Default the manifest to index.mf and keep it out of its own listing (closes #100)

mfer gen now writes index.mf instead of .index.mf, the name fetch
requests and the README calls the standard filename. Given a
directory, check, freshen, list and export look only for index.mf;
.index.mf is no longer recognized. Because index.mf is not hidden, gen
and freshen now leave the manifest they write out of its own listing by
file identity (os.SameFile), so it is recognized however its path is
spelled, through a symlink included, while an ordinary file of the same
name elsewhere in the tree is still listed.

Model: opus-5-5

.gitignore

@@ -8,7 +8,7 @@ vendor.tzst
 modcache.tzst
 
 # Generated manifest files
-.index.mf
+/index.mf
 
 # Secrets
 .env

.golangci.yml

@@ -16,7 +16,6 @@ linters:
     - depguard         # Dependency allow/block lists
     - godot            # Requires comments to end with periods
     - wsl              # Deprecated, replaced by wsl_v5
-    - gomodguard       # Deprecated, replaced by gomodguard_v2
     - wrapcheck        # Too verbose for internal packages
     - varnamelen       # Short names like db, id are idiomatic Go
   settings:

Dockerfile

@@ -75,5 +75,7 @@ RUN version="${VERSION:-$(git describe --tags --always)}"; \
 RUN ldd /mfer 2>&1 | grep -q 'not a dynamic executable'
 
 FROM scratch
+# scratch has no CA certificates; fetch needs them to verify HTTPS servers.
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=builder /mfer /mfer
 ENTRYPOINT ["/mfer"]

README.md

@@ -36,12 +36,12 @@ Generate a manifest for a directory tree, verify it later, and fetch a published
 tree by URL:
 
 ```sh
-# Write .index.mf, a manifest of the files under the current directory.
+# Write index.mf, a manifest of the files under the current directory.
 bin/mfer gen .
 
 # Verify the files on disk against the manifest. Exits nonzero if any file
 # is missing or corrupted.
-bin/mfer check .index.mf
+bin/mfer check index.mf
 
 # Download and cryptographically verify a tree published over HTTP: mfer
 # fetches <url>/index.mf, then downloads every file it lists.

go.mod

@@ -12,13 +12,13 @@ require (
 	github.com/pterm/pterm v0.12.35
 	github.com/spf13/afero v1.8.0
 	github.com/stretchr/testify v1.8.1
-	github.com/urfave/cli/v2 v2.23.6
+	github.com/urfave/cli/v2 v2.27.7
 	google.golang.org/protobuf v1.28.1
 )
 
 require (
 	github.com/atomicgo/cursor v0.0.1 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
 	github.com/fatih/color v1.7.0 // indirect
 	github.com/gookit/color v1.4.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.0.9 // indirect
@@ -34,7 +34,7 @@ require (
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/spaolacci/murmur3 v1.1.0 // indirect
 	github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 // indirect
-	github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
+	github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 // indirect
 	golang.org/x/crypto v0.0.0-20220525230936-793ad666bf5e // indirect
 	golang.org/x/sys v0.1.0 // indirect
 	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect

go.sum

@@ -61,8 +61,8 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
 github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
 github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cpuguy83/go-md2man/v2 v2.0.2 h1:p1EgwI/C7NhT0JmVkwCD2ZBK8j4aeHQX2pMHHBfMQ6w=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
