Reject manifests whose file entries decode far larger than their bytes (closes #123)

Parser fix: before decoding the manifest, the parser walks its file
entries and adds up what decoding sets aside for each entry, hash,
timestamp and MIME type, however short its encoding. It refuses the
manifest once that sum passes 8 times the decompressed size; manifests
mfer writes come to at most about 7.15 times. Empty entries decoded to
about 50 times their size, so a manifest of under 1 KB allocated about
500 MB. A test refuses entries counted at just over 8 times and loads
them at just under. The fuzz target's ceiling rises from 16 to 20 times
the input and decompressed data, and seeds of empty entries and of
empty hashes fail it without the fix.

Model: opus-5-5

Dockerfile

@@ -14,7 +14,9 @@ RUN touch mfer/mf.pb.go
 # Go half of fmt-check only: this image has no node, so no prettier. The
 # markdown half runs in the mdfmt stage below.
 RUN make fmt-check-go
-RUN make lint
+# The linter directly, not `make lint`: script/lint builds this stage, and
+# there is no docker inside this build.
+RUN golangci-lint run --config .golangci.yml ./...
 
 # Markdown/JSON format stage — prettier needs node, which the Go images
 # do not have. node:22.17.0-bookworm-slim (2026-08-09); ships node
@@ -67,7 +69,10 @@ RUN version="${VERSION:-$(git describe --tags --always)}"; \
         exit 1; \
     fi; \
     cd cmd/mfer && \
-    go build -tags urfave_cli_no_docs -ldflags "-X main.Gitrev=$version" -o /mfer .
+    CGO_ENABLED=0 go build -tags urfave_cli_no_docs -ldflags "-X main.Gitrev=$version" -o /mfer .
+
+# Fail unless /mfer is statically linked: scratch has no C library to run it.
+RUN ldd /mfer 2>&1 | grep -q 'not a dynamic executable'
 
 FROM scratch
 COPY --from=builder /mfer /mfer

FORMAT.md

@@ -49,7 +49,9 @@ The `innerMessage` field is compressed with
 enforce a decompression size limit to prevent decompression bombs. The reference
 implementation limits decompressed size to 256 MB. It writes zstd frames with a
 window of at most 8 MiB, the largest window the zstd format recommends decoders
-support, and refuses frames that ask for a larger one.
+support, and refuses frames that ask for a larger one. It also refuses an inner
+message whose file entries, hashes, timestamps and MIME types, counted at 160,
+112, 64 and 16 bytes each, add up to more than 8 times its size.
 
 ## Inner Message (`MFFile`)
 

Makefile

@@ -58,9 +58,6 @@ fmt-check-md:
 hooks:
 	@script/install-precommit
 
-devprereqs:
-	which golangci-lint || go install -v github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
-
 mfer/mf.pb.go: mfer/mf.proto
 	cd mfer && go generate .
 

README.md

@@ -65,9 +65,9 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call them. We
 provide:
 
-- `script/bootstrap` — install all dependencies (Go, golangci-lint, Go module
-  download, and node/yarn plus the prettier version pinned in
-  `package.json`/`yarn.lock`), idempotently
+- `script/bootstrap` — install all dependencies (Go, Go module download, and
+  node/yarn plus the prettier version pinned in `package.json`/`yarn.lock`),
+  idempotently; golangci-lint is not installed, it runs only in Docker
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (`mfer`); used by other scripts
@@ -77,9 +77,11 @@ provide:
 - `script/fuzz` — fuzz the manifest parser for one minute; run by hand
   (`make fuzz`), never by CI, while `script/test` runs its committed seed corpus
   as ordinary tests
-- `script/lint` — run `golangci-lint` and verify `gofmt` cleanliness
-- `script/fmt` — format all code and docs (writes): `gofumpt`,
-  `golangci-lint run --fix`, and `script/prettier --write`
+- `script/lint` — run `golangci-lint` in Docker: builds only the `lint` stage of
+  the `Dockerfile` (the Go format check, then the linter), uncached so it runs
+  every time, then removes the image
+- `script/fmt` — format all code and docs (writes): `gofumpt` and
+  `script/prettier --write`
 - `script/prettier` — run prettier over the repository's canonical file set
   (Markdown and JSON, minus `.prettierignore`) in the given mode, `--write` or
   `--check`; the single definition of that file set, so `script/fmt` and
@@ -105,11 +107,10 @@ yet. Primary development happens on a privately-run Gitea instance at
 [tracked there](https://git.eeqj.de/sneak/mfer/issues).
 
