Enforce real timeouts on gpg subprocess calls (closes #62)

Every gpg run now has a one-minute deadline (gpgTimeout) on top of its
caller's context and is killed when either ends. A timeout is reported
as "gpg timed out" under the failing operation instead of "signal:
killed". Only gpg itself is killed; WaitDelay (one second) stops the run
from waiting on a process gpg left behind that still holds its output,
such as a wrapper script that does not exec the real gpg.
Builder.Build and Checker.ExtractEmbeddedSigningKeyFP take a context, so
ToManifest's context now reaches signing and the contextcheck
suppression calling signing non-cancellable is gone. Manifest loading
takes no context, so its signature check is bounded by the timeout
alone.

Model: opus-5-5

README.md

@@ -417,8 +417,8 @@ proto `go_package` option. Which is canonical?
       matching Scanner
 - [ ] Add `--deterministic` flag or make it default — omit `createdAt`, sort
       files (pending design question answer)
-- [x] Wire `--version` flag properly: `--version` and `-V` print the same line
+- [ ] Wire `--version` flag properly (currently only a `version` subcommand
-      as the `version` subcommand, and `-v` means verbose
+      exists; top-level `--version` shows urfave/cli generic output)
 - [ ] Add retry logic to `fetch` — currently no retries on transient HTTP
       errors; needs exponential backoff
 - [ ] `fetch` command uses bare `http.Get` with no timeout — needs `http.Client`

TODO.md

@@ -24,8 +24,10 @@ only thing left of the `chore/align-repo-policies` branch is the list below.
 
 # Completed Steps
 
-- 2026-09-21: fixed the `-v` collision between `--verbose` and `--version`;
+- 2026-10-03: every gpg run is killed after one minute or when its caller's
-  verbose owns `-v`, and version answers to `--version` and `-V` (#64)
+  context ends, and a timeout reads as "gpg timed out" under the failing
+  operation; `Builder.Build` and `Checker.ExtractEmbeddedSigningKeyFP` take a
+  context, which reaches gpg (#62)
 - 2026-10-03: pinned the CLI error messages by driving the functions that emit
   them in `internal/cli/errmsg_test.go`, and made the freshen mtime-presence
   test distinguish an absent mtime from the epoch (#87)
@@ -120,8 +122,7 @@ only thing left of the `chore/align-repo-policies` branch is the list below.
     - Add decompression size limit via io.LimitReader in deserializeInner()
     - Fix errors.Is dead code in checker; make AddFile verify totalRead == size
     - Export manifest type or define a public interface (pending)
-    - Replace GPG subprocess with pure-Go crypto (pending); add timeouts to
+    - Replace GPG subprocess with pure-Go crypto (pending)
-      remaining subprocess calls
 - CLI:
     - Kebab-case primary flag names; fix fetch URL construction with
       url.JoinPath; add http.Client timeout and retry with backoff to fetch;

internal/cli/check.go

@@ -2,6 +2,7 @@
 package cli
 
 import (
+	"context"
 	"encoding/hex"
 	"errors"
 	"fmt"
@@ -126,7 +127,9 @@ func (mfa *CLIApp) fetchManifestToTemp(url string) (string, error) {
 
 // verifyRequiredSigner enforces the --require-signature fingerprint
 // against the manifest's embedded signing key.
-func verifyRequiredSigner(chk *mfer.Checker, requiredSigner string) error {
+func verifyRequiredSigner(
+	ctx context.Context, chk *mfer.Checker, requiredSigner string,
+) error {
 	// Validate fingerprint format: must be exactly 40 hex characters
 	if len(requiredSigner) != fingerprintHexLen {
 		return fmt.Errorf("%w, got %d", errInvalidFingerprint, len(requiredSigner))
@@ -145,7 +148,7 @@ func verifyRequiredSigner(chk *mfer.Checker, requiredSigner string) error {
 	// Extract fingerprint from the embedded public key (not from the
 	// signer field). This validates the key is importable and gets its
 	// actual fingerprint.
-	embeddedFP, err := chk.ExtractEmbeddedSigningKeyFP()
+	embeddedFP, err := chk.ExtractEmbeddedSigningKeyFP(ctx)
 	if err != nil {
 		return fmt.Errorf(
 			"failed to extract fingerprint from embedded signing key: %w", err)
@@ -303,7 +306,7 @@ func (mfa *CLIApp) checkManifestOperation(ctx *cli.Context) error {
 	// Check signature requirement
 	requiredSigner := ctx.String("require-signature")
 	if requiredSigner != "" {
-		err = verifyRequiredSigner(chk, requiredSigner)
+		err = verifyRequiredSigner(ctx.Context, chk, requiredSigner)
 		if err != nil {
 			return err
 		}

internal/cli/entry_test.go

@@ -27,7 +27,6 @@ const (
 	testManifest    = "/manifest.mf"
 	testFlagBase    = "--base"
 	testFlagNoExtra = "--no-extra-files"
-	testFlagVersion = "--version"
 )
 
 var errSimulatedWrite = errors.New("simulated write failure")
@@ -103,7 +102,7 @@ func TestVersionCommand(t *testing.T) {
 	t.Parallel()
 
 	fs := afero.NewMemMapFs()
-	opts := testOpts([]string{testApp, cmdVersion}, fs)
+	opts := testOpts([]string{testApp, "version"}, fs)
 
 	exitCode := runCLI(opts)
 
@@ -114,110 +113,6 @@ func TestVersionCommand(t *testing.T) {
 	assert.Contains(t, stdout, "abc123")
 }
 