+github.com/cpuguy83/go-md2man/v2 v2.0.7/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -231,12 +231,12 @@ github.com/tj/go-buffer v1.1.0/go.mod h1:iyiJpfFcR2B9sXu7KvjbT9fpM4mOelRSDTbntVj
 github.com/tj/go-elastic v0.0.0-20171221160941-36157cbbebc2/go.mod h1:WjeM0Oo1eNAjXGDx2yma7uG2XoyRZTq1uv3M/o7imD0=
 github.com/tj/go-kinesis v0.0.0-20171128231115-08b17f58cb1b/go.mod h1:/yhzCV0xPfx6jb1bBgRFjl5lytqVqZXEaeqWP8lTEao=
 github.com/tj/go-spin v1.1.0/go.mod h1:Mg1mzmePZm4dva8Qz60H2lHwmJ2loum4VIrLgVnKwh4=
-github.com/urfave/cli/v2 v2.23.6 h1:iWmtKD+prGo1nKUtLO0Wg4z9esfBM4rAV4QRLQiEmJ4=
-github.com/urfave/cli/v2 v2.23.6/go.mod h1:GHupkWPMM0M/sj1a2b4wUrWBPzazNrIjouW6fmdJLxc=
+github.com/urfave/cli/v2 v2.27.7 h1:bH59vdhbjLv3LAvIu6gd0usJHgoTTPhCFib8qqOwXYU=
+github.com/urfave/cli/v2 v2.27.7/go.mod h1:CyNAG/xg+iAOg0N4MPGZqVmv2rCoP267496AOXUZjA4=
 github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778 h1:QldyIu/L63oPpyvQmHgvgickp1Yw510KJOqX7H24mg8=
 github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778/go.mod h1:2MuV+tbUrU1zIOPMxZ5EncGwgmMJsa+9ucAQZXxsObs=
-github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 h1:bAn7/zixMGCfxrRTfdpNzjtPYqr8smhKouy9mxVdGPU=
-github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673/go.mod h1:N3UwUGtsrSj3ccvlPHLoLsHnpR27oXr4ZE984MbSER8=
+github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1 h1:gEOO8jv9F4OT7lGCjxCBTO/36wtF6j2nSip77qHd4x4=
+github.com/xrash/smetrics v0.0.0-20240521201337-686a1a2994c1/go.mod h1:Ohn+xnUBiLI6FVj/9LpzZWtj1/D6lUovWYBkxHVV3aM=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=

internal/cli/check.go

@@ -75,25 +75,22 @@ func safeRateUint64(rate float64) uint64 {
 	return uint64(rate)
 }
 
-// findManifest looks for a manifest file in the given directory.
-// It checks for index.mf and .index.mf, returning the first one found.
+// findManifest returns the path of the manifest with the default name in
+// dir, or an error if there is none.
 func findManifest(fs afero.Fs, dir string) (string, error) {
-	candidates := []string{"index.mf", ".index.mf"}
-	for _, name := range candidates {
-		path := filepath.Join(dir, name)
+	path := filepath.Join(dir, defaultManifestName)
 
-		exists, err := afero.Exists(fs, path)
-		if err != nil {
-			return "", err
-		}
-
-		if exists {
-			return path, nil
-		}
+	exists, err := afero.Exists(fs, path)
+	if err != nil {
+		return "", err
 	}
 
-	return "", fmt.Errorf(
-		"%w in %s (looked for index.mf and .index.mf)", errNoManifestFound, dir)
+	if !exists {
+		return "", fmt.Errorf("%w in %s (looked for %s)",
+			errNoManifestFound, dir, defaultManifestName)
+	}
+
+	return path, nil
 }
 
 // fetchManifestToTemp downloads a manifest URL to a temporary file and

internal/cli/entry_test.go

@@ -8,6 +8,9 @@ import (
 	"io"
 	"math/rand"
 	"os"
+	"path/filepath"
+	"slices"
+	"strings"
 	"sync"
 	"testing"
 
@@ -30,6 +33,7 @@ const (
 	testFlagBase    = "--base"
 	testFlagNoExtra = "--no-extra-files"
 	testFlagVersion = "--version"
+	testFlagVerbose = "--verbose"
 )
 
 var errSimulatedWrite = errors.New("simulated write failure")
@@ -42,20 +46,32 @@ var errSimulatedWrite = errors.New("simulated write failure")
 var runMu sync.Mutex
 
 // runCLI invokes RunWithOptions while holding runMu so parallel tests
-// capture their own output. Before releasing the lock it points the
-// process-global logger at io.Discard: other tests log outside the lock
-// (manifest loads, scans), and those lines must not land in this run's
-// buffers once it has returned and its test is reading them.
