files and never a path starting
+// with "./".
+func builtManifest(t *testing.T, files map[string][]byte) []byte {
+	t.Helper()
+
+	builder := mfer.NewBuilder()
+
+	for p, content := range files {
+		_, err := builder.AddFile(mfer.RelFilePath(p), mfer.FileSize(len(content)),
+			mfer.ModTime(time.Now()), 0, bytes.NewReader(content), nil)
+		require.NoError(t, err)
+	}
+
+	var manifest bytes.Buffer
+
+	require.NoError(t, builder.Build(context.Background(), &manifest))
+
+	return manifest.Bytes()
+}
+
 // assertFetchRefused serves manifest, a manifest of files, and fetches it
 // with flags into a directory that does not exist yet. fetch must fail
 // with message after requesting only the manifest, and must not create
@@ -1256,18 +1570,13 @@ func TestFetchTimeoutFlag(t *testing.T) {
 
 	mfa := &CLIApp{Fs: afero.NewMemMapFs()}
 
-	set := flag.NewFlagSet(cmdFetch, flag.ContinueOnError)
+	cmd := mfa.fetchCommand()
-	for _, f := range mfa.fetchCommand().Flags {
+	cmd.Action = mfa.fetchManifestOperation
-		require.NoError(t, f.Apply(set))
-	}
-
-	require.NoError(t, set.Parse([]string{"--" + flagTimeout, "100ms", server.URL}))
-
-	cliCtx := urfcli.NewContext(nil, set, nil)
-	cliCtx.Context = ctx
 
 	// fetchManifestOperation logs to the process-global logger.
-	err := runLocked(func() error { return mfa.fetchManifestOperation(cliCtx) })
+	err := runLocked(func() error {
+		return cmd.Run(ctx, []string{cmdFetch, "--" + flagTimeout, "100ms", server.URL})
+	})
 	require.Error(t, err)
 }
 

internal/cli/freshen.go

@@ -14,7 +14,7 @@ import (
 	"github.com/dustin/go-humanize"
 	"github.com/multiformats/go-multihash"
 	"github.com/spf13/afero"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 	"sneak.berlin/go/mfer/internal/log"
 	"sneak.berlin/go/mfer/mfer"
 )
@@ -48,6 +48,7 @@ type freshenEntry struct {
 	path      string
 	size      int64
 	mtime     time.Time
+	mode      fs.FileMode      // mode to record, 0 for none
 	needsHash bool             // true if new or changed
 	existing  *mfer.MFFilePath // existing manifest entry if unchanged
 }
@@ -55,13 +56,14 @@ type freshenEntry struct {
 // freshenScanner walks the filesystem and compares it against the
 // entries of an existing manifest.
 type freshenScanner struct {
-	fs              afero.Fs
+	fs                 afero.Fs
-	absBase         string
+	absBase            string
-	excluded        []fs.FileInfo // files left out of the listing
+	excluded           []fs.FileInfo // files left out of the listing
-	includeDotfiles bool
+	includeDotfiles    bool
-	followSymlinks  bool
+	followSymlinks     bool
-	showProgress    bool
+	includePermissions bool
-	existingByPath  map[string]*mfer.MFFilePath
+	showProgress       bool
+	existingByPath     map[string]*mfer.MFFilePath
 
 	entries   []*freshenEntry
 	scanCount int64
@@ -93,6 +95,12 @@ func (s *freshenScanner) resolveSymlink(path string) (fs.FileInfo, bool) {
 // recordEntry classifies a scanned file as changed, unchanged, or added
 // relative to the existing manifest.
 func (s *freshenScanner) recordEntry(relPath string, info fs.FileInfo) {
+	// A mode of 0 records 0000, which means none was recorded.
+	var mode fs.FileMode
+	if s.includePermissions {
+		mode = info.Mode().Perm()
+	}
+
 	existing, inManifest := s.existingByPath[relPath]
 	if !inManifest {
 		s.added++
@@ -102,16 +110,17 @@ func (s *freshenScanner) recordEntry(relPath string, info fs.FileInfo) {
 			path:      relPath,
 			size:      info.Size(),
 			mtime:     info.ModTime(),
+			mode:      mode,
 			needsHash: true,
 		})
 
 		return
 	}
 
-	// Check if changed (size or mtime). An entry with no recorded mtime
+	// Check if changed (size, mtime, or the mode to record). An entry
-	// cannot be compared, so it counts as changed and gets re-hashed;
+	// with no recorded mtime cannot be compared, so it counts as changed
-	// silently treating the absent mtime as the Unix epoch would classify
+	// and gets re-hashed; silently treating the absent mtime as the Unix
-	// every such entry as changed without saying why.
+	// epoch would classify every such entry as changed without saying why.
 	existingMtime, haveMtime := entryMtime(existing)
 	if !haveMtime {
 		log.Debugf("%s: manifest entry has no mtime, treating as changed",
@@ -119,7 +128,8 @@ func (s *freshenScanner) recordEntry(relPath string, info fs.FileInfo) {
 	}
 
 	if !haveMtime || existing.GetSize() != info.Size() ||
-		!existingMtime.Equal(info.ModTime()) {
+		!existingMtime.Equal(info.ModTime()) ||
+		fs.FileMode(existing.GetMode()) != mode {
 		s.changed++
 
 		log.Verbosef("M %s", relPath)
@@ -127,6 +137,7 @@ func (s *freshenScanner) recordEntry(relPath string, info fs.FileInfo) {
 			path:      relPath,
 			size:      info.Size(),
 			mtime:     info.ModTime(),
+			mode:      mode,
 			needsHash: true,
 		})
 	} else {
@@ -136,6 +147,7 @@ func (s *freshenScanner) recordEntry(relPath string, info fs.FileInfo) {
 			path:      relPath,
 			size:      info.Size(),
 			mtime:     info.ModTime(),
+			mode:      mode,
 			needsHash: false,
 			existing:  existing,
 		})
@@ -202,12 +214,12 @@ func (s *freshenScanner) walk(path string, info fs.FileInfo, walkErr error) erro
 
 // resolveFreshenManifestPath determines the manifest path from the CLI
 // arguments, searching directories for a manifest where needed.
-func (mfa *CLIApp) resolveFreshenManifestPath(ctx *cli.Context) (string, error) {
+func (mfa *CLIApp) resolveFreshenManifestPath(cmd *cli.Command) (string, error) {
-	if ctx.Args().Len() == 0 {
+	if cmd.Args().Len() == 0 {
 		return findManifest(mfa.Fs, ".")
 	}
 
-	arg := ctx.Args().Get(0)
+	arg := cmd.Args().Get(0)
 
 	info, statErr := mfa.Fs.Stat(arg)
 	if statErr == nil && info.IsDir() {
@@ -296,7 +308,7 @@ func (h *freshenHasher) processEntry(e *freshenEntry) error {
 	h.hashedFiles++
 
 	// Add to builder with computed hash
-	err = addFileToBuilder(h.builder, e.path, e.size, e.mtime, hash)
+	err = addFileToBuilder(h.builder, e.path, e.size, e.mtime, e.mode, hash)
 	if err != nil {
 		return fmt.Errorf("failed to add %s: %w", e.path, err)
 	}
@@ -338,14 +350,14 @@ func writeFreshenedManifest(
 
 // newFreshenBuilder constructs the manifest builder configured from CLI
 // flags.
-func newFreshenBuilder(ctx *cli.Context) *mfer.Builder {
+func newFreshenBuilder(cmd *cli.Command) *mfer.Builder {
 	builder := mfer.NewBuilder()
-	if ctx.Bool("include-timestamps") {
+	if cmd.Bool("include-timestamps") {
 		builder.SetIncludeTimestamps(true)
 	}
 
 	// Set up signing options if sign-key is provided
-	if signKey := ctx.String("sign-key"); signKey != "" {
+	if signKey := cmd.String("sign-key"); signKey != "" {
 		builder.SetSigningOptions(&mfer.SigningOptions{
 			KeyID: mfer.GPGKeyID(signKey),
 		})
@@ -358,13 +370,13 @@ func newFreshenBuilder(ctx *cli.Context) *mfer.Builder {
 // freshenScan runs the scan phase against the loaded manifest entries
 // and returns the populated scanner and the count of removed files.
 func (mfa *CLIApp) freshenScan(
-	ctx *cli.Context, manifestPath, absBase string,
+	cmd *cli.Command, manifestPath, absBase string,
 	existingByPath map[string]*mfer.MFFilePath,
 ) (*freshenScanner, int64, error) {
 	log.Infof("scanning filesystem...")
 
 	startScan := time.Now()
-	showProgress := ctx.Bool("progress")
+	showProgress := cmd.Bool("progress")
 
 	// Leave out the manifest and a temp file left by an interrupted run,
 	// as gen does. A path that cannot be stat'd, normally because no file
@@ -379,13 +391,14 @@ func (mfa *CLIApp) freshenScan(
 	}
 
 	scanner := &freshenScanner{
-		fs:              mfa.Fs,
+		fs:                 mfa.Fs,
-		absBase:         absBase,
+		absBase:            absBase,
-		excluded:        excluded,
+		excluded:           excluded,
-		includeDotfiles: ctx.Bool("include-dotfiles"),
+		includeDotfiles:    cmd.Bool("include-dotfiles"),
-		followSymlinks:  ctx.Bool("follow-symlinks"),
+		followSymlinks:     cmd.Bool("follow-symlinks"),
-		showProgress:    showProgress,
+		includePermissions: cmd.Bool(flagIncludePermissions),
-		existingByPath:  existingByPath,
+		showProgress:       showProgress,
+		existingByPath:     existingByPath,
 	}
 
 	err := afero.Walk(mfa.Fs, absBase, scanner.walk)
@@ -433,7 +446,7 @@ func hashTotals(entries []*freshenEntry) (int64, int64) {
 // runFreshenHash processes every entry through the hasher, aborting if
 // the context is canceled.
 func runFreshenHash(
-	ctx *cli.Context, hasher *freshenHasher, entries []*freshenEntry,
+	ctx context.Context, hasher *freshenHasher, entries []*freshenEntry,
 ) error {
 	for _, e := range entries {
 		select {
@@ -479,18 +492,21 @@ func (mfa *CLIApp) loadExistingEntries(
 	return existingByPath, nil
 }
 
-func (mfa *CLIApp) freshenManifestOperation(ctx *cli.Context) error {
+func (mfa *CLIApp) freshenManifestOperation(
+	ctx context.Context, cmd *cli.Command,
+) error {
 	log.Debug("freshenManifestOperation()")
 
-	basePath := ctx.String("base")
+	basePath := cmd.String("base")
-	showProgress := ctx.Bool("progress")
+	showProgress := cmd.Bool("progress")
 
 	// Find manifest file
-	manifestPath, err := mfa.resolveFreshenManifestPath(ctx)
+	manifestPath, err := mfa.resolveFreshenManifestPath(cmd)
 	if err != nil {
 		return fmt.Errorf("freshen: %w", err)
 	}
 
+	//nolint:contextcheck // mfer loads a manifest without a context
 	existingByPath, err := mfa.loadExistingEntries(manifestPath)
 	if err != nil {
 		return err
@@ -502,7 +518,7 @@ func (mfa *CLIApp) freshenManifestOperation(ctx *cli.Context) error {
 	}
 
 	// Phase 1: Scan filesystem
-	scanner, removed, err := mfa.freshenScan(ctx, manifestPath, absBase,
+	scanner, removed, err := mfa.freshenScan(cmd, manifestPath, absBase,
 		existingByPath)
 	if err != nil {
 		return err
@@ -524,7 +540,7 @@ func (mfa *CLIApp) freshenManifestOperation(ctx *cli.Context) error {
 		totalHashBytes: totalHashBytes,
 		filesToHash:    filesToHash,
 		startHash:      time.Now(),
-		builder:        newFreshenBuilder(ctx),
+		builder:        newFreshenBuilder(cmd),
 	}
 
 	err = runFreshenHash(ctx, hasher, scanner.entries)
@@ -548,7 +564,7 @@ func (mfa *CLIApp) freshenManifestOperation(ctx *cli.Context) error {
 	}
 