-// TestVFlagCollision covers the -v/--verbose vs --version flag interaction
-// (issue #64). Verbose owns -v; version answers to --version and -V. None of
-// these invocations may produce a parser error, and the two ways of asking
-// for the version must print the same thing.
-func TestVFlagCollision(t *testing.T) {
-	t.Parallel()
-
-	// Invocations that must print the version and exit 0.
-	versionCases := map[string][]string{
-		"long version flag":        {testApp, testFlagVersion},
-		"short version flag":       {testApp, "-V"},
-		"verbose then version":     {testApp, "-v", testFlagVersion},
-		"long verbose and version": {testApp, "--verbose", testFlagVersion},
-	}
-
-	for name, args := range versionCases {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			opts := testOpts(args, afero.NewMemMapFs())
-			exitCode := runCLI(opts)
-
-			assert.Equal(t, 0, exitCode, "stderr: %s", testStderr(t, opts))
-			assert.Contains(t, testStdout(t, opts), mfer.Version)
-			assert.NotContains(t, testStderr(t, opts), "two forms of the same flag")
-		})
-	}
-
-	// Invocations that must enable verbose and exit 0 without a parser error.
-	verboseCases := map[string][]string{
-		"short verbose flag": {testApp, "-v"},
-		"long verbose flag":  {testApp, "--verbose"},
-	}
-
-	for name, args := range verboseCases {
-		t.Run(name, func(t *testing.T) {
-			t.Parallel()
-
-			opts := testOpts(args, afero.NewMemMapFs())
-			exitCode := runCLI(opts)
-
-			assert.Equal(t, 0, exitCode, "stderr: %s", testStderr(t, opts))
-			assert.Contains(t, testStdout(t, opts), cmdGenerate,
-				"root should show help listing subcommands")
-			assert.Empty(t, testStderr(t, opts))
-		})
-	}
-}
-
-// TestVersionFlagAndCommandMatch asserts that "mfer --version" and
-// "mfer version" produce identical output (issue #64).
-func TestVersionFlagAndCommandMatch(t *testing.T) {
-	t.Parallel()
-
-	flagOpts := testOpts([]string{testApp, testFlagVersion}, afero.NewMemMapFs())
-	require.Equal(t, 0, runCLI(flagOpts))
-
-	cmdOpts := testOpts([]string{testApp, cmdVersion}, afero.NewMemMapFs())
-	require.Equal(t, 0, runCLI(cmdOpts))
-
-	assert.Equal(t, testStdout(t, flagOpts), testStdout(t, cmdOpts))
-}
-
-// TestVerbosityFlagsBeforeSubcommand asserts that -q and -v given before the
-// subcommand name take effect in that subcommand (issue #64).
-func TestVerbosityFlagsBeforeSubcommand(t *testing.T) {
-	t.Parallel()
-
-	t.Run("quiet before fetch hides the banner", func(t *testing.T) {
-		t.Parallel()
-
-		opts := testOpts([]string{testApp, "-q", cmdFetch}, afero.NewMemMapFs())
-
-		assert.Equal(t, 1, runCLI(opts))
-		assert.Contains(t, testStderr(t, opts), errURLRequired.Error())
-		assert.NotContains(t, testStdout(t, opts), banner)
-	})
-
-	t.Run("verbose twice before fetch enables debug logging", func(t *testing.T) {
-		t.Parallel()
-
-		opts := testOpts([]string{testApp, "-v", "-v", cmdFetch}, afero.NewMemMapFs())
-
-		assert.Equal(t, 1, runCLI(opts))
-		assert.Contains(t, testStderr(t, opts), "fetchManifestOperation()")
-	})
-
-	t.Run("quiet before export hides the manifest summary", func(t *testing.T) {
-		t.Parallel()
-
-		fs := afero.NewMemMapFs()
-		manifest := buildTestManifest(t, map[string][]byte{"a.txt": []byte("a")})
-		require.NoError(t, afero.WriteFile(fs, testManifest, manifest, 0o644))
-
-		loud := testOpts([]string{testApp, cmdExport, testManifest}, fs)
-		require.Equal(t, 0, runCLI(loud))
-		assert.Contains(t, testStderr(t, loud), "loaded manifest")
-
-		quiet := testOpts([]string{testApp, "-q", cmdExport, testManifest}, fs)
-		require.Equal(t, 0, runCLI(quiet))
-		assert.NotContains(t, testStderr(t, quiet), "loaded manifest")
-	})
-}
-
 func TestHelpCommand(t *testing.T) {
 	t.Parallel()
 

internal/cli/errmsg_test.go

@@ -5,7 +5,6 @@ import (
 	"bytes"
 	"context"
 	"flag"
-	"io"
 	"net/http"
 	"net/http/httptest"
 	"os"
@@ -17,7 +16,6 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	urfcli "github.com/urfave/cli/v2"
-	"sneak.berlin/go/mfer/internal/log"
 	"sneak.berlin/go/mfer/mfer"
 )
 
@@ -38,16 +36,12 @@ const (
 	msgFpB = "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
 )
 
-// runLocked runs fn while holding runMu and with the process-global logger
+// runLocked runs fn while holding runMu, so operations that write to the
-// pointed at io.Discard, so fn's log lines neither race the other CLI runs
+// process-global logger do not race the other CLI runs.
-// nor land in the last run's buffers, which its test may still be reading.
 func runLocked(fn func() error) error {
 	runMu.Lock()
 	defer runMu.Unlock()
 
-	log.SetOutput(io.Discard, io.Discard)
-	log.Init()
-
 	return fn()
 }
 
@@ -89,7 +83,8 @@ func TestVerifyRequiredSignerMessages(t *testing.T) {
 	t.Run("invalid fingerprint length", func(t *testing.T) {
 		t.Parallel()
 
-		err := verifyRequiredSigner(unsignedChecker(t), "12345678")
+		err := verifyRequiredSigner(context.Background(),
+			unsignedChecker(t), "12345678")
 		require.ErrorIs(t, err, errInvalidFingerprint)
 		assert.EqualError(t, err,
 			"invalid fingerprint: must be exactly 40 hex characters, got 8")
@@ -98,7 +93,8 @@ func TestVerifyRequiredSignerMessages(t *testing.T) {
 	t.Run("manifest not signed", func(t *testing.T) {
 		t.Parallel()
 