+// capture their own output, and returns its exit code.
 func runCLI(opts *RunOptions) int {
+	exitCode, _ := runCLIWithLevel(opts)
+
+	return exitCode
+}
+
+// runCLIWithLevel is runCLI that also returns the log level the run left
+// set, read while runMu still keeps other runs from changing it. Each run
+// starts at the default level, as a new process does. Before releasing the
+// lock it points the process-global logger at io.Discard: other tests log
+// outside the lock (manifest loads, scans), and those lines must not land in
+// this run's buffers once it has returned and its test is reading them.
+func runCLIWithLevel(opts *RunOptions) (int, log.Level) {
 	runMu.Lock()
 	defer runMu.Unlock()
 
+	log.SetLevel(log.InfoLevel)
+
 	exitCode := RunWithOptions(opts)
+	level := log.GetLevel()
 
 	log.SetOutput(io.Discard, io.Discard)
 	log.Init()
 
-	return exitCode
+	return exitCode, level
 }
 
 func TestMain(m *testing.M) {
@@ -235,6 +251,90 @@ func TestRootVerbosityFlags(t *testing.T) {
 	})
 }
 
+// commandsTakingVerbose returns the command lines -v can follow: the root and
+// the generate, check, freshen and fetch subcommands.
+func commandsTakingVerbose() [][]string {
+	return [][]string{
+		{testApp},
+		{testApp, cmdGenerate},
+		{testApp, cmdCheck},
+		{testApp, cmdFreshen},
+		{testApp, cmdFetch},
+	}
+}
+
+// TestVerboseCount asserts that one -v or --verbose gives verbose output and
+// two -v give debug output (issue #125). urfave/cli before v2.25.5 counted a
+// flag given by its alias twice, so one -v gave debug output.
+func TestVerboseCount(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		flags []string
+		want  log.Level
+	}{
+		{[]string{"-v"}, log.VerboseLevel},
+		{[]string{testFlagVerbose}, log.VerboseLevel},
+		{[]string{"-v", "-v"}, log.DebugLevel},
+	}
+
+	for _, command := range commandsTakingVerbose() {
+		for _, tc := range cases {
+			args := slices.Concat(command, tc.flags)
+
+			t.Run(strings.Join(args, " "), func(t *testing.T) {
+				t.Parallel()
+
+				_, level := runCLIWithLevel(testOpts(args, afero.NewMemMapFs()))
+				assert.Equal(t, tc.want, level)
+			})
+		}
+	}
+}
+
+// TestCombinedShortVerboseRefused asserts that -vv is refused (issue #125):
+// single-letter flags do not combine, so the -v help text says -v -v.
+func TestCombinedShortVerboseRefused(t *testing.T) {
+	t.Parallel()
+
+	for _, command := range commandsTakingVerbose() {
+		args := slices.Concat(command, []string{"-vv"})
+
+		t.Run(strings.Join(args, " "), func(t *testing.T) {
+			t.Parallel()
+
+			opts := testOpts(args, afero.NewMemMapFs())
+			exitCode, level := runCLIWithLevel(opts)
+
+			assert.Equal(t, 1, exitCode)
+			assert.Contains(t, testStderr(t, opts), "flag provided but not defined: -vv")
+			assert.Equal(t, log.InfoLevel, level)
+		})
+	}
+}
+
+// TestShortAndLongVerboseRefused asserts that -v and --verbose given together
+// are refused (issue #125): urfave/cli v2 refuses a flag given under two of its
+// names, and one flag with an alias keeps help and parsing simple.