 Changes must always be formatted with a standard `go fmt`, syntactically valid,
-and must pass the linting defined in the repository (presently only the
-`golangci-lint` defaults), which can be run with a `make lint`. The `main`
-branch is protected and all changes must be made via
-[pull requests](https://git.eeqj.de/sneak/mfer/pulls) and pass CI to be merged.
-Any changes submitted to this project must also be
+and must pass the linting defined in the repository's `.golangci.yml`, which
+`make lint` runs in Docker. The `main` branch is protected and all changes must
+be made via [pull requests](https://git.eeqj.de/sneak/mfer/pulls) and pass CI to
+be merged. Any changes submitted to this project must also be
 [WTFPL-licensed](https://wtfpl.net) to be considered.
 
 See [`REPO_POLICIES.md`](REPO_POLICIES.md) for detailed coding standards,

mfer/constants.go

@@ -35,6 +35,9 @@ const (
 	decodedTimestampSize = 64
 	decodedMIMETypeSize  = 16
 
-	// The densest manifests mfer writes add up to about 7 times their size.
+	// Each file entry mfer writes holds a path of at least one byte, a
+	// 34-byte SHA-256 multihash and a modification time: at least 47 bytes,
+	// counted at 336. So its manifests add up to at most about 7.15 times
+	// their size, and this limit is about 12% above that.
 	maxDecodedGrowth = 8
 )

mfer/deserialize_fuzz_test.go

@@ -76,9 +76,8 @@ func FuzzNewManifestFromReader(f *testing.F) {
 		// fails if the decoder accepts windows of twice zstdWindowSize; the
 		// seed whose two frames together exceed MaxDecompressedSize fails
 		// if the decoder decodes them in full instead of stopping at the
-		// declared size; the seeds of empty file entries, of a file entry
-		// of empty hashes, and of file entries of only an empty MIME type
-		// and empty times fail if the parser decodes them.
+		// declared size; the seeds of empty file entries and of a file
+		// entry of empty hashes fail if the parser decodes them.
 		limit := 20*(uint64(len(data))+decompressed) + 24*zstdWindowSize
 
 		allocated := after.TotalAlloc - before.TotalAlloc

mfer/deserialize_path_test.go

@@ -7,6 +7,7 @@ import (
 	"crypto/sha256"
 	"fmt"
 	"strconv"
+	"strings"
 	"testing"
 	"time"
 
@@ -116,29 +117,55 @@ func TestDeserializeRejectsInvalidEntryPaths(t *testing.T) {
 	}
 }
 
-// Entries of a one-character path and empty modification and change times
-// pass every other check, but would take about 23 times their size to decode.
+// Entries of a path, an empty hash, an empty MIME type and empty modification
+// and change times are counted at 416 bytes each (160 + 112 + 16 + 64 + 64)
+// and take 16 bytes plus the path to encode. A 35-character path makes that
+// 51 bytes, about 8.2 times: refused, and leaving any one of the five
+// uncounted, even the MIME type, brings it under 8. A 37-character path makes
+// it 53 bytes, about 7.8 times: loaded.
 func TestDeserializeRefusesEntriesThatDecodeTooLarge(t *testing.T) {
 	t.Parallel()
 
-	entry := protowire.AppendTag(nil, 1, protowire.BytesType) // MFFilePath.path
-	entry = protowire.AppendString(entry, "a")
-	entry = protowire.AppendTag(entry, 302, protowire.BytesType) // MFFilePath.mtime
-	entry = protowire.AppendBytes(entry, nil)
-	entry = protowire.AppendTag(entry, 303, protowire.BytesType) // MFFilePath.ctime
-	entry = protowire.AppendBytes(entry, nil)
-
-	id := uuid.New()
-	inner := protowire.AppendTag(nil, 102, protowire.BytesType) // MFFile.uuid
-	inner = protowire.AppendBytes(inner, id[:])
-
-	for range 1000 {
-		inner = protowire.AppendTag(inner, 101, protowire.BytesType) // MFFile.files
-		inner = protowire.AppendBytes(inner, entry)
+	tests := []struct {
+		pathLen int
+		refused bool
+	}{
+		{35, true},
+		{37, false},
 	}
 