-		err := verifyRequiredSigner(unsignedChecker(t), msgFpA)
+		err := verifyRequiredSigner(context.Background(),
+			unsignedChecker(t), msgFpA)
 		require.ErrorIs(t, err, errManifestNotSigned)
 		assert.EqualError(t, err,
 			"manifest is not signed, but signature from "+msgFpA+" is required")
@@ -115,10 +111,10 @@ func TestVerifyRequiredSignerMessages(t *testing.T) {
 func TestSignerMismatchMessage(t *testing.T) {
 	chk := signedChecker(t)
 
-	embeddedFP, err := chk.ExtractEmbeddedSigningKeyFP()
+	embeddedFP, err := chk.ExtractEmbeddedSigningKeyFP(context.Background())
 	require.NoError(t, err)
 
-	err = verifyRequiredSigner(chk, msgFpB)
+	err = verifyRequiredSigner(context.Background(), chk, msgFpB)
 	require.ErrorIs(t, err, errSignerMismatch)
 	assert.EqualError(t, err,
 		"embedded signing key fingerprint "+embeddedFP+
@@ -166,7 +162,7 @@ func signedChecker(t *testing.T) *mfer.Checker {
 
 	var buf bytes.Buffer
 
-	require.NoError(t, b.Build(&buf))
+	require.NoError(t, b.Build(context.Background(), &buf))
 
 	fs := afero.NewMemMapFs()
 	require.NoError(t, afero.WriteFile(fs, "/index.mf", buf.Bytes(), 0o644))

internal/cli/freshen.go

@@ -1,6 +1,7 @@
 package cli
 
 import (
+	"context"
 	"crypto/sha256"
 	"errors"
 	"fmt"
@@ -304,7 +305,7 @@ func (h *freshenHasher) processEntry(e *freshenEntry) error {
 // writeFreshenedManifest writes the manifest atomically (write to a
 // temp file, then rename over the target).
 func writeFreshenedManifest(
-	afs afero.Fs, builder *mfer.Builder, manifestPath string,
+	ctx context.Context, afs afero.Fs, builder *mfer.Builder, manifestPath string,
 ) error {
 	tmpPath := manifestPath + ".tmp"
 
@@ -313,7 +314,7 @@ func writeFreshenedManifest(
 		return fmt.Errorf("failed to create temp file: %w", err)
 	}
 
-	err = builder.Build(outFile)
+	err = builder.Build(ctx, outFile)
 	_ = outFile.Close()
 
 	if err != nil {
@@ -530,7 +531,7 @@ func (mfa *CLIApp) freshenManifestOperation(ctx *cli.Context) error {
 	}
 
 	// Write updated manifest atomically (write to temp, then rename)
-	err = writeFreshenedManifest(mfa.Fs, hasher.builder, manifestPath)
+	err = writeFreshenedManifest(ctx.Context, mfa.Fs, hasher.builder, manifestPath)
 	if err != nil {
 		return err
 	}

internal/cli/mfer.go

@@ -19,7 +19,6 @@ const (
 	cmdCheck    = "check"
 	cmdExport   = "export"
 	cmdFetch    = "fetch"
-	cmdVersion  = "version"
 
 	flagProgress = "progress"
 
@@ -69,12 +68,6 @@ func (mfa *CLIApp) VersionString() string {
 	return mfer.Version
 }
 
-// printVersion writes the version line shared by the --version flag and the
-// version subcommand, so both produce identical output.
-func (mfa *CLIApp) printVersion() {
-	_, _ = fmt.Fprintf(mfa.Stdout, "%s version %s\n", mfa.appname, mfa.VersionString())
-}
-
 func (mfa *CLIApp) printBanner() {
 	if log.GetLevel() <= log.InfoLevel {
 		_, _ = fmt.Fprintln(mfa.Stdout, banner)
@@ -85,34 +78,20 @@ func (mfa *CLIApp) printBanner() {
 	}
 }
 
-// setVerbosity sets the log level from -v and -q, given before the subcommand
-// name (the root's copies), after it (the subcommand's own copies), or both.
-// urfave/cli reads a flag from the nearest command that defines it, so each
-// command in the lineage is asked. The highest -v count wins rather than the
-// sum, because a subcommand without its own copies reads the root's.
 func (mfa *CLIApp) setVerbosity(c *cli.Context) {
 	_, present := os.LookupEnv("MFER_DEBUG")
 
-	verbosity := 0
-	quiet := false
-
-	for _, ctx := range c.Lineage() {
-		verbosity = max(verbosity, ctx.Count("verbose"))
-		quiet = quiet || ctx.Bool("quiet")
-	}
-
 	switch {
 	case present:
 		log.EnableDebugLogging()
-	case quiet:
+	case c.Bool("quiet"):
 		log.SetLevel(log.ErrorLevel)
 	default:
-		log.SetLevelFromVerbosity(verbosity)
+		log.SetLevelFromVerbosity(c.Count("verbose"))
 	}
 }
 
-// commonFlags returns the -v and -q flags taken by the root and by the
+// commonFlags returns the flags shared by most commands (-v, -q)
-// generate, check, freshen and fetch subcommands.
 func commonFlags() []cli.Flag {
 	return []cli.Flag{
 		&cli.BoolFlag{
@@ -280,8 +259,6 @@ func (mfa *CLIApp) exportCommand() *cli.Command {
 		Usage:     "Export manifest contents as JSON",
 		ArgsUsage: "[manifest file or URL]",
 		Action: func(c *cli.Context) error {
-			mfa.setVerbosity(c)
-
 			return mfa.exportManifestOperation(c)
 		},
 	}
@@ -289,10 +266,10 @@ func (mfa *CLIApp) exportCommand() *cli.Command {
 
 func (mfa *CLIApp) versionCommand() *cli.Command {
 	return &cli.Command{
-		Name:  cmdVersion,
+		Name:  "version",
 		Usage: "Show version",
 		Action: func(_ *cli.Context) error {
-			mfa.printVersion()
+			_, _ = fmt.Fprintln(mfa.Stdout, mfa.VersionString())
 
 			return nil
 		},
@@ -348,21 +325,6 @@ func (mfa *CLIApp) run(args []string) {
 	log.SetOutput(mfa.Stdout, mfa.Stderr)
 	log.Init()
 
