Refuse to freshen a signed manifest without --sign-key (closes #191)

freshen built the new manifest from its flags alone, so a signed
manifest freshened without --sign-key came out unsigned while the log
said its signature verified. freshen now stops after loading such a
manifest, before scanning, with an error naming the signer's
fingerprint and --sign-key, and leaves the manifest as it was. With
--sign-key it rewrites and signs as before.

The library gains Signer() on the loaded manifest: the signing key's
fingerprint, or nil when the manifest is unsigned, as Checker.Signer
gives it.

Model: opus-5-5

README.md

@@ -300,6 +300,9 @@ are now tracked only in the [issues](https://git.eeqj.de/sneak/mfer/issues).
     - leaves out hidden files unless given `--include-dotfiles`, and symlinks
       unless given `--follow-symlinks`, which lists each symlink to a regular
       file under its own name with the contents of the file it points to
+    - refuses a signed manifest, leaving it as it was and naming the fingerprint
+      of the key that signed it, unless `--sign-key` or `MFER_SIGN_KEY` names a
+      key to sign the new one with
 - `mfer gen --sign-key key.asc` / `mfer freshen --sign-key key.asc`
     - signs the manifest with the OpenPGP secret key in `key.asc`, armored or
       binary, as `gpg --export-secret-keys` writes it; `MFER_SIGN_KEY` names the

docs/FORMAT.md

@@ -75,15 +75,15 @@ After decompressing `innerMessage`, the result is a serialized `MFFile`
 
 Each file entry contains:
 
-| Field      | Number | Type                      | Description                                                   |
-| ---------- | ------ | ------------------------- | ------------------------------------------------------------- |
-| `path`     | 1      | string                    | Relative file path (see Path Rules)                           |
-| `size`     | 2      | int64                     | File size in bytes                                            |
-| `hashes`   | 3      | repeated `MFFileChecksum` | At least one hash required; readers reject an entry with none |
-| `mimeType` | 301    | string (optional)         | MIME type                                                     |
-| `mtime`    | 302    | Timestamp (optional)      | Modification time                                             |
-| `ctime`    | 303    | Timestamp (optional)      | Change time (inode metadata change)                           |
-| `mode`     | 304    | uint32                    | Permission bits (see File Mode)                               |
+| Field      | Number | Type                      | Description                         |
+| ---------- | ------ | ------------------------- | ----------------------------------- |
+| `path`     | 1      | string                    | Relative file path (see Path Rules) |
+| `size`     | 2      | int64                     | File size in bytes                  |
+| `hashes`   | 3      | repeated `MFFileChecksum` | At least one hash required          |
+| `mimeType` | 301    | string (optional)         | MIME type                           |
+| `mtime`    | 302    | Timestamp (optional)      | Modification time                   |
+| `ctime`    | 303    | Timestamp (optional)      | Change time (inode metadata change) |
+| `mode`     | 304    | uint32                    | Permission bits (see File Mode)     |
 
 ## File Mode
 
@@ -174,10 +174,6 @@ also refuses a manifest whose `signingPubKey` holds a DSA key or subkey, or any
 secret key or subkey, since checking the self-signatures of a DSA key or the
 numbers of a secret key can take hours when those numbers are very large.
 
-A signing key that has expired does not make the signature bad, because a
-manifest outlives its key. A signature past its own expiry time is not good,
-whether or not the key has expired too.
-
 ## Deterministic Serialization
 
 By default, manifests are generated deterministically:

internal/cli/entry_test.go

@@ -771,9 +771,13 @@ func TestGenerateExcludesDotfilesByDefault(t *testing.T) {
 	assert.True(t, exists)
 
 	// Verify manifest only has 1 file (the non-dotfile)
-	paths := manifestPaths(t, fs, testMF)
-	require.Len(t, paths, 1)
-	assert.Equal(t, "file1.txt", paths[0])
+	manifest, err := mfer.NewManifestFromFile(&mfer.ManifestFromFileOptions{
+		Path: testMF,
+		Fs:   fs,
+	})
+	require.NoError(t, err)
+	assert.Len(t, manifest.Files(), 1)
+	assert.Equal(t, "file1.txt", manifest.Files()[0].GetPath())
 }
 
 func TestGenerateWithIncludeDotfiles(t *testing.T) {
@@ -794,7 +798,12 @@ func TestGenerateWithIncludeDotfiles(t *testing.T) {
 	require.Equal(t, 0, exitCode)
 