-	_, err := NewManifestFromReader(bytes.NewReader(wrapInner(t, id, inner)))
-	require.ErrorIs(t, err, errDecodedTooLarge)
+	for _, tt := range tests {
+		t.Run(strconv.Itoa(tt.pathLen), func(t *testing.T) {
+			t.Parallel()
+
+			entry := protowire.AppendTag(nil, 1, protowire.BytesType) // MFFilePath.path
+			entry = protowire.AppendString(entry, strings.Repeat("a", tt.pathLen))
+			entry = protowire.AppendTag(entry, 3, protowire.BytesType) // MFFilePath.hashes
+			entry = protowire.AppendBytes(entry, nil)
+			entry = protowire.AppendTag(entry, 301, protowire.BytesType) // MFFilePath.mimeType
+			entry = protowire.AppendBytes(entry, nil)
+			entry = protowire.AppendTag(entry, 302, protowire.BytesType) // MFFilePath.mtime
+			entry = protowire.AppendBytes(entry, nil)
+			entry = protowire.AppendTag(entry, 303, protowire.BytesType) // MFFilePath.ctime
+			entry = protowire.AppendBytes(entry, nil)
+
+			id := uuid.New()
+			inner := protowire.AppendTag(nil, 102, protowire.BytesType) // MFFile.uuid
+			inner = protowire.AppendBytes(inner, id[:])
+
+			for range 1000 {
+				inner = protowire.AppendTag(inner, 101, protowire.BytesType) // MFFile.files
+				inner = protowire.AppendBytes(inner, entry)
+			}
+
+			_, err := NewManifestFromReader(bytes.NewReader(wrapInner(t, id, inner)))
+			if tt.refused {
+				require.ErrorIs(t, err, errDecodedTooLarge)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
 }
 
 // Many empty files with names of at most three characters and modification

script/bootstrap

@@ -140,12 +140,7 @@ main() {
 
     # ---- Go repos ----
     if missing go; then pkg_install go golang go go; fi
-    # golangci-lint: packaged in nix, brew, and apk. On apt there is no
-    # package: download a specific release archive from GitHub and
-    # verify its hash (verify_sha256), never curl | sh.
-    if missing golangci-lint; then
-        pkg_install golangci-lint golangci-lint golangci-lint golangci-lint
-    fi
+    # No golangci-lint: script/lint runs it in Docker only.
     go mod download
 
     # ---- Python repos ----

script/fmt

@@ -19,7 +19,6 @@ main() {
     cd "$ROOT"
     ensure_pb
     gofumpt -l -w mfer internal cmd
-    golangci-lint run --fix
     # Markdown and JSON, over the same file set script/fmt-check verifies.
     "$SCRIPT_DIR/prettier" --write
 }

script/lint

@@ -1,17 +1,20 @@
 #!/bin/sh
-# script/lint: run the linter.
+# script/lint: run golangci-lint, in Docker only. Builds the lint stage of
+# the Dockerfile, whose build runs the linter, so a successful build is a
+# clean lint. --no-cache because a cached build runs no linter. The image
+# is removed afterwards, whatever the outcome.
 set -eu
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
+ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    golangci-lint run
-    if [ -n "$(gofmt -l .)" ]; then
-        echo "gofmt: files need formatting:" >&2
-        gofmt -l . >&2
-        exit 1
-    fi
+    # Tagged per run, so concurrent runs never remove each other's image.
+    image="$("$SCRIPT_DIR/projectname")-lint:$$"
+    # A failed build leaves no image, so there is nothing to remove then.
+    trap 'docker image rm "$image" >/dev/null 2>&1 || true' EXIT INT TERM
+    docker build --no-cache --target lint -t "$image" .
 }
 
 main "$@"