-	// -v means verbose, not version. urfave/cli's built-in version flag
-	// claims -v by default, which made "mfer -v --version" fail to parse and
-	// gave -v a different meaning at the root than on the generate, check,
-	// freshen and fetch subcommands, where it means verbose. Verbose is the
-	// more common meaning of -v in tools that offer both, so -v means verbose
-	// at the root too and the version flag takes the capital -V.
-	// VersionFlag and VersionPrinter are urfave/cli package globals; run() is
-	// serialized in tests, so assigning them here is safe.
-	cli.VersionFlag = &cli.BoolFlag{
-		Name:    cmdVersion,
-		Aliases: []string{"V"},
-		Usage:   "print the version",
-	}
-	cli.VersionPrinter = func(_ *cli.Context) { mfa.printVersion() }
-
 	mfa.app = &cli.App{
 		Name:                 mfa.appname,
 		Usage:                "Manifest generator",
@@ -370,13 +332,11 @@ func (mfa *CLIApp) run(args []string) {
 		EnableBashCompletion: true,
 		Writer:               mfa.Stdout,
 		ErrWriter:            mfa.Stderr,
-		Flags:                commonFlags(),
 		Action: func(c *cli.Context) error {
 			if c.Args().Len() > 0 {
 				return fmt.Errorf("%w %q", errUnknownCommand, c.Args().First())
 			}
 
-			mfa.setVerbosity(c)
 			mfa.printBanner()
 
 			return cli.ShowAppHelp(c)

mfer/builder.go

@@ -3,6 +3,7 @@
 package mfer
 
 import (
+	"context"
 	"crypto/sha256"
 	"errors"
 	"fmt"
@@ -281,8 +282,9 @@ func (b *Builder) SetSigningOptions(opts *SigningOptions) {
 	b.signingOptions = opts
 }
 
-// Build finalizes the manifest and writes it to the writer.
+// Build finalizes the manifest and writes it to the writer. ctx bounds the
-func (b *Builder) Build(w io.Writer) error {
+// gpg runs that sign the manifest when signing options are set.
+func (b *Builder) Build(ctx context.Context, w io.Writer) error {
 	b.mu.Lock()
 	defer b.mu.Unlock()
 
@@ -308,13 +310,13 @@ func (b *Builder) Build(w io.Writer) error {
 	}
 
 	// Generate outer wrapper
-	err := m.generateOuter()
+	err := m.generateOuter(ctx)
 	if err != nil {
 		return fmt.Errorf("build: generate outer: %w", err)
 	}
 
 	// Generate final output
-	err = m.generate()
+	err = m.generate(ctx)
 	if err != nil {
 		return fmt.Errorf("build: generate: %w", err)
 	}

mfer/builder_test.go

@@ -3,6 +3,7 @@ package mfer
 
 import (
 	"bytes"
+	"context"
 	"strings"
 	"testing"
 	"time"
@@ -113,7 +114,7 @@ func TestBuilderBuild(t *testing.T) {
 
 	var buf bytes.Buffer
 
-	err = b.Build(&buf)
+	err = b.Build(context.Background(), &buf)
 	require.NoError(t, err)
 
 	// Should have magic bytes
@@ -177,7 +178,7 @@ func TestBuilderDeterministicOutput(t *testing.T) {
 
 		var buf bytes.Buffer
 
-		err := b.Build(&buf)
+		err := b.Build(context.Background(), &buf)
 		require.NoError(t, err)
 
 		return buf.Bytes()
@@ -325,7 +326,7 @@ func TestBuilderBuildRoundTrip(t *testing.T) {
 	}
 
 	var buf bytes.Buffer
-	require.NoError(t, b.Build(&buf))
+	require.NoError(t, b.Build(context.Background(), &buf))
 
 	m, err := NewManifestFromReader(&buf)
 	require.NoError(t, err)
@@ -383,7 +384,7 @@ func TestManifestString(t *testing.T) {
 	require.NoError(t, err)
 
 	var buf bytes.Buffer
-	require.NoError(t, b.Build(&buf))
+	require.NoError(t, b.Build(context.Background(), &buf))
 
 	m, err := NewManifestFromReader(&buf)
 	require.NoError(t, err)
@@ -397,7 +398,7 @@ func TestBuilderBuildEmpty(t *testing.T) {
 
 	var buf bytes.Buffer
 
-	err := b.Build(&buf)
+	err := b.Build(context.Background(), &buf)
 	require.NoError(t, err)
 
 	// Should still produce valid manifest with 0 files
@@ -416,7 +417,7 @@ func TestBuilderOmitsCreatedAtByDefault(t *testing.T) {
 	require.NoError(t, err)
 
 	var buf bytes.Buffer
-	require.NoError(t, b.Build(&buf))
+	require.NoError(t, b.Build(context.Background(), &buf))
 
 	m, err := NewManifestFromReader(&buf)
 	require.NoError(t, err)
@@ -438,7 +439,7 @@ func TestBuilderIncludesCreatedAtWhenRequested(t *testing.T) {
 	require.NoError(t, err)
 
 	var buf bytes.Buffer
-	require.NoError(t, b.Build(&buf))
+	require.NoError(t, b.Build(context.Background(), &buf))
 
 	m, err := NewManifestFromReader(&buf)
 	require.NoError(t, err)
@@ -464,7 +465,7 @@ func TestBuilderDeterministicFileOrder(t *testing.T) {
 		}
 
 		var buf bytes.Buffer
-		require.NoError(t, b.Build(&buf))
+		require.NoError(t, b.Build(context.Background(), &buf))
 		m, err := NewManifestFromReader(&buf)
 		require.NoError(t, err)
 

mfer/checker.go

@@ -164,12 +164,12 @@ func (c *Checker) SigningPubKey() []byte {
 // ExtractEmbeddedSigningKeyFP imports the manifest's embedded public key into a
 // temporary keyring and extracts its fingerprint. This validates the key and
 // returns its actual fingerprint from the key material itself.
-func (c *Checker) ExtractEmbeddedSigningKeyFP() (string, error) {
+func (c *Checker) ExtractEmbeddedSigningKeyFP(ctx context.Context) (string, error) {
 	if len(c.signingPubKey) == 0 {
 		return "", errNoSigningPubKey
 	}
 