+func TestShortAndLongVerboseRefused(t *testing.T) {
+	t.Parallel()
+
+	for _, command := range commandsTakingVerbose() {
+		args := slices.Concat(command, []string{"-v", testFlagVerbose})
+
+		t.Run(strings.Join(args, " "), func(t *testing.T) {
+			t.Parallel()
+
+			opts := testOpts(args, afero.NewMemMapFs())
+			exitCode, level := runCLIWithLevel(opts)
+
+			assert.Equal(t, 1, exitCode)
+			assert.Contains(t, testStderr(t, opts), "Cannot use two forms of the same flag")
+			assert.Equal(t, log.InfoLevel, level)
+		})
+	}
+}
+
 func TestHelpCommand(t *testing.T) {
 	t.Parallel()
 
@@ -638,6 +738,80 @@ func TestGenerateFailsWithoutForceWhenOutputExists(t *testing.T) {
 	assert.Equal(t, "existing", string(content), "original file should be preserved")
 }
 
+// manifestPaths returns the file paths listed by the manifest at path.
+func manifestPaths(t *testing.T, fs afero.Fs, path string) []string {
+	t.Helper()
+
+	manifest, err := mfer.NewManifestFromFile(fs, path)
+	require.NoError(t, err)
+
+	paths := make([]string, 0, len(manifest.Files()))
+	for _, f := range manifest.Files() {
+		paths = append(paths, f.GetPath())
+	}
+
+	return paths
+}
+
+// TestGenerateLeavesOutputOutOfListing overwrites an output file inside the
+// scanned tree with --force: the old file is not listed, even when the tree
+// is named through a symlink, while a file named index.mf in a subdirectory
+// still is. The output file is recognized by file identity, which needs
+// the real filesystem.
+func TestGenerateLeavesOutputOutOfListing(t *testing.T) {
+	t.Parallel()
+
+	// Paths are relative to a temp dir holding data/tree and link, a
+	// symlink to data.
+	for name, tc := range map[string]struct{ input, output string }{
+		"default name":                 {"data/tree", "data/tree/index.mf"},
+		"other name in a subdirectory": {"data/tree", "data/tree/sub/listing.mf"},
+		"tree named through a symlink": {"link/tree", "data/tree/index.mf"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			root := t.TempDir()
+			tree := filepath.Join(root, "data", "tree")
+			output := filepath.Join(root, tc.output)
+
+			fs := afero.NewOsFs()
+			require.NoError(t, fs.MkdirAll(filepath.Join(tree, "sub"), 0o750))
+			require.NoError(t,
+				os.Symlink(filepath.Join(root, "data"), filepath.Join(root, "link")))
+			writeTestFile(t, fs, filepath.Join(tree, testFileTxt), "hello")
+			writeTestFile(t, fs, filepath.Join(tree, "sub", "index.mf"), "an ordinary file")
+			writeTestFile(t, fs, output, "previous manifest")
+
+			opts := testOpts([]string{
+				testApp, cmdGenerate, "-q", "--force", "-o", output, filepath.Join(root, tc.input),
+			}, fs)
+			require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
+
+			assert.ElementsMatch(t, []string{testFileTxt, "sub/index.mf"},
+				manifestPaths(t, fs, output))
+		})
+	}
+}
+
+// TestGenerateDefaultOutputLeftOutOfListing runs gen with --force and no
+// other arguments, so it scans the current directory and writes the
+// relative path index.mf: the index.mf already there is not listed.
+//
+//nolint:paralleltest // changes the process-global working directory
+func TestGenerateDefaultOutputLeftOutOfListing(t *testing.T) {
+	chdirTemp(t)
+
+	fs := afero.NewOsFs()
+	writeTestFile(t, fs, testFileTxt, "hello")
+	writeTestFile(t, fs, "index.mf", "previous manifest")
+
+	opts := testOpts([]string{testApp, cmdGenerate, "-q", "--force"}, fs)
+	require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
+
+	assert.Equal(t, []string{testFileTxt}, manifestPaths(t, fs, "index.mf"))
+}
+
 func TestGenerateAtomicWriteUsesTemp(t *testing.T) {
 	t.Parallel()
 

internal/cli/errmsg_test.go

@@ -74,7 +74,7 @@ func TestNoManifestFoundMessage(t *testing.T) {
 	_, err := findManifest(afero.NewMemMapFs(), "/tmp/x")
 	require.ErrorIs(t, err, errNoManifestFound)
 	assert.EqualError(t, err,
-		"no manifest found in /tmp/x (looked for index.mf and .index.mf)")
+		"no manifest found in /tmp/x (looked for index.mf)")
 }
 
 func TestVerifyRequiredSignerMessages(t *testing.T) {

internal/cli/fetch.go

@@ -313,7 +313,7 @@ func checkNoSymlinks(p string) error {
 
 // resolveManifestURL takes a URL and returns the manifest URL.