 	// Verify manifest has 2 files (including dotfile)
-	assert.Len(t, manifestPaths(t, fs, testMF), 2)
+	manifest, err := mfer.NewManifestFromFile(&mfer.ManifestFromFileOptions{
+		Path: testMF,
+		Fs:   fs,
+	})
+	require.NoError(t, err)
+	assert.Len(t, manifest.Files(), 2)
 }
 
 func TestMultipleInputPaths(t *testing.T) {
@@ -1215,11 +1224,6 @@ func TestGenerateFailsWithoutForceWhenOutputExists(t *testing.T) {
 func manifestPaths(t *testing.T, fs afero.Fs, path string) []string {
 	t.Helper()
 
-	// Loading a manifest logs to the process-global logger, so serialize
-	// with the CLI runs.
-	runMu.Lock()
-	defer runMu.Unlock()
-
 	manifest, err := mfer.NewManifestFromFile(&mfer.ManifestFromFileOptions{
 		Path: path,
 		Fs:   fs,

internal/cli/errmsg_test.go

@@ -54,11 +54,6 @@ func runLocked(fn func() error) error {
 func unsignedChecker(t *testing.T) *mfer.Checker {
 	t.Helper()
 
-	// The scan and the manifest load log to the process-global logger, so
-	// serialize with the CLI runs.
-	runMu.Lock()
-	defer runMu.Unlock()
-
 	fs := afero.NewMemMapFs()
 	require.NoError(t, fs.MkdirAll("/d", 0o755))
 	require.NoError(t, afero.WriteFile(fs, "/d/f.txt", []byte("hi"), 0o644))
@@ -188,11 +183,6 @@ func signedManifest(t *testing.T, files map[string][]byte) []byte {
 func signedChecker(t *testing.T, manifest []byte) *mfer.Checker {
 	t.Helper()
 
-	// Loading a manifest logs to the process-global logger, so serialize
-	// with the CLI runs.
-	runMu.Lock()
-	defer runMu.Unlock()
-
 	fs := afero.NewMemMapFs()
 	require.NoError(t, afero.WriteFile(fs, "/index.mf", manifest, 0o644))
 

internal/cli/export_test.go

@@ -20,11 +20,6 @@ const testCmdExport = "export"
 func buildTestManifest(t *testing.T, files map[string][]byte) []byte {
 	t.Helper()
 
-	// The scan logs to the process-global logger, so serialize with the
-	// CLI runs.
-	runMu.Lock()
-	defer runMu.Unlock()
-
 	sourceFs := afero.NewMemMapFs()
 	for path, content := range files {
 		require.NoError(t, sourceFs.MkdirAll("/", 0o755))

internal/cli/fetch_test.go

@@ -171,11 +171,6 @@ func TestResolveManifestURL(t *testing.T) {
 func scanToManifest(t *testing.T, sourceFs afero.Fs) []byte {
 	t.Helper()
 
-	// The scan logs to the process-global logger, so serialize with the
-	// CLI runs.
-	runMu.Lock()
-	defer runMu.Unlock()
-
 	s := mfer.NewScannerWithOptions(&mfer.ScannerOptions{Fs: sourceFs})
 	require.NoError(t, s.EnumerateFS(sourceFs, "/", nil))
 
@@ -319,11 +314,8 @@ func TestFetchFromHTTP(t *testing.T) {
 	// Change to a fresh destination directory for the test
 	destDir := chdirTemp(t)
 
-	// Parse the manifest to get file entries. Loading a manifest logs to
-	// the process-global logger.
-	runMu.Lock()
+	// Parse the manifest to get file entries
 	manifest, err := mfer.NewManifestFromReader(bytes.NewReader(manifestData))
-	runMu.Unlock()
 	require.NoError(t, err)
 
 	files := manifest.Files()
@@ -373,10 +365,7 @@ func TestFetchHashMismatch(t *testing.T) {
 	// Generate and parse manifest
 	manifestData := scanToManifest(t, sourceFs)
 
