Merge branch 'next' into fix/issue-23

1B iterations was too slow (30s+). Benchmarked on Apple Silicon:
- 150M iterations ≈ 6.3s
- Falls within the 5-10s target range

.gitignore

@@ -3,8 +3,6 @@
 *.tmp
 *.dockerimage
 /vendor
-vendor.tzst
-modcache.tzst
 
 # Stale files
 .drone.yml

internal/cli/mfer.go

@@ -156,7 +156,7 @@ func (mfa *CLIApp) run(args []string) {
 					},
 					&cli.StringFlag{
 						Name:    "seed",
-						Usage:   "Seed value for deterministic manifest UUID",
+						Usage:   "Seed value for deterministic manifest UUID (hashed 150M times with SHA-256, ~5-10s)",
 						EnvVars: []string{"MFER_SEED"},
 					},
 				),

mfer/builder.go

@@ -92,12 +92,25 @@ type Builder struct {
 	fixedUUID      []byte // if set, use this UUID instead of generating one
 }
 
+// seedIterations is the number of SHA-256 rounds used to derive a UUID from a seed.
+// Tuned to take approximately 5-10 seconds on modern hardware.
+const seedIterations = 150_000_000
+
 // SetSeed derives a deterministic UUID from the given seed string.
-// The seed is hashed once with SHA-256 and the first 16 bytes are used
+// The seed is hashed 150,000,000 times with SHA-256 to produce
-// as a fixed UUID for the manifest.
+// 16 bytes used as a fixed UUID for the manifest (~5-10s on modern hardware).
 func (b *Builder) SetSeed(seed string) {
+	b.fixedUUID = deriveSeedUUID(seed, seedIterations)
+}
+
+// deriveSeedUUID hashes the seed string n times with SHA-256
+// and returns the first 16 bytes as a UUID.
+func deriveSeedUUID(seed string, iterations int) []byte {
 	hash := sha256.Sum256([]byte(seed))
-	b.fixedUUID = hash[:16]
+	for i := 1; i < iterations; i++ {
+		hash = sha256.Sum256(hash[:])
+	}
+	return hash[:16]
 }
 
 // NewBuilder creates a new Builder.

mfer/builder_test.go

@@ -150,17 +150,15 @@ func TestBuilderDeterministicOutput(t *testing.T) {
 	assert.Equal(t, out1, out2, "two builds with same input should produce byte-identical output")
 }
 
-func TestSetSeedDeterministic(t *testing.T) {
+func TestDeriveSeedUUID(t *testing.T) {
-	b1 := NewBuilder()
+	// Use a small iteration count for testing (production uses 1B)
-	b1.SetSeed("test-seed-value")
+	uuid1 := deriveSeedUUID("test-seed-value", 1000)
-	b2 := NewBuilder()
+	uuid2 := deriveSeedUUID("test-seed-value", 1000)
-	b2.SetSeed("test-seed-value")
+	assert.Equal(t, uuid1, uuid2, "same seed should produce same UUID")
-	assert.Equal(t, b1.fixedUUID, b2.fixedUUID, "same seed should produce same UUID")
+	assert.Len(t, uuid1, 16, "UUID should be 16 bytes")
-	assert.Len(t, b1.fixedUUID, 16, "UUID should be 16 bytes")
 
-	b3 := NewBuilder()
+	uuid3 := deriveSeedUUID("different-seed", 1000)
-	b3.SetSeed("different-seed")
+	assert.NotEqual(t, uuid1, uuid3, "different seeds should produce different UUIDs")
-	assert.NotEqual(t, b1.fixedUUID, b3.fixedUUID, "different seeds should produce different UUIDs")
 }
 
 func TestBuilderBuildEmpty(t *testing.T) {