 // If the URL already ends with .mf, it's returned as-is.
-// Otherwise, index.mf is appended.
+// Otherwise, the default manifest name is appended.
 func resolveManifestURL(inputURL string) (string, error) {
 	parsed, err := url.Parse(inputURL)
 	if err != nil {
@@ -330,8 +330,7 @@ func resolveManifestURL(inputURL string) (string, error) {
 		parsed.Path += "/"
 	}
 
-	// Append index.mf
-	parsed.Path += "index.mf"
+	parsed.Path += defaultManifestName
 
 	return parsed.String(), nil
 }

internal/cli/freshen.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"io/fs"
+	"os"
 	"path/filepath"
 	"time"
 
@@ -56,7 +57,7 @@ type freshenEntry struct {
 type freshenScanner struct {
 	fs              afero.Fs
 	absBase         string
-	manifestBase    string
+	manifestInfo    fs.FileInfo // the manifest being freshened
 	includeDotfiles bool
 	followSymlinks  bool
 	showProgress    bool
@@ -156,11 +157,6 @@ func (s *freshenScanner) walk(path string, info fs.FileInfo, walkErr error) erro
 			"freshen: failed to compute relative path for %s: %w", path, err)
 	}
 
-	// Skip the manifest file itself
-	if relPath == s.manifestBase || relPath == "."+s.manifestBase {
-		return nil
-	}
-
 	// Handle dotfiles
 	if !s.includeDotfiles && mfer.IsHiddenPath(filepath.ToSlash(relPath)) {
 		if info.IsDir() {
@@ -185,6 +181,12 @@ func (s *freshenScanner) walk(path string, info fs.FileInfo, walkErr error) erro
 		info = realInfo
 	}
 
+	// Skip the manifest file itself, however its path is spelled; gen
+	// leaves out its output file the same way.
+	if os.SameFile(info, s.manifestInfo) {
+		return nil
+	}
+
 	s.scanCount++
 
 	// Check against existing manifest
@@ -364,17 +366,22 @@ func (mfa *CLIApp) freshenScan(
 	startScan := time.Now()
 	showProgress := ctx.Bool("progress")
 
+	manifestInfo, err := mfa.Fs.Stat(manifestPath)
+	if err != nil {
+		return nil, 0, fmt.Errorf("freshen: %w", err)
+	}
+
 	scanner := &freshenScanner{
 		fs:              mfa.Fs,
 		absBase:         absBase,
-		manifestBase:    filepath.Base(manifestPath),
+		manifestInfo:    manifestInfo,
 		includeDotfiles: ctx.Bool("include-dotfiles"),
 		followSymlinks:  ctx.Bool("follow-symlinks"),
 		showProgress:    showProgress,
 		existingByPath:  existingByPath,
 	}
 
-	err := afero.Walk(mfa.Fs, absBase, scanner.walk)
+	err = afero.Walk(mfa.Fs, absBase, scanner.walk)
 
 	if showProgress {
 		log.ProgressDone()

internal/cli/freshen_test.go

@@ -5,6 +5,7 @@ import (
 	"bytes"
 	"context"
 	"os"
+	"path/filepath"
 	"testing"
 	"time"
 
@@ -29,7 +30,7 @@ func (s stubFileInfo) IsDir() bool        { return false }
 func (s stubFileInfo) Sys() any           { return nil }
 
 // setupFreshenDir populates /testdir with two files, scans it, and
-// writes the resulting manifest to /testdir/.index.mf.