-	// Loading a manifest logs to the process-global logger.
-	runMu.Lock()
 	manifest, err := mfer.NewManifestFromReader(bytes.NewReader(manifestData))
-	runMu.Unlock()
 	require.NoError(t, err)
 
 	files := manifest.Files()
@@ -422,10 +411,7 @@ func TestFetchSizeMismatch(t *testing.T) {
 	// Generate and parse manifest
 	manifestData := scanToManifest(t, sourceFs)
 
-	// Loading a manifest logs to the process-global logger.
-	runMu.Lock()
 	manifest, err := mfer.NewManifestFromReader(bytes.NewReader(manifestData))
-	runMu.Unlock()
 	require.NoError(t, err)
 
 	files := manifest.Files()
@@ -537,10 +523,7 @@ func TestFetchProgress(t *testing.T) {
 	// Generate and parse manifest
 	manifestData := scanToManifest(t, sourceFs)
 
-	// Loading a manifest logs to the process-global logger.
-	runMu.Lock()
 	manifest, err := mfer.NewManifestFromReader(bytes.NewReader(manifestData))
-	runMu.Unlock()
 	require.NoError(t, err)
 
 	files := manifest.Files()
@@ -914,12 +897,9 @@ func TestGetStopsWaitingWhenCanceled(t *testing.T) {
 //nolint:paralleltest // changes the process-global working directory
 func TestDownloadFileRetriesToSuccess(t *testing.T) {
 	content := []byte("the whole file, every byte of it")
-	manifestData := manifestOf(t, map[string][]byte{testFileTxt: content})
 
-	// Loading a manifest logs to the process-global logger.
-	runMu.Lock()
-	manifest, err := mfer.NewManifestFromReader(bytes.NewReader(manifestData))
-	runMu.Unlock()
+	manifest, err := mfer.NewManifestFromReader(bytes.NewReader(
+		manifestOf(t, map[string][]byte{testFileTxt: content})))
 	require.NoError(t, err)
 
 	var requests atomic.Int32
@@ -942,11 +922,8 @@ func TestDownloadFileRetriesToSuccess(t *testing.T) {
 
 	chdirTemp(t)
 
-	// downloadFile logs each retry to the process-global logger.
-	err = runLocked(func() error {
-		return downloadFile(context.Background(), testClient(),
-			server.URL+"/"+testFileTxt, ".", testFileTxt, manifest.Files()[0], nil)
-	})
+	err = downloadFile(context.Background(), testClient(),
+		server.URL+"/"+testFileTxt, ".", testFileTxt, manifest.Files()[0], nil)
 	require.NoError(t, err)
 	assert.Equal(t, int32(3), requests.Load())
 
@@ -1427,18 +1404,14 @@ func TestFetchSetsRecordedMode(t *testing.T) {
 		require.NoError(t, afero.WriteFile(sourceFs, "/"+p, content, modes[p]))
 	}
 
+	scanner := mfer.NewScannerWithOptions(&mfer.ScannerOptions{
+		Fs:                 sourceFs,
+		IncludePermissions: true,
+	})
+	require.NoError(t, scanner.EnumerateFS(sourceFs, "/", nil))
+
 	var manifest bytes.Buffer
-
-	// The scan logs to the process-global logger.
-	require.NoError(t, runLocked(func() error {
-		scanner := mfer.NewScannerWithOptions(&mfer.ScannerOptions{
-			Fs:                 sourceFs,
-			IncludePermissions: true,
-		})
-		require.NoError(t, scanner.EnumerateFS(sourceFs, "/", nil))
-
-		return scanner.ToManifest(context.Background(), &manifest, nil)
-	}))
+	require.NoError(t, scanner.ToManifest(context.Background(), &manifest, nil))
 
 	tree := fetchTestHandler(manifest.Bytes(), files)
 

internal/cli/freshen.go

@@ -28,15 +28,13 @@ const (
 	scanProgressInterval = 100
 )
 
-var (
-	// errEntryMissingMtime indicates a manifest entry that carries no
-	// modification time where one is required to carry it forward unchanged.
-	errEntryMissingMtime = errors.New("manifest entry has no mtime")
+// errEntryMissingMtime indicates a manifest entry that carries no
+// modification time where one is required to carry it forward unchanged.
+var errEntryMissingMtime = errors.New("manifest entry has no mtime")
 