 	// Write updated manifest atomically (write to temp, then rename)
-	err = writeFreshenedManifest(ctx.Context, mfa.Fs, hasher.builder, manifestPath)
+	err = writeFreshenedManifest(ctx, mfa.Fs, hasher.builder, manifestPath)
 	if err != nil {
 		return err
 	}
@@ -608,10 +624,12 @@ func hashFile(r io.Reader, progress func(int64)) ([]byte, int64, error) {
 
 // addFileToBuilder adds a new file entry to the builder
 func addFileToBuilder(
-	b *mfer.Builder, path string, size int64, mtime time.Time, hash []byte,
+	b *mfer.Builder, path string, size int64, mtime time.Time, mode fs.FileMode,
+	hash []byte,
 ) error {
 	return b.AddFileWithHash(
-		mfer.RelFilePath(path), mfer.FileSize(size), mfer.ModTime(mtime), hash)
+		mfer.RelFilePath(path), mfer.FileSize(size), mfer.ModTime(mtime), mode,
+		hash)
 }
 
 // addExistingToBuilder adds an existing manifest entry to the builder.
@@ -631,7 +649,7 @@ func addExistingToBuilder(b *mfer.Builder, entry *mfer.MFFilePath) error {
 
 	err := b.AddFileWithHash(mfer.RelFilePath(entry.GetPath()),
 		mfer.FileSize(entry.GetSize()), mfer.ModTime(mtime),
-		entry.GetHashes()[0].GetMultiHash())
+		fs.FileMode(entry.GetMode()), entry.GetHashes()[0].GetMultiHash())
 	if err != nil {
 		return fmt.Errorf(
 			"manifest entry %s: %w (regenerate the manifest with mfer generate)",

internal/cli/freshen_test.go

@@ -99,6 +99,42 @@ func TestFreshenUnchanged(t *testing.T) {
 	}
 }
 
+// TestFreshenRecordsModeOnlyWhenAsked changes only the modes of a tree
+// after gen made its manifest, which recorded every mode as 0000. freshen
+// --include-permissions must record each file's permission bits, and a
+// later freshen without it must record 0000 again, although no file's
+// content or mtime changed.
+func TestFreshenRecordsModeOnlyWhenAsked(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewOsFs()
+	root, manifestPath := setupFreshenDir(t, fs,
+		map[string]string{testFileTxt: "a file", testDirFile: "a file in dir"})
+	require.NoError(t, fs.Chmod(filepath.Join(root, testFileTxt), 0o640))
+	require.NoError(t, fs.Chmod(filepath.Join(root, testDirFile), 0o755))
+
+	recordedModes := func() map[string]uint32 {
+		modes := map[string]uint32{}
+		for _, f := range manifestFiles(t, fs, manifestPath) {
+			modes[f.GetPath()] = f.GetMode()
+		}
+
+		return modes
+	}
+
+	opts := testOpts([]string{
+		testApp, cmdFreshen, "-q", "--" + flagIncludePermissions,
+		testFlagBase, root, manifestPath,
+	}, fs)
+	require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
+	assert.Equal(t, map[string]uint32{testFileTxt: 0o640, testDirFile: 0o755},
+		recordedModes())
+
+	runFreshen(t, fs, root, manifestPath)
+	assert.Equal(t, map[string]uint32{testFileTxt: 0, testDirFile: 0},
+		recordedModes())
+}
+
 // assertManifestLists asserts that the manifest at manifestPath lists
 // exactly the files in want, each with the size and SHA-256 hash of its
 // content in want and the mtime of the file of that name under root.

internal/cli/gen.go

@@ -1,6 +1,7 @@
 package cli
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -12,7 +13,7 @@ import (
 
 	"github.com/dustin/go-humanize"
 	"github.com/spf13/afero"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 	"sneak.berlin/go/mfer/internal/log"
 	"sneak.berlin/go/mfer/mfer"
 )
@@ -88,27 +89,28 @@ func (mfa *CLIApp) collectInputPaths(args cli.Args) ([]string, error) {
 }
 
 // buildScannerOptions constructs scanner options from the CLI flags.
-func (mfa *CLIApp) buildScannerOptions(ctx *cli.Context) *mfer.ScannerOptions {
+func (mfa *CLIApp) buildScannerOptions(cmd *cli.Command) *mfer.ScannerOptions {
-	output := ctx.String("output")
+	output := cmd.String("output")
 	opts := &mfer.ScannerOptions{
-		IncludeDotfiles:   ctx.Bool("include-dotfiles"),
+		IncludeDotfiles:    cmd.Bool("include-dotfiles"),
-		FollowSymLinks:    ctx.Bool("follow-symlinks"),
+		FollowSymLinks:     cmd.Bool("follow-symlinks"),
-		IncludeTimestamps: ctx.Bool("include-timestamps"),
+		IncludeTimestamps:  cmd.Bool("include-timestamps"),
-		Fs:                mfa.Fs,
+		IncludePermissions: cmd.Bool(flagIncludePermissions),
+		Fs:                 mfa.Fs,
 		// Neither a manifest being replaced nor a temp file left by an
 		// interrupted run belongs in the new manifest.
 		ExcludePaths: []string{output, manifestTempPath(output)},
 	}
 
 	// Set seed for deterministic UUID if provided
-	if seed := ctx.String("seed"); seed != "" {
+	if seed := cmd.String("seed"); seed != "" {
 		opts.Seed = seed
 
 		log.Infof("using deterministic seed for manifest UUID")
 	}
 
 	// Set up signing options if sign-key is provided
-	if signKey := ctx.String("sign-key"); signKey != "" {
+	if signKey := cmd.String("sign-key"); signKey != "" {
 		opts.SigningOptions = &mfer.SigningOptions{
 			KeyID: mfer.GPGKeyID(signKey),
 		}
@@ -173,14 +175,14 @@ func (mfa *CLIApp) cleanupOnSignal(outFile afero.File, tmpPath string) chan os.S
 
 // runEnumeratePhase enumerates all input paths with optional progress
 // reporting and logs the totals.
-func (mfa *CLIApp) runEnumeratePhase(ctx *cli.Context, s *mfer.Scanner) error {
+func (mfa *CLIApp) runEnumeratePhase(cmd *cli.Command, s *mfer.Scanner) error {
 	// Set up enumeration progress reporting
 	var (
 		enumProgress chan mfer.EnumerateStatus
 		enumWg       sync.WaitGroup
 	)
 
-	if ctx.Bool("progress") {
+	if cmd.Bool("progress") {
 		enumProgress = make(chan mfer.EnumerateStatus, 1)
 
 		enumWg.Add(1)
@@ -188,7 +190,7 @@ func (mfa *CLIApp) runEnumeratePhase(ctx *cli.Context, s *mfer.Scanner) error {
 		go reportEnumProgress(enumProgress, &enumWg)
 	}
 
-	err := mfa.enumerateInputs(s, ctx.Args(), enumProgress)
+	err := mfa.enumerateInputs(s, cmd.Args(), enumProgress)
 	if err != nil {
 		return err
 	}
@@ -201,22 +203,24 @@ func (mfa *CLIApp) runEnumeratePhase(ctx *cli.Context, s *mfer.Scanner) error {
 	return nil
 }
 
-func (mfa *CLIApp) generateManifestOperation(ctx *cli.Context) error {
+func (mfa *CLIApp) generateManifestOperation(
+	ctx context.Context, cmd *cli.Command,
+) error {
 	log.Debug("generateManifestOperation()")
 
-	s := mfer.NewScannerWithOptions(mfa.buildScannerOptions(ctx))
+	s := mfer.NewScannerWithOptions(mfa.buildScannerOptions(cmd))
 
 	// Phase 1: Enumeration - collect paths and stat files
-	err := mfa.runEnumeratePhase(ctx, s)
+	err := mfa.runEnumeratePhase(cmd, s)
 	if err != nil {
 		return err
 	}
 
-	showProgress := ctx.Bool("progress")
+	showProgress := cmd.Bool("progress")
 
 	// Check if output file exists
-	outputPath := ctx.String("output")
+	outputPath := cmd.String("output")
-	if exists, _ := afero.Exists(mfa.Fs, outputPath); exists && !ctx.Bool("force") {
+	if exists, _ := afero.Exists(mfa.Fs, outputPath); exists && !cmd.Bool("force") {
 		return fmt.Errorf("output file %s %w", outputPath, errOutputExists)
 	}
 
@@ -259,7 +263,7 @@ func (mfa *CLIApp) generateManifestOperation(ctx *cli.Context) error {
 		go reportScanProgress(scanProgress, &scanWg)
 	}
 
-	err = s.ToManifest(ctx.Context, outFile, scanProgress)
+	err = s.ToManifest(ctx, outFile, scanProgress)
 
 	scanWg.Wait()
 

internal/cli/list.go

@@ -1,33 +1,35 @@
 package cli
 
 import (
+	"context"
 	"fmt"
 	"time"
 
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 	"sneak.berlin/go/mfer/internal/log"
 	"sneak.berlin/go/mfer/mfer"
 )
 
-func (mfa *CLIApp) listManifestOperation(ctx *cli.Context) error {
+func (mfa *CLIApp) listManifestOperation(ctx context.Context, cmd *cli.Command) error {
 	// Default to ErrorLevel for clean output
 	log.SetLevel(log.ErrorLevel)
 
-	longFormat := ctx.Bool("long")
+	longFormat := cmd.Bool("long")
-	print0 := ctx.Bool("print0")
+	print0 := cmd.Bool("print0")
 
-	pathOrURL, err := mfa.resolveManifestArg(ctx)
+	pathOrURL, err := mfa.resolveManifestArg(cmd)
 	if err != nil {
 		return fmt.Errorf("list: %w", err)
 	}
 
-	rc, err := mfa.openManifestReader(pathOrURL)
+	rc, err := mfa.openManifestReader(ctx, pathOrURL)
 	if err != nil {
 		return fmt.Errorf("list: %w", err)
 	}
 
 	defer func() { _ = rc.Close() }()
 
+	//nolint:contextcheck // mfer loads a manifest without a context
 	manifest, err := mfer.NewManifestFromReader(rc)
 	if err != nil {
 		return fmt.Errorf("list: failed to parse manifest: %w", err)
@@ -50,8 +52,8 @@ func (mfa *CLIApp) listManifestOperation(ctx *cli.Context) error {
 				mtimeStr = mtime.Format(time.RFC3339)
 			}
 
-			_, _ = fmt.Fprintf(mfa.Stdout, "%d\t%s\t%s%s",
+			_, _ = fmt.Fprintf(mfa.Stdout, "%04o\t%d\t%s\t%s%s",
-				f.GetSize(), mtimeStr, f.GetPath(), lineEnd)
+				f.GetMode(), f.GetSize(), mtimeStr, f.GetPath(), lineEnd)
 		} else {
 			_, _ = fmt.Fprintf(mfa.Stdout, "%s%s", f.GetPath(), lineEnd)
 		}

internal/cli/manifest_loader.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 )
 
 // manifestFetchTimeout bounds HTTP requests made to fetch a manifest.
@@ -30,13 +30,13 @@ func isHTTPURL(s string) bool {
 
 // openManifestReader opens a manifest from a path or URL and returns a ReadCloser.
 // The caller must close the returned reader.
-func (mfa *CLIApp) openManifestReader(pathOrURL string) (io.ReadCloser, error) {
+func (mfa *CLIApp) openManifestReader(
+	ctx context.Context, pathOrURL string,
+) (io.ReadCloser, error) {
 	if isHTTPURL(pathOrURL) {
 		client := &http.Client{Timeout: manifestFetchTimeout}
 