-	return gpgExtractPubKeyFingerprint(c.signingPubKey)
+	return gpgExtractPubKeyFingerprint(ctx, c.signingPubKey)
 }
 
 // Check verifies all files against the manifest.

mfer/checker_test.go

@@ -61,7 +61,7 @@ func createTestManifest(
 	}
 
 	var buf bytes.Buffer
-	require.NoError(t, builder.Build(&buf))
+	require.NoError(t, builder.Build(context.Background(), &buf))
 	require.NoError(t, afero.WriteFile(fs, manifestPath, buf.Bytes(), 0o644))
 }
 

mfer/deserialize.go

@@ -2,6 +2,7 @@ package mfer
 
 import (
 	"bytes"
+	"context"
 	"crypto/sha256"
 	"errors"
 	"fmt"
@@ -92,7 +93,9 @@ func (m *manifest) verifyOuterIntegrity() error {
 		)
 	}
 
+	// Loading a manifest takes no context; gpgTimeout still bounds gpg.
 	err = gpgVerify(
+		context.Background(),
 		[]byte(sigString),
 		m.pbOuter.GetSignature(),
 		m.pbOuter.GetSigningPubKey(),

mfer/deserialize_path_test.go

@@ -3,6 +3,7 @@ package mfer
 
 import (
 	"bytes"
+	"context"
 	"crypto/sha256"
 	"fmt"
 	"testing"
@@ -122,7 +123,7 @@ func TestDeserializeValidManifestRoundTrips(t *testing.T) {
 	require.NoError(t, b.AddFileWithHash("dir/file.txt", 123, ModTime{}, hash))
 
 	var buf bytes.Buffer
-	require.NoError(t, b.Build(&buf))
+	require.NoError(t, b.Build(context.Background(), &buf))
 
 	m, err := NewManifestFromReader(bytes.NewReader(buf.Bytes()))
 	require.NoError(t, err)

mfer/errmsg_test.go

@@ -2,6 +2,7 @@
 package mfer
 
 import (
+	"context"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -80,6 +81,7 @@ func TestSerializeInternalErrorMessagesVerbatim(t *testing.T) {
 	t.Parallel()
 
 	m := &manifest{}
-	require.EqualError(t, m.generate(), "internal error: pbInner not set")
+	require.EqualError(t, m.generate(context.Background()),
-	require.EqualError(t, m.generateOuter(), "internal error")
+		"internal error: pbInner not set")
+	require.EqualError(t, m.generateOuter(context.Background()), "internal error")
 }

mfer/gpg.go

@@ -10,9 +10,21 @@ import (
 	"os/exec"
 	"path/filepath"
 	"strings"
+	"time"
 )
 
 const (
+	// gpgTimeout bounds every gpg run, which can otherwise wait forever on
+	// a passphrase prompt or a stalled gpg-agent. A minute leaves a person
+	// time to type a passphrase or touch a smartcard.
+	gpgTimeout = time.Minute
+
+	// gpgWaitDelay is how long a gpg run keeps waiting for gpg's stdout
+	// and stderr to close once gpg has been killed or has exited. Reading
+	// what gpg itself wrote takes far less; only a process gpg left behind
+	// holds them open longer.
+	gpgWaitDelay = time.Second
+
 	// privateDirPerms is the permission mode for temporary GPG home
 	// directories.
 	privateDirPerms os.FileMode = 0o700
@@ -66,8 +78,20 @@ func gpgArgs(opts []string, positional ...string) []string {
 }
 
 // runGPG runs the gpg binary in batch mode with the given arguments and
-// optional stdin, returning captured stdout and stderr.
+// optional stdin, returning captured stdout and stderr. gpg is killed when
-func runGPG(stdin io.Reader, args ...string) (*bytes.Buffer, *bytes.Buffer, error) {
+// ctx ends or gpgTimeout passes, whichever comes first.
+func runGPG(
+	ctx context.Context, stdin io.Reader, args ...string,
+) (*bytes.Buffer, *bytes.Buffer, error) {
+	// exec.CommandContext kills only gpg itself. A gpg-agent that gpg
+	// starts runs detached and holds none of gpg's output, but another
+	// process gpg leaves behind (a wrapper script that runs the real gpg
+	// without exec, for example) can keep gpg's stdout or stderr open, and
+	// Run would wait for it to exit. WaitDelay stops that wait
+	// gpgWaitDelay after the kill; that process is left running.
+	ctx, cancel := context.WithTimeout(ctx, gpgTimeout)
+	defer cancel()
+
 	fullArgs := append([]string{"--batch", "--no-tty"}, args...)
 
 	// G204: the executable name is a compile-time constant. The arguments
@@ -76,7 +100,8 @@ func runGPG(stdin io.Reader, args ...string) (*bytes.Buffer, *bytes.Buffer, erro
 	// option or after the "--" end-of-options marker inserted by gpgArgs,
 	// and therefore cannot be reinterpreted by gpg as an option.
 	cmd := exec.CommandContext( //nolint:gosec // G204: see comment above
-		context.Background(), "gpg", fullArgs...)
+		ctx, "gpg", fullArgs...)
+	cmd.WaitDelay = gpgWaitDelay
 	cmd.Stdin = stdin
 
 	var stdout, stderr bytes.Buffer
@@ -85,6 +110,14 @@ func runGPG(stdin io.Reader, args ...string) (*bytes.Buffer, *bytes.Buffer, erro
 	cmd.Stderr = &stderr
 
 	err := cmd.Run()
+	if err != nil && ctx.Err() != nil {
+		// gpg was killed because ctx ended, which Run reports only as
+		// "signal: killed"; return the reason instead.
+		err = ctx.Err()
+		if errors.Is(err, context.DeadlineExceeded) {
+			err = fmt.Errorf("gpg timed out: %w", err)
+		}
+	}
 
 	return &stdout, &stderr, err
 }
@@ -105,8 +138,8 @@ func parseFingerprint(colonOutput string) (string, bool) {
 