-	// errEntryMissingHash indicates a manifest entry that carries no hash
-	// to carry forward.
-	errEntryMissingHash = errors.New("manifest entry has no hash")
-)
+// errSignKeyNeeded indicates a signed manifest given to freshen with no
+// key to sign the rewritten one.
+var errSignKeyNeeded = errors.New("give --sign-key to keep it signed")
 
 // FreshenStatus contains progress information for the freshen operation.
 type FreshenStatus struct {
@@ -481,9 +479,10 @@ func runFreshenHash(
 }
 
 // loadExistingEntries loads the manifest and indexes its file entries
-// by path.
+// by path. It refuses a signed manifest when no --sign-key is given, as
+// the rewritten manifest would be unsigned.
 func (mfa *CLIApp) loadExistingEntries(
-	manifestPath string,
+	cmd *cli.Command, manifestPath string,
 ) (map[string]*mfer.MFFilePath, error) {
 	log.Infof("loading manifest from %s", manifestPath)
 
@@ -496,6 +495,10 @@ func (mfa *CLIApp) loadExistingEntries(
 		return nil, fmt.Errorf("load manifest: %w", err)
 	}
 
+	if signer := manifest.Signer(); signer != nil && cmd.String("sign-key") == "" {
+		return nil, fmt.Errorf("manifest is signed by %s: %w", signer, errSignKeyNeeded)
+	}
+
 	existingFiles := manifest.Files()
 	log.Infof("manifest contains %d files", len(existingFiles))
 
@@ -526,7 +529,7 @@ func (mfa *CLIApp) freshenManifestOperation(
 		return err
 	}
 
-	existingByPath, err := mfa.loadExistingEntries(manifestPath)
+	existingByPath, err := mfa.loadExistingEntries(cmd, manifestPath)
 	if err != nil {
 		return err
 	}
@@ -650,8 +653,6 @@ func addFileToBuilder(
 // Entries reach this path only when recordEntry classified them as
 // unchanged, which requires a recorded mtime, so an absent mtime here is
 // an error rather than something to paper over with the Unix epoch.
-// Loading refuses an entry with no hash; one that got here anyway is an
-// error too, not a file to leave out of the manifest.
 func addExistingToBuilder(b *mfer.Builder, entry *mfer.MFFilePath) error {
 	mtime, ok := entryMtime(entry)
 	if !ok {
@@ -659,7 +660,7 @@ func addExistingToBuilder(b *mfer.Builder, entry *mfer.MFFilePath) error {
 	}
 
 	if len(entry.GetHashes()) == 0 {
-		return fmt.Errorf("%w: %s", errEntryMissingHash, entry.GetPath())
+		return nil
 	}
 
 	err := b.AddFileWithHash(mfer.RelFilePath(entry.GetPath()),

internal/cli/freshen_test.go

@@ -70,11 +70,6 @@ func runFreshen(t *testing.T, fs afero.Fs, root, manifestPath string) {
 func manifestFiles(t *testing.T, fs afero.Fs, path string) []*mfer.MFFilePath {
 	t.Helper()
 
-	// Loading a manifest logs to the process-global logger, so serialize
-	// with the CLI runs.
-	runMu.Lock()
-	defer runMu.Unlock()
-
 	manifest, err := mfer.NewManifestFromFile(&mfer.ManifestFromFileOptions{
 		Path: path,
 		Fs:   fs,
@@ -441,11 +436,7 @@ func TestFreshenRecordEntryMtimePresence(t *testing.T) {
 			s := &freshenScanner{
 				existingByPath: map[string]*mfer.MFFilePath{relPath: tc.entry},
 			}
-
-			// recordEntry logs to the process-global logger.
-			runMu.Lock()
 			s.recordEntry(relPath, info)
-			runMu.Unlock()
 
 			require.Len(t, s.entries, 1)
 			assert.Equal(t, tc.needsHash, s.entries[0].needsHash)
@@ -480,24 +471,6 @@ func TestFreshenAddExistingRejectsMissingMtime(t *testing.T) {
 	assert.Contains(t, err.Error(), "file1.txt")
 }
 