-		req, err := http.NewRequestWithContext(
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, pathOrURL, nil)
-			context.Background(), http.MethodGet, pathOrURL, nil,
-		)
 		if err != nil {
 			return nil, fmt.Errorf("failed to fetch %s: %w", pathOrURL, err)
 		}
@@ -67,9 +67,9 @@ func (mfa *CLIApp) openManifestReader(pathOrURL string) (io.ReadCloser, error) {
 // resolveManifestArg resolves the manifest path from CLI arguments.
 // HTTP(S) URLs are returned as-is. Directories are searched for index.mf.
 // If no argument is given, the current directory is searched.
-func (mfa *CLIApp) resolveManifestArg(ctx *cli.Context) (string, error) {
+func (mfa *CLIApp) resolveManifestArg(cmd *cli.Command) (string, error) {
-	if ctx.Args().Len() > 0 {
+	if cmd.Args().Len() > 0 {
-		arg := ctx.Args().Get(0)
+		arg := cmd.Args().Get(0)
 		if isHTTPURL(arg) {
 			return arg, nil
 		}

internal/cli/mfer.go

@@ -1,6 +1,7 @@
 package cli
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"io"
@@ -8,7 +9,7 @@ import (
 	"time"
 
 	"github.com/spf13/afero"
-	"github.com/urfave/cli/v2"
+	"github.com/urfave/cli/v3"
 	"sneak.berlin/go/mfer/internal/log"
 	"sneak.berlin/go/mfer/mfer"
 )
@@ -20,12 +21,14 @@ const (
 	cmdFreshen  = "freshen"
 	cmdExport   = "export"
 	cmdFetch    = "fetch"
+	cmdList     = "list"
 	cmdVersion  = "version"
 
-	flagProgress         = "progress"
+	flagProgress           = "progress"
-	flagTimeout          = "timeout"
+	flagTimeout            = "timeout"
-	flagDest             = "dest"
+	flagDest               = "dest"
-	flagRequireSignature = "require-signature"
+	flagRequireSignature   = "require-signature"
+	flagIncludePermissions = "include-permissions"
 
 	manifestArgsUsage = "[manifest file]"
 
@@ -54,7 +57,7 @@ type CLIApp struct {
 	gitrev      string
 	startupTime time.Time
 	exitCode    int
-	app         *cli.App
+	app         *cli.Command
 
 	Stdin  io.Reader // Standard input stream
 	Stdout io.Writer // Standard output stream for normal output
@@ -105,15 +108,15 @@ func (mfa *CLIApp) printBanner() {
 // urfave/cli reads a flag from the nearest command that defines it, so each
 // command in the lineage is asked. The highest -v count wins rather than the
 // sum, because a subcommand without its own copies reads the root's.
-func (mfa *CLIApp) setVerbosity(c *cli.Context) {
+func (mfa *CLIApp) setVerbosity(cmd *cli.Command) {
 	_, present := os.LookupEnv("MFER_DEBUG")
 
 	verbosity := 0
 	quiet := false
 
-	for _, ctx := range c.Lineage() {
+	for _, c := range cmd.Lineage() {
-		verbosity = max(verbosity, ctx.Count("verbose"))
+		verbosity = max(verbosity, c.Count("verbose"))
-		quiet = quiet || ctx.Bool("quiet")
+		quiet = quiet || c.Bool("quiet")
 	}
 
 	switch {
@@ -127,23 +130,34 @@ func (mfa *CLIApp) setVerbosity(c *cli.Context) {
 }
 
 // commonFlags returns the -v and -q flags taken by the root and by the
-// generate, check, freshen and fetch subcommands.
+// generate, check, freshen and fetch subcommands. They are local, so the
+// root's copies are not inherited by the subcommands that do not take them.
 func commonFlags() []cli.Flag {
 	return []cli.Flag{
 		&cli.BoolFlag{
 			Name:    "verbose",
 			Aliases: []string{"v"},
 			Usage:   "Increase verbosity (-v for verbose, -v -v for debug)",
-			Count:   new(int),
+			Local:   true,
 		},
 		&cli.BoolFlag{
 			Name:    "quiet",
 			Aliases: []string{"q"},
 			Usage:   "Suppress output except errors",
+			Local:   true,
 		},
 	}
 }
 
+// stopOnFirstArg returns the StopOnNthArg setting every command uses: flags
+// are read only before the command's first argument, and everything after it
+// is an argument, as with urfave/cli v2. So `mfer gen d -v` names a path "-v".
+func stopOnFirstArg() *int {
+	n := 1
+
+	return &n
+}
+
 // requireSignatureFlag returns the --require-signature flag taken by the
 // check and fetch subcommands.
 func requireSignatureFlag() *cli.StringFlag {
@@ -151,21 +165,32 @@ func requireSignatureFlag() *cli.StringFlag {
 		Name:    flagRequireSignature,
 		Aliases: []string{"S"},
 		Usage:   "Require manifest to be signed by the specified GPG key ID",
-		EnvVars: []string{"MFER_REQUIRE_SIGNATURE"},
+		Sources: cli.EnvVars("MFER_REQUIRE_SIGNATURE"),
+	}
+}
+
+// includePermissionsFlag returns the --include-permissions flag taken by the
+// generate and freshen subcommands.
+func includePermissionsFlag() *cli.BoolFlag {
+	return &cli.BoolFlag{
+		Name: flagIncludePermissions,
+		Usage: "Record each file's permission bits in manifest " +
+			"(recorded as 0000 by default)",
 	}
 }
 
 func (mfa *CLIApp) generateCommand() *cli.Command {
 	return &cli.Command{
-		Name:      cmdGenerate,
+		Name:         cmdGenerate,
-		Aliases:   []string{"gen"},
+		Aliases:      []string{"gen"},
-		Usage:     "Generate manifest file",
+		Usage:        "Generate manifest file",
-		ArgsUsage: "[path ...]",
+		ArgsUsage:    "[path ...]",
-		Action: func(c *cli.Context) error {
+		StopOnNthArg: stopOnFirstArg(),
-			mfa.setVerbosity(c)
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			mfa.setVerbosity(cmd)
 			mfa.printBanner()
 
-			return mfa.generateManifestOperation(c)
+			return mfa.generateManifestOperation(ctx, cmd)
 		},
 		Flags: append(commonFlags(),
 			&cli.BoolFlag{
@@ -199,32 +224,34 @@ func (mfa *CLIApp) generateCommand() *cli.Command {
 				Name:    "sign-key",
 				Aliases: []string{"s"},
 				Usage:   "GPG key ID to sign the manifest with",
-				EnvVars: []string{"MFER_SIGN_KEY"},
+				Sources: cli.EnvVars("MFER_SIGN_KEY"),
 			},
 			&cli.StringFlag{
 				Name:    "seed",
 				Usage:   "Seed value for deterministic manifest UUID",
-				EnvVars: []string{"MFER_SEED"},
+				Sources: cli.EnvVars("MFER_SEED"),
 			},
 			&cli.BoolFlag{
 				Name: "include-timestamps",
 				Usage: "Include createdAt timestamp in manifest " +
 					"(omitted by default for determinism)",
 			},
+			includePermissionsFlag(),
 		),
 	}
 }
 
 func (mfa *CLIApp) checkCommand() *cli.Command {
 	return &cli.Command{
-		Name:      cmdCheck,
+		Name:         cmdCheck,
-		Usage:     "Validate files using manifest file",
+		Usage:        "Validate files using manifest file",
-		ArgsUsage: manifestArgsUsage,
+		ArgsUsage:    manifestArgsUsage,
-		Action: func(c *cli.Context) error {
+		StopOnNthArg: stopOnFirstArg(),
-			mfa.setVerbosity(c)
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			mfa.setVerbosity(cmd)
 			mfa.printBanner()
 
-			return mfa.checkManifestOperation(c)
+			return mfa.checkManifestOperation(ctx, cmd)
 		},
 		Flags: append(commonFlags(),
 			&cli.StringFlag{
@@ -249,14 +276,15 @@ func (mfa *CLIApp) checkCommand() *cli.Command {
 
 func (mfa *CLIApp) freshenCommand() *cli.Command {
 	return &cli.Command{
-		Name:      cmdFreshen,
+		Name:         cmdFreshen,
-		Usage:     "Update manifest with changed, new, and removed files",
+		Usage:        "Update manifest with changed, new, and removed files",
-		ArgsUsage: manifestArgsUsage,
+		ArgsUsage:    manifestArgsUsage,
-		Action: func(c *cli.Context) error {
+		StopOnNthArg: stopOnFirstArg(),
-			mfa.setVerbosity(c)
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			mfa.setVerbosity(cmd)
 			mfa.printBanner()
 
-			return mfa.freshenManifestOperation(c)
+			return mfa.freshenManifestOperation(ctx, cmd)
 		},
 		Flags: append(commonFlags(),
 			&cli.StringFlag{
@@ -285,35 +313,38 @@ func (mfa *CLIApp) freshenCommand() *cli.Command {
 				Name:    "sign-key",
 				Aliases: []string{"s"},
 				Usage:   "GPG key ID to sign the manifest with",
-				EnvVars: []string{"MFER_SIGN_KEY"},
+				Sources: cli.EnvVars("MFER_SIGN_KEY"),
 			},
 			&cli.BoolFlag{
 				Name: "include-timestamps",
 				Usage: "Include createdAt timestamp in manifest " +
 					"(omitted by default for determinism)",
 			},
+			includePermissionsFlag(),
 		),
 	}
 }
 
 func (mfa *CLIApp) exportCommand() *cli.Command {
 	return &cli.Command{
-		Name:      cmdExport,
+		Name:         cmdExport,
-		Usage:     "Export manifest contents as JSON",
+		Usage:        "Export manifest contents as JSON",
-		ArgsUsage: "[manifest file or URL]",
+		ArgsUsage:    "[manifest file or URL]",
-		Action: func(c *cli.Context) error {
+		StopOnNthArg: stopOnFirstArg(),
-			mfa.setVerbosity(c)
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			mfa.setVerbosity(cmd)
 
-			return mfa.exportManifestOperation(c)
+			return mfa.exportManifestOperation(ctx, cmd)
 		},
 	}
 }
 
 func (mfa *CLIApp) versionCommand() *cli.Command {
 	return &cli.Command{
-		Name:  cmdVersion,
+		Name:         cmdVersion,
-		Usage: "Show version",
+		Usage:        "Show version",
-		Action: func(_ *cli.Context) error {
+		StopOnNthArg: stopOnFirstArg(),
+		Action: func(context.Context, *cli.Command) error {
 			mfa.printVersion()
 
 			return nil
@@ -323,18 +354,17 @@ func (mfa *CLIApp) versionCommand() *cli.Command {
 
 func (mfa *CLIApp) listCommand() *cli.Command {
 	return &cli.Command{
-		Name:      "list",
+		Name:         cmdList,
-		Aliases:   []string{"ls"},
+		Aliases:      []string{"ls"},
-		Usage:     "List files in manifest",
+		Usage:        "List files in manifest",
-		ArgsUsage: manifestArgsUsage,
+		ArgsUsage:    manifestArgsUsage,
-		Action: func(c *cli.Context) error {
+		StopOnNthArg: stopOnFirstArg(),
-			return mfa.listManifestOperation(c)
+		Action:       mfa.listManifestOperation,
-		},
 		Flags: []cli.Flag{
 			&cli.BoolFlag{
 				Name:    "long",
 				Aliases: []string{"l"},
-				Usage:   "Show size and mtime",
+				Usage:   "Show mode, size and mtime",
 			},
 			&cli.BoolFlag{
 				Name:  "print0",
@@ -346,14 +376,15 @@ func (mfa *CLIApp) listCommand() *cli.Command {
 
 func (mfa *CLIApp) fetchCommand() *cli.Command {
 	return &cli.Command{
-		Name:      cmdFetch,
+		Name:         cmdFetch,
-		Usage:     "fetch manifest and referenced files",
+		Usage:        "fetch manifest and referenced files",
-		ArgsUsage: "URL",
+		ArgsUsage:    "URL",
-		Action: func(c *cli.Context) error {
+		StopOnNthArg: stopOnFirstArg(),
-			mfa.setVerbosity(c)
+		Action: func(ctx context.Context, cmd *cli.Command) error {
+			mfa.setVerbosity(cmd)
 			mfa.printBanner()
 
-			return mfa.fetchManifestOperation(c)
+			return mfa.fetchManifestOperation(ctx, cmd)
 		},
 		Flags: append(commonFlags(),
 			&cli.DurationFlag{
@@ -385,38 +416,40 @@ func (mfa *CLIApp) run(args []string) {
 	log.SetOutput(mfa.Stdout, mfa.Stderr)
 	log.Init()
 