 // gpgSign creates a detached signature of the data using the specified key.
 // Returns the armored detached signature.
-func gpgSign(data []byte, keyID GPGKeyID) ([]byte, error) {
+func gpgSign(ctx context.Context, data []byte, keyID GPGKeyID) ([]byte, error) {
-	stdout, stderr, err := runGPG(bytes.NewReader(data),
+	stdout, stderr, err := runGPG(ctx, bytes.NewReader(data),
 		"--detach-sign",
 		gpgOptArmor,
 		"--local-user", string(keyID),
@@ -120,8 +153,8 @@ func gpgSign(data []byte, keyID GPGKeyID) ([]byte, error) {
 
 // gpgExportPublicKey exports the public key for the specified key ID.
 // Returns the armored public key.
-func gpgExportPublicKey(keyID GPGKeyID) ([]byte, error) {
+func gpgExportPublicKey(ctx context.Context, keyID GPGKeyID) ([]byte, error) {
-	stdout, stderr, err := runGPG(nil,
+	stdout, stderr, err := runGPG(ctx, nil,
 		gpgArgs([]string{"--export", gpgOptArmor}, string(keyID))...,
 	)
 	if err != nil {
@@ -136,8 +169,8 @@ func gpgExportPublicKey(keyID GPGKeyID) ([]byte, error) {
 }
 
 // gpgGetKeyFingerprint gets the full fingerprint for a key ID.
-func gpgGetKeyFingerprint(keyID GPGKeyID) ([]byte, error) {
+func gpgGetKeyFingerprint(ctx context.Context, keyID GPGKeyID) ([]byte, error) {
-	stdout, stderr, err := runGPG(nil,
+	stdout, stderr, err := runGPG(ctx, nil,
 		gpgArgs([]string{"--with-colons", "--fingerprint"}, string(keyID))...,
 	)
 	if err != nil {
@@ -157,7 +190,7 @@ func gpgGetKeyFingerprint(keyID GPGKeyID) ([]byte, error) {
 // gpgExtractPubKeyFingerprint imports a public key into a temporary keyring
 // and extracts its fingerprint. This verifies the key is valid and returns
 // the actual fingerprint from the key material.
-func gpgExtractPubKeyFingerprint(pubKey []byte) (string, error) {
+func gpgExtractPubKeyFingerprint(ctx context.Context, pubKey []byte) (string, error) {
 	// Create temporary directory for GPG operations
 	tmpDir, err := os.MkdirTemp("", "mfer-gpg-fingerprint-*")
 	if err != nil {
@@ -181,7 +214,7 @@ func gpgExtractPubKeyFingerprint(pubKey []byte) (string, error) {
 	}
 
 	// Import the public key into the temporary keyring
-	_, importStderr, err := runGPG(nil,
+	_, importStderr, err := runGPG(ctx, nil,
 		gpgArgs([]string{gpgOptHomedir, tmpDir, "--import"}, pubKeyFile)...,
 	)
 	if err != nil {
@@ -191,7 +224,7 @@ func gpgExtractPubKeyFingerprint(pubKey []byte) (string, error) {
 	}
 
 	// List keys to get fingerprint
-	listStdout, listStderr, err := runGPG(nil,
+	listStdout, listStderr, err := runGPG(ctx, nil,
 		"--homedir", tmpDir,
 		"--with-colons",
 		"--fingerprint",
@@ -212,7 +245,7 @@ func gpgExtractPubKeyFingerprint(pubKey []byte) (string, error) {
 
 // gpgVerify verifies a detached signature against data using the provided public key.
 // It creates a temporary keyring to import the public key for verification.
-func gpgVerify(data, signature, pubKey []byte) error {
+func gpgVerify(ctx context.Context, data, signature, pubKey []byte) error {
 	// Create temporary directory for GPG operations
 	tmpDir, err := os.MkdirTemp("", "mfer-gpg-verify-*")
 	if err != nil {
@@ -252,7 +285,7 @@ func gpgVerify(data, signature, pubKey []byte) error {
 	}
 
 	// Import the public key into the temporary keyring
-	_, importStderr, err := runGPG(nil,
+	_, importStderr, err := runGPG(ctx, nil,
 		gpgArgs([]string{gpgOptHomedir, tmpDir, "--import"}, pubKeyFile)...,
 	)
 	if err != nil {
@@ -262,7 +295,7 @@ func gpgVerify(data, signature, pubKey []byte) error {
 	}
 
 	// Verify the signature
-	_, verifyStderr, err := runGPG(nil,
+	_, verifyStderr, err := runGPG(ctx, nil,
 		gpgArgs([]string{gpgOptHomedir, tmpDir, gpgOptVerify},
 			sigFile, dataFile)...,
 	)

mfer/gpg_test.go

@@ -4,11 +4,13 @@ package mfer
 import (
 	"bytes"
 	"context"
+	"io"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
@@ -43,8 +45,11 @@ Expire-Date: 0
 	paramsFile := filepath.Join(gpgHome, "key-params")
 	require.NoError(t, os.WriteFile(paramsFile, []byte(keyParams), 0o600))
 
+	ctx, cancel := context.WithTimeout(context.Background(), gpgTimeout)
+	defer cancel()
+
 	//nolint:gosec // paramsFile is a test-controlled path inside t.TempDir()
-	cmd := exec.CommandContext(context.Background(), "gpg",
+	cmd := exec.CommandContext(ctx, "gpg",
 		"--batch", "--gen-key", paramsFile)
 
 	cmd.Env = append(os.Environ(), "GNUPGHOME="+gpgHome)
@@ -55,7 +60,7 @@ Expire-Date: 0
 	}
 