-// TestFreshenAddExistingRejectsMissingHash pins that an entry with no hash
-// is an error rather than a file left out of the rebuilt manifest.
-func TestFreshenAddExistingRejectsMissingHash(t *testing.T) {
-	t.Parallel()
-
-	b := mfer.NewBuilder()
-	entry := &mfer.MFFilePath{
-		Path:  "data.bin",
-		Size:  8,
-		Mtime: &mfer.Timestamp{Seconds: 1_700_000_000},
-	}
-
-	err := addExistingToBuilder(b, entry)
-	require.ErrorIs(t, err, errEntryMissingHash)
-	assert.Contains(t, err.Error(), "data.bin")
-	assert.Zero(t, b.FileCount())
-}
-
 // TestFreshenAddExistingRejectsShortHash pins that an existing manifest
 // entry whose hash the builder refuses is reported as a problem with the
 // manifest, with the command that fixes it.

internal/cli/signing_test.go

@@ -73,6 +73,56 @@ func TestGenAndFreshenSignWithKeyFile(t *testing.T) {
 	}
 }
 
+// TestFreshenSignedManifestNeedsSignKey runs freshen on a signed manifest
+// after a file is added. Without --sign-key it must fail, naming the
+// signer and --sign-key, and leave the manifest as it was; with --sign-key
+// it must rewrite the manifest, signed.
+func TestFreshenSignedManifestNeedsSignKey(t *testing.T) {
+	t.Setenv(envSignKeyPassphrase, "")
+
+	secretKey, fingerprint := testSecretKey(t, nil, nil)
+
+	fs := afero.NewOsFs()
+	keyFile := filepath.Join(t.TempDir(), "key.asc")
+	root := t.TempDir()
+	manifestPath := filepath.Join(root, defaultManifestName)
+
+	require.NoError(t, afero.WriteFile(fs, keyFile, secretKey, 0o600))
+	writeTestFile(t, fs, filepath.Join(root, testFileTxt), "hello")
+
+	opts := testOpts([]string{
+		testApp, cmdGenerate, "-q", testFlagSignKey, keyFile,
+		"-o", manifestPath, root,
+	}, fs)
+	require.Equal(t, 0, runCLI(opts), testStderr(t, opts))
+
+	before, err := afero.ReadFile(fs, manifestPath)
+	require.NoError(t, err)
+
+	writeTestFile(t, fs, filepath.Join(root, "added.txt"), "added")
+
+	opts = testOpts([]string{testApp, cmdFreshen, "-q", manifestPath}, fs)
+	assert.Equal(t, 1, runCLI(opts))
+	assert.Contains(t, testStderr(t, opts), fingerprint)
+	assert.Contains(t, testStderr(t, opts), testFlagSignKey)
+
+	after, err := afero.ReadFile(fs, manifestPath)
+	require.NoError(t, err)
+	assert.Equal(t, before, after)
+
+	opts = testOpts([]string{
+		testApp, cmdFreshen, "-q", testFlagSignKey, keyFile, manifestPath,
+	}, fs)
+	require.Equal(t, 0, runCLI(opts), testStderr(t, opts))
+
+	opts = testOpts([]string{
+		testApp, cmdCheck, "-q",
+		"--" + flagRequireSignature, fingerprint, manifestPath,
+	}, fs)
+	require.Equal(t, 0, runCLI(opts), testStderr(t, opts))
+	assert.Len(t, manifestFiles(t, fs, manifestPath), 2)
+}
+
 // TestSignWithProtectedKeyNeedsPassphrase runs gen with a protected key,
 // with MFER_SIGN_KEY_PASSPHRASE empty and no terminal to ask on. gen must
 // fail, naming the variable, and write no manifest.

mfer/deserialize.go

@@ -27,7 +27,6 @@ var (
 	errUUIDMismatch         = errors.New("outer and inner UUID mismatch")
 	errInvalidFileFormat    = errors.New("invalid file format")
 	errInvalidManifestPath  = errors.New("invalid file entry")
-	errEntryMissingHash     = errors.New("file entry has no hash")
 	errDecodedTooLarge      = errors.New("too much memory needed")
 	errSignerNotSigningKey  = errors.New(
 		"signer is not the fingerprint of the key that made the signature")
@@ -294,8 +293,7 @@ func (m *manifest) deserializeInner() error {
 	// untrusted .mf. Reject loudly on the first offender rather than
 	// dropping entries, which would let a hostile manifest hide files from a
 	// check. A path listed twice is refused too: check would check the one
-	// file against both entries. So is an entry with no hash: there is
-	// nothing to check the file against.
+	// file against both entries.
 	seen := make(map[string]bool, len(m.pbInner.GetFiles()))
 
 	for _, f := range m.pbInner.GetFiles() {
@@ -304,10 +302,6 @@ func (m *manifest) deserializeInner() error {
 			return fmt.Errorf("%w: %w", errInvalidManifestPath, err)
 		}
 