-	// -v means verbose, not version. urfave/cli's built-in version flag
+	// -v means verbose, not version, at the root as on the generate, check,
-	// claims -v by default, which made "mfer -v --version" fail to parse and
+	// freshen and fetch subcommands: verbose is the more common meaning of -v
-	// gave -v a different meaning at the root than on the generate, check,
+	// in tools that offer both. urfave/cli's built-in version flag claims -v
-	// freshen and fetch subcommands, where it means verbose. Verbose is the
+	// by default, so the version flag takes the capital -V instead.
-	// more common meaning of -v in tools that offer both, so -v means verbose
-	// at the root too and the version flag takes the capital -V.
 	// VersionFlag and VersionPrinter are urfave/cli package globals; run() is
 	// serialized in tests, so assigning them here is safe.
 	cli.VersionFlag = &cli.BoolFlag{
 		Name:    cmdVersion,
 		Aliases: []string{"V"},
 		Usage:   "print the version",
+		Local:   true,
 	}
-	cli.VersionPrinter = func(_ *cli.Context) { mfa.printVersion() }
+	cli.VersionPrinter = func(*cli.Command) { mfa.printVersion() }
 
-	mfa.app = &cli.App{
+	mfa.app = &cli.Command{
-		Name:                 mfa.appname,
+		Name:                  mfa.appname,
-		Usage:                "Manifest generator",
+		Usage:                 "Manifest generator",
-		Version:              mfa.VersionString(),
+		Version:               mfa.VersionString(),
-		EnableBashCompletion: true,
+		EnableShellCompletion: true,
-		Writer:               mfa.Stdout,
+		Writer:                mfa.Stdout,
-		ErrWriter:            mfa.Stderr,
+		// v3 writes its "Incorrect Usage" line to ErrWriter; v2 wrote it to
-		Flags:                commonFlags(),
+		// stdout, before the help, so it stays on stdout.
-		Action: func(c *cli.Context) error {
+		ErrWriter:    mfa.Stdout,
-			if c.Args().Len() > 0 {
+		Flags:        commonFlags(),
-				return fmt.Errorf("%w %q", errUnknownCommand, c.Args().First())
+		StopOnNthArg: stopOnFirstArg(),
+		Action: func(_ context.Context, cmd *cli.Command) error {
+			if cmd.Args().Len() > 0 {
+				return fmt.Errorf("%w %q", errUnknownCommand, cmd.Args().First())
 			}
 
-			mfa.setVerbosity(c)
+			mfa.setVerbosity(cmd)
 			mfa.printBanner()
 
-			return cli.ShowAppHelp(c)
+			return cli.ShowRootCommandHelp(cmd)
 		},
 		Commands: []*cli.Command{
 			mfa.generateCommand(),
@@ -431,7 +464,7 @@ func (mfa *CLIApp) run(args []string) {
 
 	mfa.app.HideVersion = false
 
-	err := mfa.app.Run(args)
+	err := mfa.app.Run(context.Background(), args)
 	if err != nil {
 		mfa.exitCode = 1
 

mfer/builder.go

@@ -8,6 +8,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"sort"
 	"strings"
 	"sync"
@@ -63,7 +64,7 @@ func ValidatePath(p string) error {
 		return fmt.Errorf("path %q %w", p, errPathAbsolute)
 	}
 
-	for _, seg := range strings.Split(p, "/") {
+	for seg := range strings.SplitSeq(p, "/") {
 		if seg == "" {
 			return fmt.Errorf("path %q %w", p, errPathEmptySegment)
 		}
@@ -137,12 +138,14 @@ func (b *Builder) SetSeed(seed string) {
 }
 
 // AddFile reads file content from reader, computes hashes, and adds to manifest.
+// Only mode's permission bits (mode.Perm()) are recorded; 0 records none.
 // Progress updates are sent to the progress channel (if non-nil) without blocking.
 // Returns the number of bytes read.
 func (b *Builder) AddFile(
 	path RelFilePath,
 	size FileSize,
 	mtime ModTime,
+	mode fs.FileMode,
 	reader io.Reader,
 	progress chan<- FileHashProgress,
 ) (FileSize, error) {
@@ -198,6 +201,7 @@ func (b *Builder) AddFile(
 			{MultiHash: mh},
 		},
 		Mtime: mtime.Timestamp(),
+		Mode:  uint32(mode.Perm()),
 	}
 
 	b.mu.Lock()
@@ -229,12 +233,14 @@ func (b *Builder) FileCount() int {
 
 // AddFileWithHash adds a file entry with a pre-computed hash.
 // This is useful when the hash is already known (e.g., from an existing manifest).
+// Only mode's permission bits (mode.Perm()) are recorded; 0 records none.
 // Returns an error if path is invalid, size is negative, or hash is not a
 // multihash with a digest of at least 32 bytes, as long as SHA-256's.
 func (b *Builder) AddFileWithHash(
 	path RelFilePath,
 	size FileSize,
 	mtime ModTime,
+	mode fs.FileMode,
 	hash Multihash,
 ) error {
 	err := ValidatePath(string(path))
@@ -268,6 +274,7 @@ func (b *Builder) AddFileWithHash(
 			{MultiHash: hash},
 		},
 		Mtime: mtime.Timestamp(),
+		Mode:  uint32(mode.Perm()),
 	}
 
 	b.mu.Lock()

mfer/builder_test.go

@@ -35,7 +35,7 @@ func TestBuilderAddFile(t *testing.T) {
 	reader := bytes.NewReader(content)
 
 	bytesRead, err := b.AddFile(
-		"test.txt", FileSize(len(content)), ModTime(time.Now()), reader, nil,
+		"test.txt", FileSize(len(content)), ModTime(time.Now()), 0, reader, nil,
 	)
 	require.NoError(t, err)
 	assert.Equal(t, FileSize(len(content)), bytesRead)
@@ -49,7 +49,7 @@ func TestBuilderAddFileWithHash(t *testing.T) {
 	hash, err := multihash.Encode(make([]byte, sha256.Size), multihash.SHA2_256)
 	require.NoError(t, err)
 
-	err = b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), hash)
+	err = b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), 0, hash)
 	require.NoError(t, err)
 	assert.Equal(t, 1, b.FileCount())
 }
@@ -64,7 +64,7 @@ func TestBuilderAddFileWithHashValidation(t *testing.T) {
 		t.Parallel()
 
 		b := NewBuilder()
-		err := b.AddFileWithHash("", 100, ModTime(time.Now()), sha256Hash)
+		err := b.AddFileWithHash("", 100, ModTime(time.Now()), 0, sha256Hash)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "path")
 	})
@@ -73,7 +73,7 @@ func TestBuilderAddFileWithHashValidation(t *testing.T) {
 		t.Parallel()
 
 		b := NewBuilder()
-		err := b.AddFileWithHash("test.txt", -1, ModTime(time.Now()), sha256Hash)
+		err := b.AddFileWithHash("test.txt", -1, ModTime(time.Now()), 0, sha256Hash)
 		require.Error(t, err)
 		assert.Contains(t, err.Error(), "size")
 	})
@@ -82,7 +82,7 @@ func TestBuilderAddFileWithHashValidation(t *testing.T) {
 		t.Parallel()
 
 		b := NewBuilder()
-		err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), sha256Hash)
+		err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), 0, sha256Hash)
 		require.NoError(t, err)
 		assert.Equal(t, 1, b.FileCount())
 	})
@@ -118,7 +118,7 @@ func TestBuilderAddFileWithHashRejectsBadHashes(t *testing.T) {
 			t.Parallel()
 
 			b := NewBuilder()
-			err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), tt.hash)
+			err := b.AddFileWithHash("test.txt", 100, ModTime(time.Now()), 0, tt.hash)
 			require.ErrorIs(t, err, tt.want)
 			assert.Equal(t, 0, b.FileCount())
 		})
@@ -133,7 +133,7 @@ func TestBuilderBuild(t *testing.T) {
 	reader := bytes.NewReader(content)
 
 	_, err := b.AddFile(
-		"test.txt", FileSize(len(content)), ModTime(time.Now()), reader, nil,
+		"test.txt", FileSize(len(content)), ModTime(time.Now()), 0, reader, nil,
 	)
 	require.NoError(t, err)
 
@@ -196,7 +196,7 @@ func TestBuilderDeterministicOutput(t *testing.T) {
 		for _, f := range files {
 			r := bytes.NewReader([]byte(f.content))
 			_, err := b.AddFile(
-				RelFilePath(f.path), FileSize(len(f.content)), mtime, r, nil,
+				RelFilePath(f.path), FileSize(len(f.content)), mtime, 0, r, nil,
 			)
 			require.NoError(t, err)
 		}
@@ -279,7 +279,7 @@ func TestBuilderAddFileSizeMismatch(t *testing.T) {
 	reader := bytes.NewReader(content)
 
 	// Declare wrong size
-	_, err := b.AddFile("test.txt", FileSize(100), ModTime(time.Now()), reader, nil)
+	_, err := b.AddFile("test.txt", FileSize(100), ModTime(time.Now()), 0, reader, nil)
 	require.Error(t, err)
 	assert.Contains(t, err.Error(), "size mismatch")
 }
@@ -291,12 +291,12 @@ func TestBuilderAddFileInvalidPath(t *testing.T) {
 	content := []byte("data")
 	reader := bytes.NewReader(content)
 
-	_, err := b.AddFile("", FileSize(len(content)), ModTime(time.Now()), reader, nil)
+	_, err := b.AddFile("", FileSize(len(content)), ModTime(time.Now()), 0, reader, nil)
 	require.Error(t, err)
 
 	reader.Reset(content)
 	_, err = b.AddFile(
-		"/absolute", FileSize(len(content)), ModTime(time.Now()), reader, nil,
+		"/absolute", FileSize(len(content)), ModTime(time.Now()), 0, reader, nil,
 	)
 	assert.Error(t, err)
 }
@@ -310,7 +310,7 @@ func TestBuilderAddFileWithProgress(t *testing.T) {
 	progress := make(chan FileHashProgress, 100)
 
 	bytesRead, err := b.AddFile(
-		"test.txt", FileSize(len(content)), ModTime(time.Now()), reader, progress,
+		"test.txt", FileSize(len(content)), ModTime(time.Now()), 0, reader, progress,
 	)
 	close(progress)
 	require.NoError(t, err)
@@ -345,7 +345,7 @@ func TestBuilderBuildRoundTrip(t *testing.T) {
 	for _, f := range files {
 		reader := bytes.NewReader(f.content)
 		_, err := b.AddFile(
-			RelFilePath(f.path), FileSize(len(f.content)), ModTime(now), reader, nil,
+			RelFilePath(f.path), FileSize(len(f.content)), ModTime(now), 0, reader, nil,
 		)
 		require.NoError(t, err)
 	}
@@ -387,7 +387,7 @@ func TestBuilderBuildRoundTripLargeManifest(t *testing.T) {
 
 	for i := range 4000 {
 		path := RelFilePath(fmt.Sprintf("dir/file-%05d.txt", i))
-		require.NoError(t, b.AddFileWithHash(path, FileSize(i), ModTime{}, hash))
+		require.NoError(t, b.AddFileWithHash(path, FileSize(i), ModTime{}, 0, hash))
 	}
 
 	var buf bytes.Buffer
@@ -452,7 +452,7 @@ func TestManifestString(t *testing.T) {
 	content := []byte("test")
 	reader := bytes.NewReader(content)
 	_, err := b.AddFile(
-		"test.txt", FileSize(len(content)), ModTime(time.Now()), reader, nil,
+		"test.txt", FileSize(len(content)), ModTime(time.Now()), 0, reader, nil,
 	)
 	require.NoError(t, err)
 