 	// Get the key fingerprint
-	cmd = exec.CommandContext(context.Background(), "gpg",
+	cmd = exec.CommandContext(ctx, "gpg",
 		"--list-keys", "--with-colons", "test@mfer.test")
 
 	cmd.Env = append(os.Environ(), "GNUPGHOME="+gpgHome)
@@ -90,7 +95,7 @@ func TestGPGSign(t *testing.T) {
 	t.Setenv("GNUPGHOME", gpgHome)
 
 	data := []byte("test data to sign")
-	sig, err := gpgSign(data, keyID)
+	sig, err := gpgSign(context.Background(), data, keyID)
 	require.NoError(t, err)
 	assert.NotEmpty(t, sig)
 	assert.Contains(t, string(sig), "-----BEGIN PGP SIGNATURE-----")
@@ -101,7 +106,7 @@ func TestGPGExportPublicKey(t *testing.T) {
 	keyID, gpgHome := testGPGEnv(t)
 	t.Setenv("GNUPGHOME", gpgHome)
 
-	pubKey, err := gpgExportPublicKey(keyID)
+	pubKey, err := gpgExportPublicKey(context.Background(), keyID)
 	require.NoError(t, err)
 	assert.NotEmpty(t, pubKey)
 	assert.Contains(t, string(pubKey), "-----BEGIN PGP PUBLIC KEY BLOCK-----")
@@ -112,7 +117,7 @@ func TestGPGGetKeyFingerprint(t *testing.T) {
 	keyID, gpgHome := testGPGEnv(t)
 	t.Setenv("GNUPGHOME", gpgHome)
 
-	fingerprint, err := gpgGetKeyFingerprint(keyID)
+	fingerprint, err := gpgGetKeyFingerprint(context.Background(), keyID)
 	require.NoError(t, err)
 	assert.NotEmpty(t, fingerprint)
 	// The fingerprint should be 40 hex chars
@@ -146,12 +151,12 @@ func TestGPGOptionLikeKeyIDIsNotAnOption(t *testing.T) {
 	_, gpgHome := testGPGEnv(t)
 	t.Setenv("GNUPGHOME", gpgHome)
 
-	pubKey, err := gpgExportPublicKey(GPGKeyID("--version"))
+	pubKey, err := gpgExportPublicKey(context.Background(), GPGKeyID("--version"))
 	require.Error(t, err)
 	require.ErrorIs(t, err, errGPGKeyNotFound)
 	assert.NotContains(t, string(pubKey), "gpg (GnuPG)")
 
-	fpr, err := gpgGetKeyFingerprint(GPGKeyID("--version"))
+	fpr, err := gpgGetKeyFingerprint(context.Background(), GPGKeyID("--version"))
 	require.Error(t, err)
 	assert.NotContains(t, string(fpr), "gpg (GnuPG)")
 }
@@ -162,7 +167,8 @@ func TestGPGSignInvalidKey(t *testing.T) {
 	t.Setenv("GNUPGHOME", gpgHome)
 
 	data := []byte("test data")
-	_, err := gpgSign(data, GPGKeyID("NONEXISTENT_KEY_ID_12345"))
+	_, err := gpgSign(context.Background(), data,
+		GPGKeyID("NONEXISTENT_KEY_ID_12345"))
 	assert.Error(t, err)
 }
 
@@ -185,7 +191,7 @@ func TestBuilderWithSigning(t *testing.T) {
 	// Build the manifest
 	var buf bytes.Buffer
 
-	err = b.Build(&buf)
+	err = b.Build(context.Background(), &buf)
 	require.NoError(t, err)
 
 	// Parse the manifest and verify signature fields are populated
@@ -251,14 +257,14 @@ func TestGPGVerify(t *testing.T) {
 	t.Setenv("GNUPGHOME", gpgHome)
 
 	data := []byte("test data to sign and verify")
-	sig, err := gpgSign(data, keyID)
+	sig, err := gpgSign(context.Background(), data, keyID)
 	require.NoError(t, err)
 
-	pubKey, err := gpgExportPublicKey(keyID)
+	pubKey, err := gpgExportPublicKey(context.Background(), keyID)
 	require.NoError(t, err)
 
 	// Verify the signature
-	err = gpgVerify(data, sig, pubKey)
+	err = gpgVerify(context.Background(), data, sig, pubKey)
 	require.NoError(t, err)
 }
 
@@ -267,15 +273,15 @@ func TestGPGVerifyInvalidSignature(t *testing.T) {
 	t.Setenv("GNUPGHOME", gpgHome)
 
 	data := []byte("test data to sign")
-	sig, err := gpgSign(data, keyID)
+	sig, err := gpgSign(context.Background(), data, keyID)
 	require.NoError(t, err)
 
-	pubKey, err := gpgExportPublicKey(keyID)
+	pubKey, err := gpgExportPublicKey(context.Background(), keyID)
 	require.NoError(t, err)
 
 	// Try to verify with different data - should fail
 	wrongData := []byte("different data")
-	err = gpgVerify(wrongData, sig, pubKey)
+	err = gpgVerify(context.Background(), wrongData, sig, pubKey)
 	assert.Error(t, err)
 }
 
@@ -284,12 +290,12 @@ func TestGPGVerifyBadPublicKey(t *testing.T) {
 	t.Setenv("GNUPGHOME", gpgHome)
 
 	data := []byte("test data")
-	sig, err := gpgSign(data, keyID)
+	sig, err := gpgSign(context.Background(), data, keyID)
 	require.NoError(t, err)
 
 	// Try to verify with invalid public key - should fail
 	badPubKey := []byte("not a valid public key")
-	err = gpgVerify(data, sig, badPubKey)
+	err = gpgVerify(context.Background(), data, sig, badPubKey)
 	assert.Error(t, err)
 }
 
@@ -312,7 +318,7 @@ func TestManifestSignatureVerification(t *testing.T) {
 	// Build the manifest
 	var buf bytes.Buffer
 
-	err = b.Build(&buf)
+	err = b.Build(context.Background(), &buf)
 	require.NoError(t, err)
 
 	// Parse the manifest - signature should be verified during load
@@ -341,7 +347,7 @@ func TestManifestTamperedSignatureFails(t *testing.T) {
 
 	var buf bytes.Buffer
 
-	err = b.Build(&buf)
+	err = b.Build(context.Background(), &buf)
 	require.NoError(t, err)
 