+// writes the resulting manifest to /testdir/index.mf.
 func setupFreshenDir(t *testing.T, fs afero.Fs) {
 	t.Helper()
 
@@ -48,7 +49,7 @@ func setupFreshenDir(t *testing.T, fs afero.Fs) {
 
 	// Write manifest to filesystem
 	require.NoError(t,
-		afero.WriteFile(fs, "/testdir/.index.mf", manifestBuf.Bytes(), 0o644))
+		afero.WriteFile(fs, "/testdir/index.mf", manifestBuf.Bytes(), 0o644))
 }
 
 func TestFreshenUnchanged(t *testing.T) {
@@ -58,7 +59,7 @@ func TestFreshenUnchanged(t *testing.T) {
 	setupFreshenDir(t, fs)
 
 	// Parse manifest to verify
-	manifest, err := mfer.NewManifestFromFile(fs, "/testdir/.index.mf")
+	manifest, err := mfer.NewManifestFromFile(fs, "/testdir/index.mf")
 	require.NoError(t, err)
 	assert.Len(t, manifest.Files(), 2)
 }
@@ -70,7 +71,7 @@ func TestFreshenWithChanges(t *testing.T) {
 	setupFreshenDir(t, fs)
 
 	// Verify initial manifest has 2 files
-	manifest, err := mfer.NewManifestFromFile(fs, "/testdir/.index.mf")
+	manifest, err := mfer.NewManifestFromFile(fs, "/testdir/index.mf")
 	require.NoError(t, err)
 	assert.Len(t, manifest.Files(), 2)
 
@@ -95,6 +96,36 @@ func TestFreshenWithChanges(t *testing.T) {
 	assert.Equal(t, "modified content2", string(content))
 }
 
+// TestFreshenLeavesManifestOutOfListing freshens a manifest kept in a
+// subdirectory of the tree it lists: the manifest is not listed, while an
+// ordinary file of the same name at the top of the tree is. The manifest
+// is recognized by file identity, which needs the real filesystem.
+func TestFreshenLeavesManifestOutOfListing(t *testing.T) {
+	t.Parallel()
+
+	root := t.TempDir()
+	manifestPath := filepath.Join(root, "sub", "listing.mf")
+
+	fs := afero.NewOsFs()
+	require.NoError(t, fs.MkdirAll(filepath.Join(root, "sub"), 0o750))
+	writeTestFile(t, fs, filepath.Join(root, testFileTxt), "hello")
+	writeTestFile(t, fs, filepath.Join(root, "listing.mf"), "an ordinary file")
+
+	opts := testOpts([]string{testApp, cmdGenerate, "-q", "-o", manifestPath, root}, fs)
+	require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
+
+	// A new file gives freshen something to write.
+	writeTestFile(t, fs, filepath.Join(root, "added.txt"), "added")
+
+	opts = testOpts([]string{
+		testApp, "freshen", "-q", testFlagBase, root, manifestPath,
+	}, fs)
+	require.Equal(t, 0, runCLI(opts), "stderr: %s", testStderr(t, opts))
+
+	assert.ElementsMatch(t, []string{testFileTxt, "listing.mf", "added.txt"},
+		manifestPaths(t, fs, manifestPath))
+}
+
 // TestFreshenRecordEntryMtimePresence pins the behavior of recordEntry
 // with respect to MFFilePath.Mtime, which is a message pointer with
 // proto3 field presence and may legitimately be absent.

internal/cli/gen.go

@@ -94,6 +94,7 @@ func (mfa *CLIApp) buildScannerOptions(ctx *cli.Context) *mfer.ScannerOptions {
 		FollowSymLinks:    ctx.Bool("follow-symlinks"),
 		IncludeTimestamps: ctx.Bool("include-timestamps"),
 		Fs:                mfa.Fs,
+		OutputPath:        ctx.String("output"),
 	}
 
 	// Set seed for deterministic UUID if provided

internal/cli/manifest_loader.go

@@ -65,7 +65,7 @@ func (mfa *CLIApp) openManifestReader(pathOrURL string) (io.ReadCloser, error) {
 }
 
 // resolveManifestArg resolves the manifest path from CLI arguments.