-		if len(f.GetHashes()) == 0 {
-			return fmt.Errorf("%w: %q", errEntryMissingHash, f.GetPath())
-		}
-
 		if seen[f.GetPath()] {
 			return fmt.Errorf("%w %q", errDuplicatePath, f.GetPath())
 		}

mfer/deserialize_path_test.go

@@ -165,24 +165,6 @@ func TestDeserializeRefusesPathListedTwice(t *testing.T) {
 	}
 }
 
-// A manifest holding a file entry with no hash is refused as it is loaded,
-// naming the path: there is nothing to check the file against.
-func TestDeserializeRefusesEntryWithNoHash(t *testing.T) {
-	t.Parallel()
-
-	id := uuid.NewV4()
-	inner, err := proto.Marshal(&MFFile{
-		Version: MFFile_VERSION_ONE,
-		Files:   []*MFFilePath{{Path: "x", Size: 1}},
-		Uuid:    id[:],
-	})
-	require.NoError(t, err)
-
-	_, err = NewManifestFromReader(bytes.NewReader(wrapInner(t, id, inner)))
-	require.ErrorIs(t, err, errEntryMissingHash)
-	require.EqualError(t, err, `file entry has no hash: "x"`)
-}
-
 // Entries of a path, an empty hash, an empty MIME type and empty modification
 // and change times are counted at 432 bytes each (176 + 112 + 16 + 64 + 64)
 // and take 16 bytes plus the path to encode. A 37-character path makes that
@@ -247,8 +229,6 @@ func TestDeserializeDropsUnknownFields(t *testing.T) {
 
 	entry := protowire.AppendTag(nil, 1, protowire.BytesType) // MFFilePath.path
 	entry = protowire.AppendString(entry, "a")
-	entry = protowire.AppendTag(entry, 3, protowire.BytesType) // MFFilePath.hashes
-	entry = protowire.AppendBytes(entry, nil)
 	entry = append(entry, unknown...)
 
 	id := uuid.NewV4()

mfer/manifest.go

@@ -47,6 +47,17 @@ func (m *manifest) Files() []*MFFilePath {
 	return m.pbInner.GetFiles()
 }
 
+// Signer returns the fingerprint of the key that made a loaded manifest's
+// signature, which loading the manifest checked, or nil if the manifest is
+// not signed.
+func (m *manifest) Signer() []byte {
+	if len(m.pbOuter.GetSignature()) == 0 {
+		return nil
+	}
+
+	return m.pbOuter.GetSigner()
+}
+
 // signatureString generates the canonical string used for signing/verification.
 // Format: MAGIC-UUID-MULTIHASH where UUID and multihash are hex-encoded.
 // Requires pbOuter to be set with Uuid and Sha256 fields.

mfer/openpgp.go

@@ -8,7 +8,6 @@ import (
 	"io"
 	"slices"
 	"strings"
-	"time"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
@@ -243,10 +242,10 @@ func fingerprint(key *openpgp.Entity) string {
 	return strings.ToUpper(hex.EncodeToString(key.PrimaryKey.Fingerprint))
 }
 
-// verifySignature checks that signature is one good, unexpired OpenPGP
-// signature over data, made by the one primary key in pubKey or one of its
-// subkeys, and returns that primary key's fingerprint. signature and pubKey
-// may each be armored or binary.
+// verifySignature checks that signature is one good OpenPGP signature
+// over data, made by the one primary key in pubKey or one of its subkeys,
+// and returns that primary key's fingerprint. signature and pubKey may each
+// be armored or binary.
 func verifySignature(data, signature, pubKey []byte) (string, error) {
 	key, err := readOneKey(pubKey, "embedded public key block", true)
 	if err != nil {
@@ -267,16 +266,10 @@ func verifySignature(data, signature, pubKey []byte) (string, error) {
 		return "", fmt.Errorf("%w, found %d", errNotOneSignature, sigs)
 	}
 