@@ -484,7 +484,7 @@ func TestBuilderOmitsCreatedAtByDefault(t *testing.T) {
 	b := NewBuilder()
 	content := []byte("hello")
 	_, err := b.AddFile(
-		"test.txt", FileSize(len(content)), ModTime(time.Now()),
+		"test.txt", FileSize(len(content)), ModTime(time.Now()), 0,
 		bytes.NewReader(content), nil,
 	)
 	require.NoError(t, err)
@@ -506,7 +506,7 @@ func TestBuilderIncludesCreatedAtWhenRequested(t *testing.T) {
 
 	content := []byte("hello")
 	_, err := b.AddFile(
-		"test.txt", FileSize(len(content)), ModTime(time.Now()),
+		"test.txt", FileSize(len(content)), ModTime(time.Now()), 0,
 		bytes.NewReader(content), nil,
 	)
 	require.NoError(t, err)
@@ -532,7 +532,7 @@ func TestBuilderDeterministicFileOrder(t *testing.T) {
 			content := []byte("content of " + name)
 			_, err := b.AddFile(
 				RelFilePath(name), FileSize(len(content)),
-				ModTime(time.Unix(1000, 0)), bytes.NewReader(content), nil,
+				ModTime(time.Unix(1000, 0)), 0, bytes.NewReader(content), nil,
 			)
 			require.NoError(t, err)
 		}

mfer/checker.go

@@ -36,6 +36,7 @@ const (
 	StatusMissing                    // File not found on disk
 	StatusSizeMismatch               // File size differs from manifest
 	StatusHashMismatch               // File hash differs from manifest
+	StatusModeMismatch               // File permission bits differ from a recorded mode
 	StatusExtra                      // File exists on disk but not in manifest
 	StatusError                      // Error occurred during verification
 )
@@ -50,6 +51,8 @@ func (s Status) String() string {
 		return "SIZE_MISMATCH"
 	case StatusHashMismatch:
 		return "HASH_MISMATCH"
+	case StatusModeMismatch:
+		return "MODE_MISMATCH"
 	case StatusExtra:
 		return "EXTRA"
 	case StatusError:
@@ -408,11 +411,22 @@ func (c *Checker) checkFile(entry *MFFilePath, checkedBytes *FileSize) Result {
 		return Result{Path: relPath, Status: StatusError, Message: err.Error()}
 	}
 
-	// Check against all hashes in manifest (at least one must match)
+	// Check against all hashes in manifest (at least one must match),
+	// then against the recorded mode, where one is: 0 means none was.
 	for _, hash := range entry.GetHashes() {
-		if bytes.Equal(computed, hash.GetMultiHash()) {
+		if !bytes.Equal(computed, hash.GetMultiHash()) {
-			return Result{Path: relPath, Status: StatusOK}
+			continue
 		}
+
+		if entry.GetMode() != 0 && info.Mode().Perm() != os.FileMode(entry.GetMode()) {
+			return Result{
+				Path:    relPath,
+				Status:  StatusModeMismatch,
+				Message: "mode mismatch",
+			}
+		}
+
+		return Result{Path: relPath, Status: StatusOK}
 	}
 
 	return Result{

mfer/checker_test.go

@@ -34,6 +34,7 @@ func TestStatusString(t *testing.T) {
 		{StatusMissing, "MISSING"},
 		{StatusSizeMismatch, "SIZE_MISMATCH"},
 		{StatusHashMismatch, "HASH_MISMATCH"},
+		{StatusModeMismatch, "MODE_MISMATCH"},
 		{StatusExtra, "EXTRA"},
 		{StatusError, "ERROR"},
 		{Status(99), "UNKNOWN"},
@@ -59,7 +60,7 @@ func createTestManifest(
 	for path, content := range files {
 		reader := bytes.NewReader(content)
 		_, err := builder.AddFile(
-			RelFilePath(path), FileSize(len(content)), ModTime(time.Now()), reader, nil,
+			RelFilePath(path), FileSize(len(content)), ModTime(time.Now()), 0, reader, nil,
 		)
 		require.NoError(t, err)
 	}
@@ -279,7 +280,8 @@ func TestCheckMissingFile(t *testing.T) {
 			missingCount++
 
 			assert.Equal(t, RelFilePath("missing.txt"), r.Path)
-		case StatusSizeMismatch, StatusHashMismatch, StatusExtra, StatusError:
+		case StatusSizeMismatch, StatusHashMismatch, StatusModeMismatch,
+			StatusExtra, StatusError:
 			// Not expected in this test; counted assertions below will fail.
 		}
 	}
@@ -349,6 +351,54 @@ func TestCheckHashMismatch(t *testing.T) {
 	assert.Equal(t, RelFilePath(testFileName), r.Path)
 }
 
+// A recorded mode other than 0000 that differs from the file's permission
+// bits fails the check; a recorded 0000 is never checked.
+func TestCheckMode(t *testing.T) {
+	t.Parallel()
+
+	for _, tc := range []struct {
+		name     string
+		recorded os.FileMode
+		onDisk   os.FileMode
+		want     Status
+	}{
+		{"recorded mode matches", 0o640, 0o640, StatusOK},
+		{"recorded mode differs", 0o640, 0o600, StatusModeMismatch},
+		{"0000 is not checked", 0, 0o600, StatusOK},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			fs := afero.NewMemMapFs()
+			content := []byte("content")
+
+			b := NewBuilder()
+			_, err := b.AddFile(testFileName, FileSize(len(content)), ModTime{},
+				tc.recorded, bytes.NewReader(content), nil)
+			require.NoError(t, err)
+
+			var buf bytes.Buffer
+			require.NoError(t, b.Build(context.Background(), &buf))
+			require.NoError(t, afero.WriteFile(fs, testManifestPath, buf.Bytes(), 0o644))
+			require.NoError(t, fs.MkdirAll(testDataDir, 0o755))
+			require.NoError(t, afero.WriteFile(fs,
+				testDataDir+"/"+testFileName, content, tc.onDisk))
+
+			chk, err := NewChecker(&CheckerOptions{
+				ManifestPath: testManifestPath,
+				BasePath:     testDataDir,
+				Fs:           fs,
+			})
+			require.NoError(t, err)
+
+			results := make(chan Result, 1)
+			require.NoError(t, chk.Check(context.Background(), results, nil))
+
+			assert.Equal(t, tc.want, (<-results).Status)
+		})
+	}
+}
+
 func TestCheckWithProgress(t *testing.T) {
 	t.Parallel()
 

mfer/constants.go

@@ -29,8 +29,8 @@ const (
 	// Bytes decoding sets aside for each file entry, hash, timestamp and
 	// MIME type, however short its encoding. checkDecodedSize refuses an
 	// inner message for which these add up to more than maxDecodedGrowth
-	// times its size.
+	// times its size. The mode is held in the file entry itself.
-	decodedFileEntrySize = 160
+	decodedFileEntrySize = 176
 	decodedHashSize      = 112
 	decodedTimestampSize = 64
 	decodedMIMETypeSize  = 16
@@ -38,7 +38,7 @@ const (
 	// Each file entry mfer writes holds a path of at least one byte, a
 	// multihash at least as long as SHA-256's 34 bytes (AddFileWithHash
 	// refuses shorter ones) and a modification time: at least 47 bytes,
-	// counted at 336. So its manifests add up to at most about 7.15 times
+	// counted at 352. So its manifests add up to at most about 7.49 times
-	// their size, and this limit is about 12% above that.
+	// their size, and this limit is about 7% above that.
 	maxDecodedGrowth = 8
 )

mfer/deserialize.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"io"
 
-	"github.com/google/uuid"
 	"github.com/klauspost/compress/zstd"
 	"github.com/spf13/afero"
 	"google.golang.org/protobuf/encoding/protowire"
@@ -19,7 +18,6 @@ import (
 
 var (
 	errInvalidUUIDLength    = errors.New("invalid UUID length")
-	errInvalidUUIDFormat    = errors.New("invalid UUID format")
 	errUnknownVersion       = errors.New("unknown version")
 	errUnknownCompression   = errors.New("unknown compression type")
 	errCompressedHashWrong  = errors.New("compressed data hash mismatch")
@@ -32,16 +30,12 @@ var (
 		"manifest would take too much memory to decode")
 )
 
-// validateUUID checks that the byte slice is a valid UUID (16 bytes, parseable).
+// validateUUID checks that the byte slice is the 16 bytes of a binary UUID.
+// Any 16 bytes are one, so the length is all there is to check.
 func validateUUID(data []byte) error {
 	if len(data) != uuidLength {
 		return errInvalidUUIDLength
 	}
-	// Try to parse as UUID to validate format
-	_, err := uuid.FromBytes(data)
-	if err != nil {
-		return errInvalidUUIDFormat
-	}
 
 	return nil
 }

mfer/deserialize_path_test.go

@@ -10,8 +10,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+	"uuid"
 
-	"github.com/google/uuid"
 	"github.com/klauspost/compress/zstd"
 	"github.com/multiformats/go-multihash"
 	"github.com/stretchr/testify/assert"
@@ -92,7 +92,7 @@ func TestDeserializeRejectsInvalidEntryPaths(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
-			id := uuid.New()
+			id := uuid.NewV4()
 			data := wrapInner(t, id, craftInnerBytes(id, tt.path))
 
 			_, err := NewManifestFromReader(bytes.NewReader(data))
@@ -119,11 +119,11 @@ func TestDeserializeRejectsInvalidEntryPaths(t *testing.T) {
 }
 
 // Entries of a path, an empty hash, an empty MIME type and empty modification
-// and change times are counted at 416 bytes each (160 + 112 + 16 + 64 + 64)
+// and change times are counted at 432 bytes each (176 + 112 + 16 + 64 + 64)
-// and take 16 bytes plus the path to encode. A 35-character path makes that
+// and take 16 bytes plus the path to encode. A 37-character path makes that
-// 51 bytes, about 8.2 times: refused, and leaving any one of the five
+// 53 bytes, about 8.2 times: refused, and leaving any one of the five
-// uncounted, even the MIME type, brings it under 8. A 37-character path makes
+// uncounted, even the MIME type, brings it under 8. A 39-character path makes
-// it 53 bytes, about 7.8 times: loaded.
+// it 55 bytes, about 7.9 times: loaded.
 func TestDeserializeRefusesEntriesThatDecodeTooLarge(t *testing.T) {
 	t.Parallel()
 
@@ -131,8 +131,8 @@ func TestDeserializeRefusesEntriesThatDecodeTooLarge(t *testing.T) {
 		pathLen int
 		refused bool
 	}{
-		{35, true},
+		{37, true},
-		{37, false},
+		{39, false},
 	}
 
 	for _, tt := range tests {
@@ -150,7 +150,7 @@ func TestDeserializeRefusesEntriesThatDecodeTooLarge(t *testing.T) {
 			entry = protowire.AppendTag(entry, 303, protowire.BytesType) // MFFilePath.ctime
 			entry = protowire.AppendBytes(entry, nil)
 
-			id := uuid.New()
+			id := uuid.NewV4()
 			inner := protowire.AppendTag(nil, 102, protowire.BytesType) // MFFile.uuid
 			inner = protowire.AppendBytes(inner, id[:])
 
@@ -181,7 +181,7 @@ func TestDeserializeDropsUnknownFields(t *testing.T) {
 	entry = protowire.AppendString(entry, "a")
 	entry = append(entry, unknown...)
 