-// HTTP(S) URLs are returned as-is. Directories are searched for index.mf/.index.mf.
+// HTTP(S) URLs are returned as-is. Directories are searched for index.mf.
 // If no argument is given, the current directory is searched.
 func (mfa *CLIApp) resolveManifestArg(ctx *cli.Context) (string, error) {
 	if ctx.Args().Len() > 0 {

internal/cli/mfer.go

@@ -17,6 +17,7 @@ import (
 const (
 	cmdGenerate = "generate"
 	cmdCheck    = "check"
+	cmdFreshen  = "freshen"
 	cmdExport   = "export"
 	cmdFetch    = "fetch"
 	cmdVersion  = "version"
@@ -24,6 +25,11 @@ const (
 	flagProgress = "progress"
 
 	manifestArgsUsage = "[manifest file]"
+
+	// defaultManifestName is the filename gen writes by default, the one
+	// looked for when a command is given a directory, and the one fetch
+	// appends to a directory URL.
+	defaultManifestName = "index.mf"
 )
 
 // errUnknownCommand indicates an unrecognized command argument.
@@ -118,7 +124,7 @@ func commonFlags() []cli.Flag {
 		&cli.BoolFlag{
 			Name:    "verbose",
 			Aliases: []string{"v"},
-			Usage:   "Increase verbosity (-v for verbose, -vv for debug)",
+			Usage:   "Increase verbosity (-v for verbose, -v -v for debug)",
 			Count:   new(int),
 		},
 		&cli.BoolFlag{
@@ -131,9 +137,10 @@ func commonFlags() []cli.Flag {
 
 func (mfa *CLIApp) generateCommand() *cli.Command {
 	return &cli.Command{
-		Name:    cmdGenerate,
-		Aliases: []string{"gen"},
-		Usage:   "Generate manifest file",
+		Name:      cmdGenerate,
+		Aliases:   []string{"gen"},
+		Usage:     "Generate manifest file",
+		ArgsUsage: "[path ...]",
 		Action: func(c *cli.Context) error {
 			mfa.setVerbosity(c)
 			mfa.printBanner()
@@ -154,7 +161,7 @@ func (mfa *CLIApp) generateCommand() *cli.Command {
 			},
 			&cli.StringFlag{
 				Name:    "output",
-				Value:   "./.index.mf",
+				Value:   defaultManifestName,
 				Aliases: []string{"o"},
 				Usage:   "Specify output filename",
 			},
@@ -227,7 +234,7 @@ func (mfa *CLIApp) checkCommand() *cli.Command {
 
 func (mfa *CLIApp) freshenCommand() *cli.Command {
 	return &cli.Command{
-		Name:      "freshen",
+		Name:      cmdFreshen,
 		Usage:     "Update manifest with changed, new, and removed files",
 		ArgsUsage: manifestArgsUsage,
 		Action: func(c *cli.Context) error {
@@ -324,8 +331,9 @@ func (mfa *CLIApp) listCommand() *cli.Command {
 
 func (mfa *CLIApp) fetchCommand() *cli.Command {
 	return &cli.Command{
-		Name:  cmdFetch,
-		Usage: "fetch manifest and referenced files",
+		Name:      cmdFetch,
+		Usage:     "fetch manifest and referenced files",
+		ArgsUsage: "URL",
 		Action: func(c *cli.Context) error {
 			mfa.setVerbosity(c)
 			mfa.printBanner()

mfer/checker_test.go

@@ -360,7 +360,7 @@ func TestFindExtraFilesSkipsManifestAndDotfiles(t *testing.T) {
 	manifestFiles := map[string][]byte{
 		testFile1: []byte("in manifest"),
 	}
-	createTestManifest(t, fs, "/data/.index.mf", manifestFiles)
+	createTestManifest(t, fs, "/data/index.mf", manifestFiles)
 	createFilesOnDisk(t, fs, map[string][]byte{
 		testFile1: []byte("in manifest"),
 	})
@@ -371,7 +371,7 @@ func TestFindExtraFilesSkipsManifestAndDotfiles(t *testing.T) {
 	require.NoError(t, fs.MkdirAll("/data", 0o755))