-	sig, _, err := openpgp.VerifyDetachedSignature(openpgp.EntityList{key},
+	_, err = openpgp.CheckDetachedSignature(openpgp.EntityList{key},
 		bytes.NewReader(data), bytes.NewReader(sigData), nil)
 	// A manifest outlives its signing key, so a signature by a key that
-	// has expired since is still good, unless the signature has expired
-	// itself. The library does not check that once it finds the key
-	// expired.
-	if errors.Is(err, pgperrors.ErrKeyExpired) && sig.SigExpired(time.Now()) {
-		err = pgperrors.ErrSignatureExpired
-	}
-
+	// has expired since is still good.
 	if err != nil && !errors.Is(err, pgperrors.ErrKeyExpired) {
 		return "", fmt.Errorf("verify signature: %w", err)
 	}

mfer/openpgp_test.go

@@ -18,7 +18,6 @@ import (
 	"github.com/ProtonMail/go-crypto/openpgp"
 	"github.com/ProtonMail/go-crypto/openpgp/armor"
 	"github.com/ProtonMail/go-crypto/openpgp/elgamal"
-	pgperrors "github.com/ProtonMail/go-crypto/openpgp/errors"
 	"github.com/ProtonMail/go-crypto/openpgp/packet"
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
@@ -176,6 +175,25 @@ func TestBuilderWithSigning(t *testing.T) {
 		"-----BEGIN PGP PUBLIC KEY BLOCK-----")
 }
 
+// TestManifestSigner checks that Signer gives the signing key's
+// fingerprint for a signed manifest, and nil once the signature is taken
+// out, although the signer field is still there.
+func TestManifestSigner(t *testing.T) {
+	t.Parallel()
+
+	key := newTestKey(t, nil)
+	data := signedTestManifest(t, &SigningOptions{SecretKey: armoredSecretKeys(t, key)})
+
+	signed, err := NewManifestFromReader(bytes.NewReader(data))
+	require.NoError(t, err)
+	assert.Equal(t, fingerprint(key), string(signed.Signer()))
+
+	unsigned, err := NewManifestFromReader(bytes.NewReader(
+		rewriteOuter(t, data, func(outer *MFFileOuter) { outer.Signature = nil })))
+	require.NoError(t, err)
+	assert.Nil(t, unsigned.Signer())
+}
+
 func TestScannerWithSigning(t *testing.T) {
 	t.Parallel()
 
@@ -417,10 +435,8 @@ func TestVerifySignature(t *testing.T) {
 	assert.Error(t, err)
 }
 
-// TestVerifySignatureKeyExpiredSince verifies two signatures made in 2020
-// by a key that expired a day after it was made. A signature with no
-// expiry time is still good. One that expired an hour after it was made is
-// refused, although the key has expired too.
+// TestVerifySignatureKeyExpiredSince verifies a signature made in 2020 by
+// a key that expired a day after it was made. The signature is still good.
 func TestVerifySignatureKeyExpiredSince(t *testing.T) {
 	t.Parallel()
 
@@ -432,14 +448,9 @@ func TestVerifySignatureKeyExpiredSince(t *testing.T) {
 	key := newTestKey(t, config)
 	data := []byte("signed in 2020")
 
-	var sig, expiringSig bytes.Buffer
+	var sig bytes.Buffer
 
 	require.NoError(t, openpgp.ArmoredDetachSign(&sig, key, bytes.NewReader(data), config))
-	require.NoError(t, openpgp.ArmoredDetachSign(&expiringSig, key,
-		bytes.NewReader(data), &packet.Config{
-			Time:            config.Time,
-			SigLifetimeSecs: uint32(time.Hour.Seconds()),
-		}))
 
 	pubKey, err := armoredPublicKey(key)
 	require.NoError(t, err)
@@ -447,9 +458,6 @@ func TestVerifySignatureKeyExpiredSince(t *testing.T) {
 	signer, err := verifySignature(data, sig.Bytes(), pubKey)
 	require.NoError(t, err)
 	assert.Equal(t, fingerprint(key), signer)
-
-	_, err = verifySignature(data, expiringSig.Bytes(), pubKey)
-	require.ErrorIs(t, err, pgperrors.ErrSignatureExpired)
 }
 
 func TestManifestSignatureVerification(t *testing.T) {