-	id := uuid.New()
+	id := uuid.NewV4()
 	inner := protowire.AppendTag(nil, 101, protowire.BytesType) // MFFile.files
 	inner = protowire.AppendBytes(inner, entry)
 	inner = protowire.AppendTag(inner, 102, protowire.BytesType) // MFFile.uuid
@@ -215,7 +215,7 @@ func TestDeserializeLoadsDensestManifest(t *testing.T) {
 	const files = 10000
 	for i := range files {
 		name := RelFilePath(strconv.FormatInt(int64(i), 36))
-		require.NoError(t, b.AddFileWithHash(name, 0, ModTime(time.Unix(0, 0)), hash))
+		require.NoError(t, b.AddFileWithHash(name, 0, ModTime(time.Unix(0, 0)), 0, hash))
 	}
 
 	var buf bytes.Buffer
@@ -233,7 +233,7 @@ func TestDeserializeValidManifestRoundTrips(t *testing.T) {
 	require.NoError(t, err)
 
 	b := NewBuilder()
-	require.NoError(t, b.AddFileWithHash("dir/file.txt", 123, ModTime{}, hash))
+	require.NoError(t, b.AddFileWithHash("dir/file.txt", 123, ModTime{}, 0, hash))
 
 	var buf bytes.Buffer
 	require.NoError(t, b.Build(context.Background(), &buf))

mfer/gpg.go

@@ -125,7 +125,7 @@ func runGPG(
 // parseFingerprint extracts the first fingerprint from gpg --with-colons
 // output, or returns ok=false if none is present.
 func parseFingerprint(colonOutput string) (string, bool) {
-	for _, line := range strings.Split(colonOutput, "\n") {
+	for line := range strings.SplitSeq(colonOutput, "\n") {
 		fields := strings.Split(line, ":")
 		if len(fields) >= gpgFingerprintMinFields &&
 			fields[0] == gpgFingerprintField {

mfer/gpg_test.go

@@ -75,7 +75,7 @@ Expire-Date: 0
 	// Parse fingerprint from output
 	var keyID string
 
-	for _, line := range strings.Split(string(output), "\n") {
+	for line := range strings.SplitSeq(string(output), "\n") {
 		fields := strings.Split(line, ":")
 		if len(fields) >= gpgFingerprintMinFields &&
 			fields[0] == gpgFingerprintField {
@@ -187,7 +187,7 @@ func TestBuilderWithSigning(t *testing.T) {
 	// Add a test file
 	content := []byte("test file content")
 	reader := bytes.NewReader(content)
-	_, err := b.AddFile("test.txt", FileSize(len(content)), ModTime{}, reader, nil)
+	_, err := b.AddFile("test.txt", FileSize(len(content)), ModTime{}, 0, reader, nil)
 	require.NoError(t, err)
 
 	// Build the manifest
@@ -314,7 +314,7 @@ func TestManifestSignatureVerification(t *testing.T) {
 	// Add a test file
 	content := []byte("test file content for verification")
 	reader := bytes.NewReader(content)
-	_, err := b.AddFile("test.txt", FileSize(len(content)), ModTime{}, reader, nil)
+	_, err := b.AddFile("test.txt", FileSize(len(content)), ModTime{}, 0, reader, nil)
 	require.NoError(t, err)
 
 	// Build the manifest
@@ -344,7 +344,7 @@ func TestManifestTamperedSignatureFails(t *testing.T) {
 
 	content := []byte("test file content")
 	reader := bytes.NewReader(content)
-	_, err := b.AddFile("test.txt", FileSize(len(content)), ModTime{}, reader, nil)
+	_, err := b.AddFile("test.txt", FileSize(len(content)), ModTime{}, 0, reader, nil)
 	require.NoError(t, err)
 
 	var buf bytes.Buffer
@@ -377,7 +377,7 @@ func TestBuilderWithoutSigning(t *testing.T) {
 	// Add a test file
 	content := []byte("test file content")
 	reader := bytes.NewReader(content)
-	_, err := b.AddFile("test.txt", FileSize(len(content)), ModTime{}, reader, nil)
+	_, err := b.AddFile("test.txt", FileSize(len(content)), ModTime{}, 0, reader, nil)
 	require.NoError(t, err)
 
 	// Build the manifest

mfer/mf.go

@@ -1,3 +0,0 @@
-package mfer
-
-//go:generate protoc ./mf.proto --go_out=paths=source_relative:.

mfer/mf.pb.go

@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.36.11
+// 	protoc-gen-go v1.36.12
 // 	protoc        v6.33.4
 // source: mf.proto
 
@@ -223,11 +223,11 @@ type MFFileOuter struct {
 	// uuid must match the uuid in the inner message
 	Uuid         []byte `protobuf:"bytes,105,opt,name=uuid,proto3" json:"uuid,omitempty"`
 	InnerMessage []byte `protobuf:"bytes,199,opt,name=innerMessage,proto3" json:"innerMessage,omitempty"`
-	// detached signature, ascii or binary
+	//detached signature, ascii or binary
 	Signature []byte `protobuf:"bytes,201,opt,name=signature,proto3,oneof" json:"signature,omitempty"`
-	// full GPG key id
+	//full GPG key id
 	Signer []byte `protobuf:"bytes,202,opt,name=signer,proto3,oneof" json:"signer,omitempty"`
-	// full GPG signing public key, ascii or binary
+	//full GPG signing public key, ascii or binary
 	SigningPubKey []byte `protobuf:"bytes,203,opt,name=signingPubKey,proto3,oneof" json:"signingPubKey,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
@@ -337,9 +337,11 @@ type MFFilePath struct {
 	// gotta have at least one:
 	Hashes []*MFFileChecksum `protobuf:"bytes,3,rep,name=hashes,proto3" json:"hashes,omitempty"`
 	// optional per-file metadata
-	MimeType      *string    `protobuf:"bytes,301,opt,name=mimeType,proto3,oneof" json:"mimeType,omitempty"`
+	MimeType *string    `protobuf:"bytes,301,opt,name=mimeType,proto3,oneof" json:"mimeType,omitempty"`
-	Mtime         *Timestamp `protobuf:"bytes,302,opt,name=mtime,proto3,oneof" json:"mtime,omitempty"`
+	Mtime    *Timestamp `protobuf:"bytes,302,opt,name=mtime,proto3,oneof" json:"mtime,omitempty"`
-	Ctime         *Timestamp `protobuf:"bytes,303,opt,name=ctime,proto3,oneof" json:"ctime,omitempty"`
+	Ctime    *Timestamp `protobuf:"bytes,303,opt,name=ctime,proto3,oneof" json:"ctime,omitempty"`
+	// permission bits, at most 0777; 0 when not recorded
+	Mode          uint32 `protobuf:"varint,304,opt,name=mode,proto3" json:"mode,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -416,6 +418,13 @@ func (x *MFFilePath) GetCtime() *Timestamp {
 	return nil
 }
 
+func (x *MFFilePath) GetMode() uint32 {
+	if x != nil {
+		return x.Mode
+	}
+	return 0
+}
+
 type MFFileChecksum struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// 1.0 golang implementation must write a multihash here
@@ -561,7 +570,7 @@ const file_mf_proto_rawDesc = "" +
 	"\n" +
 	"_signatureB\t\n" +
 	"\a_signerB\x10\n" +
-	"\x0e_signingPubKey\"\xf0\x01\n" +
+	"\x0e_signingPubKey\"\x85\x02\n" +
 	"\n" +
 	"MFFilePath\x12\x12\n" +
 	"\x04path\x18\x01 \x01(\tR\x04path\x12\x12\n" +
@@ -571,7 +580,8 @@ const file_mf_proto_rawDesc = "" +
 	"\x05mtime\x18\xae\x02 \x01(\v2\n" +
 	".TimestampH\x01R\x05mtime\x88\x01\x01\x12&\n" +
 	"\x05ctime\x18\xaf\x02 \x01(\v2\n" +
-	".TimestampH\x02R\x05ctime\x88\x01\x01B\v\n" +
+	".TimestampH\x02R\x05ctime\x88\x01\x01\x12\x13\n" +
+	"\x04mode\x18\xb0\x02 \x01(\rR\x04modeB\v\n" +
 	"\t_mimeTypeB\b\n" +
 	"\x06_mtimeB\b\n" +
 	"\x06_ctime\".\n" +

mfer/mf.proto

@@ -59,6 +59,8 @@ message MFFilePath {
     optional string mimeType = 301;
     optional Timestamp mtime = 302;
     optional Timestamp ctime = 303;
+    // permission bits, at most 0777; 0 when not recorded
+    uint32 mode = 304;
 }
 
 message MFFileChecksum {

mfer/mf.proto.sha256

@@ -1 +1 @@
-fa6fceaba5553c8667c631994535fe5c307c8adb19f3ad289babf79a0f438650  mf.proto
+3d4dcb0b2f4640dd3ae6bb48b833e9f26ae9771e2d3e88bd646e7f1724dda654  mf.proto

mfer/mf_test.go

@@ -8,6 +8,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/reflect/protoreflect"
+	"sneak.berlin/go/mfer/mfer"
 )
 
 // mf.pb.go is generated from mf.proto and committed. `make generate`
@@ -27,3 +29,27 @@ func TestGeneratedCodeMatchesProto(t *testing.T) {
 		"mfer/mf.proto has changed since mfer/mf.pb.go was generated "+
 			"from it: run `make generate` and commit the result")
 }
+
+// A file entry has exactly the fields docs/FORMAT.md lists for MFFilePath.
+func TestFileEntryFieldsMatchSpec(t *testing.T) {
+	t.Parallel()
+
+	want := map[string]protoreflect.FieldNumber{
+		"path":     1,
+		"size":     2,
+		"hashes":   3,
+		"mimeType": 301,
+		"mtime":    302,
+		"ctime":    303,
+		"mode":     304,
+	}
+
+	got := map[string]protoreflect.FieldNumber{}
+
+	fields := (&mfer.MFFilePath{}).ProtoReflect().Descriptor().Fields()
+	for i := range fields.Len() {
+		got[string(fields.Get(i).Name())] = fields.Get(i).Number()
+	}
+
+	require.Equal(t, want, got)
+}

mfer/scanner.go

@@ -52,6 +52,9 @@ type ScannerOptions struct {
 	// IncludeTimestamps includes a createdAt timestamp in the manifest
 	// (default: omit for determinism).
 	IncludeTimestamps bool
+	// IncludePermissions records each file's permission bits, 0777 at
+	// most, in the manifest (default: record 0000).
+	IncludePermissions bool
 	// Fs is the filesystem to use, defaults to OsFs if nil.
 	Fs afero.Fs
 	// SigningOptions holds GPG signing options (nil = no signing).
@@ -69,6 +72,7 @@ type FileEntry struct {
 	Size    FileSize    // File size in bytes
 	Mtime   ModTime     // Last modification time
 	Ctime   time.Time   // Creation time (platform-dependent)
+	Mode    fs.FileMode // Permission bits (Perm() of the file's mode)
 }
 
 // Scanner accumulates files and generates manifests from them.
@@ -353,11 +357,18 @@ func (s *Scanner) scanFile(
 		}(scannedBytes, scannedFiles)
 	}
 
+	// A mode of 0 records 0000, which means none was recorded.
+	var mode fs.FileMode
+	if s.options.IncludePermissions {
+		mode = entry.Mode
+	}
+
 	// Add to manifest with progress channel
 	bytesRead, err := builder.AddFile(
 		entry.Path,
 		entry.Size,
 		entry.Mtime,
+		mode,
 		f,
 		fileProgress,
 	)
@@ -461,6 +472,7 @@ func (s *Scanner) enumerateFileWithInfo(
 		AbsPath: AbsFilePath(absPath),
 		Size:    FileSize(info.Size()),
 		Mtime:   ModTime(info.ModTime()),
+		Mode:    info.Mode().Perm(),
 		// Note: Ctime not available from fs.FileInfo on all platforms
 		// Will need platform-specific code to extract it
 	}

mfer/scanner_test.go

@@ -4,6 +4,7 @@ package mfer
 import (
 	"bytes"
 	"context"
+	"os"
 	"testing"
 	"time"
 
@@ -350,6 +351,46 @@ func TestScannerFileEntryFields(t *testing.T) {
 	assert.WithinDuration(t, now, time.Time(entry.Mtime), 2*time.Second)
 }
 