 	// Tamper with the signature by replacing some bytes
@@ -375,7 +381,7 @@ func TestBuilderWithoutSigning(t *testing.T) {
 	// Build the manifest
 	var buf bytes.Buffer
 
-	err = b.Build(&buf)
+	err = b.Build(context.Background(), &buf)
 	require.NoError(t, err)
 
 	// Parse the manifest and verify signature fields are empty
@@ -390,3 +396,62 @@ func TestBuilderWithoutSigning(t *testing.T) {
 	assert.Empty(t, manifest.pbOuter.GetSigningPubKey(),
 		"signing public key should be empty when not signing")
 }
+
+// fakeGPGPath writes script as an executable named gpg into a temporary
+// directory and returns a PATH value with that directory first.
+func fakeGPGPath(t *testing.T, script string) string {
+	t.Helper()
+
+	binDir := t.TempDir()
+	//nolint:gosec // G306: the fake gpg has to be executable
+	require.NoError(t, os.WriteFile(filepath.Join(binDir, "gpg"),
+		[]byte(script), 0o700))
+
+	return binDir + string(os.PathListSeparator) + os.Getenv("PATH")
+}
+
+// TestGPGTimeoutKillsGPG puts a fake gpg that never finishes first on
+// PATH and checks that a run past its deadline is killed and reported as
+// a timeout of the named operation, instead of hanging.
+func TestGPGTimeoutKillsGPG(t *testing.T) {
+	t.Setenv("PATH", fakeGPGPath(t, "#!/bin/sh\nexec sleep 10\n"))
+
+	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	defer cancel()
+
+	_, err := gpgSign(ctx, []byte("data"), GPGKeyID("any"))
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+	assert.Contains(t, err.Error(), "gpg sign failed: gpg timed out")
+}
+
+// TestGPGTimeoutWhenChildHoldsOutput uses a fake gpg that runs sleep as a
+// child instead of exec-ing it, the way a wrapper script around the real
+// gpg might. Killing the fake gpg leaves sleep holding its stdout and
+// stderr open; the call must still return shortly after the deadline
+// instead of waiting for sleep to exit.
+func TestGPGTimeoutWhenChildHoldsOutput(t *testing.T) {
+	t.Setenv("PATH", fakeGPGPath(t, "#!/bin/sh\nsleep 3\nexit\n"))
+
+	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
+	defer cancel()
+
+	start := time.Now()
+	_, err := gpgSign(ctx, []byte("data"), GPGKeyID("any"))
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+	assert.Less(t, time.Since(start), 3*time.Second,
+		"the call waited for the child holding gpg's output to exit")
+}
+
+// TestBuildPassesContextToSigning checks that a caller can cancel the gpg
+// runs that sign a manifest through the context given to Build.
+func TestBuildPassesContextToSigning(t *testing.T) {
+	t.Parallel()
+
+	b := NewBuilder()
+	b.SetSigningOptions(&SigningOptions{KeyID: "any"})
+
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	require.ErrorIs(t, b.Build(ctx, io.Discard), context.Canceled)
+}

mfer/scanner.go

@@ -283,8 +283,7 @@ func (s *Scanner) ToManifest(
 	}
 
 	// Build and write manifest
-	//nolint:contextcheck // Build's GPG signing exec is not cancellable by design
+	return builder.Build(ctx, w)
-	return builder.Build(w)
 }
 
 // configureBuilder constructs a manifest builder configured from the

mfer/serialize.go

@@ -2,6 +2,7 @@ package mfer
 
 import (
 	"bytes"
+	"context"
 	"crypto/sha256"
 	"errors"
 	"fmt"
@@ -50,13 +51,13 @@ func newTimestampFromTime(t time.Time) *Timestamp {
 	}
 }
 
-func (m *manifest) generate() error {
+func (m *manifest) generate(ctx context.Context) error {
 	if m.pbInner == nil {
 		return errInnerNotSet
 	}
 
 	if m.pbOuter == nil {
-		e := m.generateOuter()
+		e := m.generateOuter(ctx)
 		if e != nil {
 			return e
 		}
@@ -77,7 +78,7 @@ func (m *manifest) generate() error {
 	return nil
 }
 
-func (m *manifest) generateOuter() error {
+func (m *manifest) generateOuter(ctx context.Context) error {
 	if m.pbInner == nil {
 		return errInternal
 	}
@@ -135,7 +136,7 @@ func (m *manifest) generateOuter() error {
 
 	// Sign the manifest if signing options are provided
 	if m.signingOptions != nil && m.signingOptions.KeyID != "" {
-		return m.signOuter()
+		return m.signOuter(ctx)
 	}
 
 	return nil
@@ -143,27 +144,27 @@ func (m *manifest) generateOuter() error {
 
 // signOuter signs the outer message with the configured GPG key and
 // embeds the signature, signer fingerprint, and public key.
-func (m *manifest) signOuter() error {
+func (m *manifest) signOuter(ctx context.Context) error {
 	sigString, err := m.signatureString()
 	if err != nil {
 		return fmt.Errorf("failed to generate signature string: %w", err)
 	}
 
-	sig, err := gpgSign([]byte(sigString), m.signingOptions.KeyID)
+	sig, err := gpgSign(ctx, []byte(sigString), m.signingOptions.KeyID)
 	if err != nil {
 		return fmt.Errorf("failed to sign manifest: %w", err)
 	}
 
 	m.pbOuter.Signature = sig
 
-	fingerprint, err := gpgGetKeyFingerprint(m.signingOptions.KeyID)
+	fingerprint, err := gpgGetKeyFingerprint(ctx, m.signingOptions.KeyID)
 	if err != nil {
 		return fmt.Errorf("failed to get key fingerprint: %w", err)
 	}
 
 	m.pbOuter.Signer = fingerprint
 
-	pubKey, err := gpgExportPublicKey(m.signingOptions.KeyID)
+	pubKey, err := gpgExportPublicKey(ctx, m.signingOptions.KeyID)
 	if err != nil {
 		return fmt.Errorf("failed to export public key: %w", err)
 	}