 	require.NoError(t, afero.WriteFile(fs, "/data/extra.txt", []byte("extra"), 0o644))
 
-	chk, err := NewChecker("/data/.index.mf", "/data", fs)
+	chk, err := NewChecker("/data/index.mf", "/data", fs)
 	require.NoError(t, err)
 
 	results := make(chan Result, 10)
@@ -383,7 +383,7 @@ func TestFindExtraFilesSkipsManifestAndDotfiles(t *testing.T) {
 		extras = append(extras, r)
 	}
 
-	// Should only report extra.txt, not .hidden, .config/settings, or .index.mf
+	// Should only report extra.txt, not .hidden, .config/settings, or index.mf
 	for _, e := range extras {
 		t.Logf("extra: %s", e.Path)
 	}
@@ -528,7 +528,7 @@ func TestFindExtraFilesSkipsDotfiles(t *testing.T) {
 	files := map[string][]byte{
 		testFile1: []byte("in manifest"),
 	}
-	createTestManifest(t, fs, "/data/.index.mf", files)
+	createTestManifest(t, fs, "/data/index.mf", files)
 	createFilesOnDisk(t, fs, files)
 
 	// Add dotfiles and manifest file on disk
@@ -537,7 +537,7 @@ func TestFindExtraFilesSkipsDotfiles(t *testing.T) {
 	require.NoError(t,
 		afero.WriteFile(fs, "/data/.git/config", []byte("git config"), 0o644))
 
-	chk, err := NewChecker("/data/.index.mf", "/data", fs)
+	chk, err := NewChecker("/data/index.mf", "/data", fs)
 	require.NoError(t, err)
 
 	results := make(chan Result, 10)

mfer/scanner.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"io"
 	"io/fs"
+	"os"
 	"path"
 	"path/filepath"
 	"strings"
@@ -57,6 +58,14 @@ type ScannerOptions struct {
 	SigningOptions *SigningOptions
 	// Seed, if set, derives a deterministic UUID from this seed.
 	Seed string
+	// OutputPath, if set, is the file the manifest will be written to.
+	// If that file exists when the scanner is created, enumeration leaves
+	// it out however its path is spelled (through a symlink, a hard link,
+	// or in different letter case), so a manifest being replaced is never
+	// listed.
+	// Files are matched with os.SameFile, which only recognizes files on
+	// the operating system's filesystem.
+	OutputPath string
 }
 
 // FileEntry represents a file that has been enumerated.
@@ -75,6 +84,7 @@ type Scanner struct {
 	totalBytes FileSize // cached sum of all file sizes
 	options    *ScannerOptions
 	fs         afero.Fs
+	outputInfo fs.FileInfo // the existing output file; nil when there is none
 }
 
 // NewScanner creates a new Scanner with default options.
@@ -93,11 +103,22 @@ func NewScannerWithOptions(opts *ScannerOptions) *Scanner {
 		fs = afero.NewOsFs()
 	}
 
-	return &Scanner{
+	s := &Scanner{
 		files:   make([]*FileEntry, 0),
 		options: opts,
 		fs:      fs,
 	}
+
+	if opts.OutputPath != "" {
+		// If the output file cannot be stat'd, normally because it does
+		// not exist yet, there is nothing to leave out.
+		info, err := s.fs.Stat(opts.OutputPath)
+		if err == nil {
+			s.outputInfo = info
+		}
+	}
+
+	return s
 }
 
 // EnumerateFile adds a single file to the scanner, calling stat() to get metadata.
@@ -435,6 +456,11 @@ func (s *Scanner) enumerateFileWithInfo(
 		info = realInfo
 	}
 
+	// The manifest being written is not one of the files it lists.
+	if s.outputInfo != nil && os.SameFile(info, s.outputInfo) {
+		return nil
+	}
+
 	entry := &FileEntry{
 		Path:    RelFilePath(cleanPath),
 		AbsPath: AbsFilePath(absPath),