+// A manifest records every mode as 0000 unless the creator asks for
+// permissions; then it records each file's permission bits and never the
+// setuid, setgid or sticky bits.
+func TestScannerRecordsModeOnlyWhenAsked(t *testing.T) {
+	t.Parallel()
+
+	fs := afero.NewMemMapFs()
+	require.NoError(t, afero.WriteFile(fs, "/"+testFile1, []byte("a"), 0o640))
+	require.NoError(t, afero.WriteFile(fs, "/run.sh", []byte("b"), 0o755))
+	require.NoError(t, afero.WriteFile(fs, "/su", []byte("c"), 0o755))
+	require.NoError(t, fs.Chmod("/su", 0o755|os.ModeSetuid|os.ModeSetgid|os.ModeSticky))
+
+	for _, tc := range []struct {
+		includePermissions bool
+		want               map[string]uint32
+	}{
+		{false, map[string]uint32{testFile1: 0, "run.sh": 0, "su": 0}},
+		{true, map[string]uint32{testFile1: 0o640, "run.sh": 0o755, "su": 0o755}},
+	} {
+		s := NewScannerWithOptions(&ScannerOptions{
+			Fs:                 fs,
+			IncludePermissions: tc.includePermissions,
+		})
+		require.NoError(t, s.EnumerateFS(fs, "/", nil))
+
+		var buf bytes.Buffer
+		require.NoError(t, s.ToManifest(context.Background(), &buf, nil))
+
+		m, err := NewManifestFromReader(&buf)
+		require.NoError(t, err)
+
+		got := map[string]uint32{}
+		for _, f := range m.Files() {
+			got[f.GetPath()] = f.GetMode()
+		}
+
+		assert.Equal(t, tc.want, got, "IncludePermissions: %v", tc.includePermissions)
+	}
+}
+
 func TestScannerLargeFileEnumeration(t *testing.T) {
 	t.Parallel()
 

mfer/serialize.go

@@ -8,8 +8,8 @@ import (
 	"fmt"
 	"math"
 	"time"
+	"uuid"
 
-	"github.com/google/uuid"
 	"github.com/klauspost/compress/zstd"
 	"google.golang.org/protobuf/proto"
 )
@@ -88,7 +88,7 @@ func (m *manifest) generateOuter(ctx context.Context) error {
 	if len(m.fixedUUID) == uuidLength {
 		copy(manifestUUID[:], m.fixedUUID)
 	} else {
-		manifestUUID = uuid.New()
+		manifestUUID = uuid.NewV4()
 	}
 
 	m.pbInner.Uuid = manifestUUID[:]

package.json

@@ -1,6 +1,5 @@
 {
     "name": "mfer",
-    "version": "0.1.0",
     "private": true,
     "description": "Development tooling for the mfer repository: prettier, used by script/fmt and script/fmt-check to format and verify Markdown and JSON.",
     "license": "WTFPL",

script/bootstrap

@@ -13,11 +13,24 @@ set -eu
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 # Pinned versions, 2026-07-06. Never "latest" or "lts"; exact versions.
-NODE_VERSION="22.17.0"
+# The node version is in .nvmrc, where script/prettier reads it too.
+NODE_VERSION="$(cat "$ROOT/.nvmrc")"
 NVM_VERSION="0.40.3"
 # sha256 of https://github.com/nvm-sh/nvm/archive/refs/tags/v0.40.3.tar.gz
 NVM_SHA256="5f4d6aaa04a177dc93c985e31dbc411ab6b8c6e1e21d8015dbc1372625fcd1d0"
 YARN_VERSION="1.22.22"
+# protoc v33.4, 2026-10-04, for script/generate. The sha256 of each
+# platform's release archive is in ensure_protoc.
+PROTOC_VERSION="33.4"
+# gofumpt v0.12.0 for script/gofumpt, 2026-10-04, and protoc-gen-go
+# v1.36.12 for script/generate, 2026-10-06: each is installed into bin/
+# with `go install`, pinned to the commit its release tag names. Those two
+# scripts refuse any other version, so a new pin is changed there too.
+# protoc-gen-go stays at the google.golang.org/protobuf version in go.mod.
+GOFUMPT_VERSION="v0.12.0"
+GOFUMPT_COMMIT="3e07e7e70ac93761d8e79ca0083a19e3d59f753d"
+PROTOC_GEN_GO_VERSION="v1.36.12"
+PROTOC_GEN_GO_COMMIT="cdd4c5f7406e82462949c7a65defa9f3029c162d"
 
 PKGMGR=""
 SUDO=""
@@ -74,9 +87,11 @@ verify_sha256() {
     fi
 }
 
-# nvm is a bash script; run a command in a bash with nvm loaded
+# nvm is a bash script; run a command in a bash with nvm loaded.
+# --no-use: otherwise loading nvm here switches to the version .nvmrc
+# names, and fails silently while that version is not installed yet.
 nvm_sh() {
-    bash -c ". \"\$HOME/.nvm/nvm.sh\" && $*"
+    bash -c ". \"\$HOME/.nvm/nvm.sh\" --no-use && $*"
 }
 
 ensure_nvm() {
@@ -122,6 +137,97 @@ install_js_deps() {
     fi
 }
 
+# Unpack protoc's release archive for this platform into bin/protoc, after
+# checking the archive's sha256, unless bin/protoc already holds the pinned
+# version. script/generate runs bin/protoc/bin/protoc, so that is the
+# binary checked again after unpacking.
+ensure_protoc() {
+    dir="$ROOT/bin/protoc"
+    if [ "$("$dir/bin/protoc" --version 2>/dev/null)" = \
+        "libprotoc $PROTOC_VERSION" ]; then
+        echo "protoc $PROTOC_VERSION"
+        return 0
+    fi
+    case "$(uname -s) $(uname -m)" in
+        "Linux x86_64")
+            platform="linux-x86_64"
+            sha256="c0040ea9aef08fdeb2c74ca609b18d5fdbfc44ea0042fcfbfb38860d35f7dd66"
+            ;;
+        "Linux aarch64" | "Linux arm64")
+            platform="linux-aarch_64"
+            sha256="15aa988f4a6090636525ec236a8e4b3aab41eef402751bd5bb2df6afd9b7b5a5"
+            ;;
+        "Darwin x86_64")
+            platform="osx-x86_64"
+            sha256="a49bec10d039e902d3b43e49938c42526f90011467609864fa6386ac4014da58"
+            ;;
+        "Darwin arm64")
+            platform="osx-aarch_64"
+            sha256="726297dcfed58592fd35620a5a6246ae020c39e88f3fd4cb1827df7bcf3dfcf1"
+            ;;
+        *)
+            echo "bootstrap: no protoc archive pinned for $(uname -s) $(uname -m)" >&2
+            exit 1
+            ;;
+    esac
+    if missing curl; then pkg_install curl curl curl curl; fi
+    if missing unzip; then pkg_install unzip unzip unzip unzip; fi
+    tmp="$(mktemp -d)"
+    curl -fsSL -o "$tmp/protoc.zip" \
+        "https://github.com/protocolbuffers/protobuf/releases/download/v${PROTOC_VERSION}/protoc-${PROTOC_VERSION}-${platform}.zip"
+    verify_sha256 "$tmp/protoc.zip" "$sha256"
+    rm -rf "$dir"
+    unzip -q "$tmp/protoc.zip" -d "$dir"
+    rm -rf "$tmp"
+    actual="$("$dir/bin/protoc" --version 2>/dev/null || true)"
+    if [ "$actual" != "libprotoc $PROTOC_VERSION" ]; then
+        echo "bootstrap: $dir/bin/protoc reports '$actual'," \
+            "not libprotoc $PROTOC_VERSION" >&2
+        exit 1
+    fi
+    echo "protoc $PROTOC_VERSION"
+}
+
+# Install gofumpt into bin/ unless bin/gofumpt already reports the pinned
+# version. script/gofumpt runs bin/gofumpt, so that is the binary checked
+# again after installing. Its --version prints the version, then the Go
+# version it was built with. The old file is removed first because
+# `go install` refuses to replace a file that is not a Go binary.
+ensure_gofumpt() {
+    tool="$ROOT/bin/gofumpt"
+    if [ "$("$tool" --version 2>/dev/null | cut -d' ' -f1)" != \
+        "$GOFUMPT_VERSION" ]; then
+        rm -f "$tool"
+        GOBIN="$ROOT/bin" go install "mvdan.cc/gofumpt@$GOFUMPT_COMMIT"
+    fi
+    actual="$("$tool" --version 2>/dev/null | cut -d' ' -f1)"
+    if [ "$actual" != "$GOFUMPT_VERSION" ]; then
+        echo "bootstrap: $tool reports '$actual', not $GOFUMPT_VERSION" >&2
+        exit 1
+    fi
+    echo "gofumpt $GOFUMPT_VERSION"
+}
+
+# Install protoc-gen-go into bin/ unless bin/protoc-gen-go already reports
+# the pinned version, as ensure_gofumpt does. script/generate runs
+# bin/protoc-gen-go, so that is the binary checked again after installing.
+ensure_protoc_gen_go() {
+    tool="$ROOT/bin/protoc-gen-go"
+    if [ "$("$tool" --version 2>/dev/null)" != \
+        "protoc-gen-go $PROTOC_GEN_GO_VERSION" ]; then
+        rm -f "$tool"
+        GOBIN="$ROOT/bin" go install \
+            "google.golang.org/protobuf/cmd/protoc-gen-go@$PROTOC_GEN_GO_COMMIT"
+    fi
+    actual="$("$tool" --version 2>/dev/null || true)"
+    if [ "$actual" != "protoc-gen-go $PROTOC_GEN_GO_VERSION" ]; then
+        echo "bootstrap: $tool reports '$actual'," \
+            "not protoc-gen-go $PROTOC_GEN_GO_VERSION" >&2
+        exit 1
+    fi
+    echo "protoc-gen-go $PROTOC_GEN_GO_VERSION"
+}
+
 main() {
     cd "$ROOT"
 
@@ -132,8 +238,10 @@ main() {
     # ---- JS / docs repos ----
     # This is a Go repo, but node and yarn are required anyway: prettier
     # formats the Markdown and JSON, and script/fmt-check verifies it.
-    # The version is pinned by package.json/yarn.lock, whose integrity
+    # The version is pinned by package.json/yarn.lock: yarn checks every
-    # hashes --frozen-lockfile enforces.
+    # package it fetches against its yarn.lock integrity hash, and
+    # --frozen-lockfile fails instead of rewriting a yarn.lock that no
+    # longer matches package.json.
     ensure_node
     ensure_yarn
     install_js_deps
@@ -142,6 +250,9 @@ main() {
     if missing go; then pkg_install go golang go go; fi
     # No golangci-lint: script/lint runs it in Docker only.
     go mod download
+    ensure_gofumpt
+    ensure_protoc
+    ensure_protoc_gen_go
 
     # ---- Python repos ----
     # if missing python3; then pkg_install python3 python3 python3 python3; fi

script/build

@@ -12,9 +12,7 @@ main() {
     # empty constant.
     version="$(git describe --tags --always --dirty 2>/dev/null || true)"
     [ -n "$version" ] || version="unknown"
-    go build -tags urfave_cli_no_docs \
+    go build -ldflags "-X main.Gitrev=$version" -o bin/mfer ./cmd/mfer
-        -ldflags "-X main.Gitrev=$version" \
-        -o bin/mfer ./cmd/mfer
 }
 
 main "$@"

script/check

@@ -1,7 +1,8 @@
 #!/bin/sh
 # script/check: run all checks (test, lint, fmt-check). Our own
-# extension to scripts-to-rule-them-all. Must not modify any files.
+# extension to scripts-to-rule-them-all. test and lint are Docker
-# Generic: usually needs no adaptation.
+# phases; fmt-check is native, because a formatter writes the working
+# tree. Must not modify any files.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"

script/cibuild

@@ -1,8 +1,10 @@
 #!/bin/sh
-# script/cibuild: run the CI build; the Gitea workflow runs this on push.
+# script/cibuild: run the CI build. It bootstraps first: a CI runner
-# It builds the image with the same command as script/docker. --no-cache
+# checks out and runs this and nothing else, and script/fmt-check runs
-# because the checks the final stage depends on are RUN steps, and a
+# the formatter on the host, which a pristine checkout cannot do.
-# cached one is a check that did not run.
+# --no-cache for the same reason as script/docker: the gate phases the
+# final stage depends on are RUN steps, and a cached one is a check that
+# did not run.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -10,6 +12,8 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
+    "$SCRIPT_DIR/bootstrap"
+    "$SCRIPT_DIR/check"
     # Own line: a failing command substitution inside an argument does
     # not trip `set -e`, so the inline form degrades silently to an
     # empty constant. The VERSION build argument takes precedence over

script/generate

@@ -4,26 +4,19 @@
 # regenerates mf.pb.go: it is committed, so building and checking need no
 # protoc. A test fails while mf.proto no longer matches the recorded hash.
 #
-# Needs exactly the protoc and protoc-gen-go versions named in the header of
+# Runs the protoc that script/bootstrap unpacks into bin/protoc, and the
-# the committed mf.pb.go (README.md says how to install them). Another
+# protoc-gen-go it installs into bin/. Another version of either writes a
-# version writes a different mf.pb.go, so the script refuses to run.
+# different mf.pb.go.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# protoc 33.4 names itself v6.33.4 in the mf.pb.go header.
+# The versions script/bootstrap installs. protoc 33.4 names itself v6.33.4
+# in the mf.pb.go header.
 PROTOC_VERSION="33.4"
-PROTOC_GEN_GO_VERSION="v1.36.11"
+PROTOC="$ROOT/bin/protoc/bin/protoc"
-
+PROTOC_GEN_GO_VERSION="v1.36.12"
-# require_version <command> <its exact --version output>
+PROTOC_GEN_GO="$ROOT/bin/protoc-gen-go"
-require_version() {
-    actual="$("$1" --version 2>/dev/null || true)"
-    if [ "$actual" != "$2" ]; then
-        echo "generate: needs $2 on PATH, found: ${actual:-none}" >&2
-        echo "  README.md says how to install it." >&2
-        exit 1
-    fi
-}
 
 # sha256 <file>: print "<hash>  <file>", with sha256sum, or with shasum
 # where there is no sha256sum.
@@ -39,16 +32,27 @@ sha256() {
 }
 
 main() {
+    # A bin/protoc or bin/protoc-gen-go left from before its pin moved
+    # fails here, until script/bootstrap replaces it.
+    actual="$("$PROTOC" --version 2>/dev/null || true)"
+    if [ "$actual" != "libprotoc $PROTOC_VERSION" ]; then
+        echo "generate: needs protoc $PROTOC_VERSION in bin/protoc," \
+            "found: ${actual:-none}; run script/bootstrap" >&2
+        exit 1
+    fi
+    actual="$("$PROTOC_GEN_GO" --version 2>/dev/null || true)"
+    if [ "$actual" != "protoc-gen-go $PROTOC_GEN_GO_VERSION" ]; then
+        echo "generate: needs protoc-gen-go $PROTOC_GEN_GO_VERSION in" \
+            "bin/protoc-gen-go, found: ${actual:-none}; run script/bootstrap" >&2
+        exit 1
+    fi
+
     cd "$ROOT/mfer"
-    # `go install` puts protoc-gen-go in $(go env GOPATH)/bin, which is
-    # often not on PATH.
-    PATH="$PATH:$(go env GOPATH)/bin"
-    require_version protoc "libprotoc $PROTOC_VERSION"
-    require_version protoc-gen-go "protoc-gen-go $PROTOC_GEN_GO_VERSION"
     # Hashed before regenerating, so a missing hash tool stops the script
     # before it changes anything. Regenerating leaves mf.proto as it is.
     proto_hash="$(sha256 mf.proto)"
-    go generate .
+    "$PROTOC" --plugin=protoc-gen-go="$PROTOC_GEN_GO" \
+        --go_out=paths=source_relative:. ./mf.proto
     echo "$proto_hash" >mf.proto.sha256
 }
 

script/gofumpt

@@ -3,17 +3,16 @@
 #
 # Takes exactly one mode argument, --write or --check, and runs the same
 # gofumpt version over the same files in both modes. script/fmt and
-# script/fmt-check both go through here, and so does the Docker lint
+# script/fmt-check both go through here, so what gets formatted and what
-# stage, so what gets formatted and what gets verified cannot drift
+# gets verified cannot drift apart.
-# apart.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
-# gofumpt v0.12.0, 2026-10-04. `go run` fetches and builds exactly this
+# The gofumpt script/bootstrap installs into bin/. Must match the pin
-# version, so neither a developer machine nor the lint image needs
+# there.
-# gofumpt installed.
+GOFUMPT_VERSION="v0.12.0"
-GOFUMPT="mvdan.cc/gofumpt@v0.12.0"
+GOFUMPT="$ROOT/bin/gofumpt"
 
 usage() {
     echo "usage: script/gofumpt --write|--check" >&2
@@ -22,15 +21,22 @@ usage() {
 
 main() {
     [ "$#" -eq 1 ] || usage
-    cd "$ROOT"
+    # A bin/gofumpt left from before the pin moved formats differently, so
-    # Every Go file in the repo. gofumpt holds generated files, such as
+    # it fails here until script/bootstrap replaces it.
-    # mfer/mf.pb.go, to gofmt's rules only.
+    actual="$("$GOFUMPT" --version 2>/dev/null | cut -d' ' -f1)"
+    if [ "$actual" != "$GOFUMPT_VERSION" ]; then
+        echo "gofumpt: needs $GOFUMPT_VERSION in bin/gofumpt," \
+            "found: ${actual:-none}; run script/bootstrap" >&2
+        exit 1
+    fi
+    # Every Go file in the repo, from $ROOT down. gofumpt holds generated
+    # files, such as mfer/mf.pb.go, to gofmt's rules only.
     case "$1" in
-        --write) go run "$GOFUMPT" -l -w . ;;
+        --write) "$GOFUMPT" -l -w "$ROOT" ;;
         --check)
             # Own line: a failing command inside `[ -n "$(...)" ]` does
             # not trip `set -e`, so a gofumpt that never ran would pass.
-            unformatted="$(go run "$GOFUMPT" -l .)"
+            unformatted="$("$GOFUMPT" -l "$ROOT")"
             if [ -n "$unformatted" ]; then
                 echo "gofumpt: files need formatting (run make fmt):" >&2
                 echo "$unformatted" >&2

script/install-precommit

@@ -1,7 +1,6 @@
 #!/bin/sh
 # script/install-precommit: install the git pre-commit hook that runs
 # script/precommit. Our own extension to scripts-to-rule-them-all.
-# Generic: needs no adaptation.
 set -eu
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"

script/lint

@@ -1,8 +1,13 @@
 #!/bin/sh
-# script/lint: run golangci-lint, in Docker only. Builds the lint stage of
+# script/lint: run the linter. Linting is a phase of the Dockerfile and
-# the Dockerfile, whose build runs the linter, so a successful build is a
+# this builds that phase alone; the linter is never installed or run on
-# clean lint. --no-cache because a cached build runs no linter. The image
+# a developer host, where a shared result cache and a host-global lock
-# is removed afterwards, whatever the outcome.
+# make its answer untrustworthy.
+#
+# The phase is not the last stage in the file, so it is built only when
+# --target names it. --no-cache because a cached lint layer is a lint
+# that did not run. The tag makes each build replace the previous image
+# instead of leaving a dangling one behind.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
@@ -10,11 +15,9 @@ ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    # Tagged per run, so concurrent runs never remove each other's image.
+    docker build --no-cache \
-    image="$("$SCRIPT_DIR/projectname")-lint:$$"
+        --target lint \
-    # A failed build leaves no image, so there is nothing to remove then.
+        -t "$("$SCRIPT_DIR/projectname")-lint" .
-    trap 'docker image rm "$image" >/dev/null 2>&1 || true' EXIT INT TERM
-    docker build --no-cache --target lint -t "$image" .
 }
 
 main "$@"

script/prettier

@@ -18,24 +18,9 @@ usage() {
     exit 2
 }
 
-# Prefer the version pinned by package.json/yarn.lock so that CI and
+# Only the prettier yarn installed from yarn.lock, never one on PATH: a
-# developer machines format identically. Fall back to a prettier on PATH,
+# different version formats differently.
-# but say so, because a different version formats differently.
+PRETTIER="$ROOT/node_modules/.bin/prettier"
-find_prettier() {
-    if [ -x "$ROOT/node_modules/.bin/prettier" ]; then
-        printf '%s\n' "$ROOT/node_modules/.bin/prettier"
-        return 0
-    fi
-    if command -v prettier >/dev/null 2>&1; then
-        echo "prettier: node_modules/.bin/prettier is absent; using the" \
-            "prettier on PATH, which may be a different version than the" \
-            "one pinned in package.json. Run script/bootstrap to install" \
-            "the pinned version." >&2
-        command -v prettier
-        return 0
-    fi
-    return 1
-}
 
 main() {
     [ "$#" -eq 1 ] || usage
@@ -46,24 +31,38 @@ main() {
 
     cd "$ROOT"
 
-    if ! prettier_bin="$(find_prettier)"; then
+    # Where there is no node on PATH, script/bootstrap installs the version
-        echo "prettier: not found." >&2
+    # .nvmrc names through nvm, which keeps it in this directory.
-        echo "  Install it with: script/bootstrap" >&2
+    if ! command -v node >/dev/null 2>&1; then
-        echo "  (installs the version pinned in package.json/yarn.lock)" >&2
+        PATH="$HOME/.nvm/versions/node/v$(cat .nvmrc)/bin:$PATH"
+    fi
+    if ! command -v node >/dev/null 2>&1; then
+        echo "prettier: node is missing; run script/bootstrap" >&2
+        exit 1
+    fi
+
+    # node_modules keeps the old prettier after package.json moves to a new
+    # one, until script/bootstrap runs again, so compare the two.
+    if ! installed="$("$PRETTIER" --version 2>/dev/null)"; then
+        echo "prettier: not installed; run script/bootstrap" >&2
+        exit 1
+    fi
+    pinned="$(node -p 'require("./package.json").devDependencies.prettier')"
+    if [ "$installed" != "$pinned" ]; then
+        echo "prettier: package.json pins $pinned but $installed is" \
+            "installed; run script/bootstrap" >&2
         exit 1
     fi
 
     # Markdown and JSON, repo-wide rather than root-only, so files in
     # subdirectories (docs/, once it exists) are covered too. Exclusions
-    # live in .prettierignore; REPO_POLICIES.md is excluded there because
+    # live in .prettierignore.
-    # it is a verbatim copy of an upstream document.
     #
     # --no-error-on-unmatched-pattern is deliberately NOT used: both
     # patterns always match at least one tracked file (README.md,
     # package.json), so an empty match means the glob broke, and prettier
     # erroring out is exactly what we want rather than a vacuous pass.
-    "$prettier_bin" "$mode" "**/*.md"
+    "$PRETTIER" "$mode" "**/*.md" "**/*.json"
-    "$prettier_bin" "$mode" "**/*.json"
 }
 
 main "$@"

script/setup

@@ -1,7 +1,6 @@
 #!/bin/sh
 # script/setup: set up the repo for development after a fresh clone:
-# installs dependencies (script/bootstrap) and the git pre-commit hook.
+# installs dependencies and the git pre-commit hook.
-# Add any repo-specific initialization (db init, .env template) here.
 set -eu
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"

script/test

@@ -1,17 +1,19 @@
 #!/bin/sh
-# script/test: run the test suite.
+# script/test: run the test suite. Testing is a phase of the Dockerfile
+# and this builds that phase alone, on the same terms as script/lint:
+# --target because a phase that is not the last stage is built only when
+# named, --no-cache because a cached test layer is a test that did not
+# run, and a tag so each build replaces the previous image.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    go test -timeout 30s -race -cover ./... ||
+    docker build --no-cache \
-        {
+        --target test \
-            echo "--- Rerunning with -v for details ---"
+        -t "$("$SCRIPT_DIR/projectname")-test" .
-            go test -timeout 30s -race -v ./...
-            exit 1
-        }
 }
 
 main "$@"

script/vulncheck

@@ -0,0 +1,22 @@
+#!/bin/sh
+# script/vulncheck: report known vulnerabilities in the code mfer calls,
+# with govulncheck, which reads the Go vulnerability database online.
+# It runs as the vulncheck stage of the Dockerfile, on the same Go as the
+# test phase, and this builds that stage alone, on the same terms as
+# script/lint and script/test.
+#
+# script/check does not run it: the gate's result depends on this tree
+# alone, and this one changes whenever a new advisory is published.
+set -eu
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+
+main() {
+    cd "$ROOT"
+    docker build --no-cache \
+        --target vulncheck \
+        -t "$("$SCRIPT_DIR/projectname")-vulncheck" .
+}
+
+main "$@"