Give the image CA certificates so fetch works over HTTPS (closes #131)

The final stage is scratch, which has no CA certificates, so fetch from
an HTTPS URL failed to verify any server. Copy the CA bundle from the
pinned builder image into the final stage.

Model: opus-5-5

Dockerfile

@@ -14,9 +14,7 @@ RUN touch mfer/mf.pb.go
 # Go half of fmt-check only: this image has no node, so no prettier. The
 # markdown half runs in the mdfmt stage below.
 RUN make fmt-check-go
-# The linter directly, not `make lint`: script/lint builds this stage, and
-# there is no docker inside this build.
-RUN golangci-lint run --config .golangci.yml ./...
+RUN make lint
 
 # Markdown/JSON format stage — prettier needs node, which the Go images
 # do not have. node:22.17.0-bookworm-slim (2026-08-09); ships node
@@ -75,5 +73,7 @@ RUN version="${VERSION:-$(git describe --tags --always)}"; \
 RUN ldd /mfer 2>&1 | grep -q 'not a dynamic executable'
 
 FROM scratch
+# scratch has no CA certificates; fetch needs them to verify HTTPS servers.
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
 COPY --from=builder /mfer /mfer
 ENTRYPOINT ["/mfer"]

Makefile

@@ -58,6 +58,9 @@ fmt-check-md:
 hooks:
 	@script/install-precommit
 
+devprereqs:
+	which golangci-lint || go install -v github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.12.2
+
 mfer/mf.pb.go: mfer/mf.proto
 	cd mfer && go generate .
 

README.md

@@ -65,9 +65,9 @@ standard: normalized scripts in `script/` are the entrypoints for the
 development workflow, and the Makefile targets are thin shims that call them. We
 provide:
 
-- `script/bootstrap` — install all dependencies (Go, Go module download, and
-  node/yarn plus the prettier version pinned in `package.json`/`yarn.lock`),
-  idempotently; golangci-lint is not installed, it runs only in Docker
+- `script/bootstrap` — install all dependencies (Go, golangci-lint, Go module
+  download, and node/yarn plus the prettier version pinned in
+  `package.json`/`yarn.lock`), idempotently
 - `script/setup` — make a fresh clone ready for development: runs
   `script/bootstrap`, then `script/install-precommit`
 - `script/projectname` — output the project name (`mfer`); used by other scripts
@@ -77,11 +77,9 @@ provide:
 - `script/fuzz` — fuzz the manifest parser for one minute; run by hand
   (`make fuzz`), never by CI, while `script/test` runs its committed seed corpus
   as ordinary tests
-- `script/lint` — run `golangci-lint` in Docker: builds only the `lint` stage of
-  the `Dockerfile` (the Go format check, then the linter), uncached so it runs
-  every time, then removes the image
-- `script/fmt` — format all code and docs (writes): `gofumpt` and
-  `script/prettier --write`
+- `script/lint` — run `golangci-lint` and verify `gofmt` cleanliness
+- `script/fmt` — format all code and docs (writes): `gofumpt`,
+  `golangci-lint run --fix`, and `script/prettier --write`
 - `script/prettier` — run prettier over the repository's canonical file set
   (Markdown and JSON, minus `.prettierignore`) in the given mode, `--write` or
   `--check`; the single definition of that file set, so `script/fmt` and
@@ -107,10 +105,11 @@ yet. Primary development happens on a privately-run Gitea instance at
 [tracked there](https://git.eeqj.de/sneak/mfer/issues).
 
 Changes must always be formatted with a standard `go fmt`, syntactically valid,
-and must pass the linting defined in the repository's `.golangci.yml`, which
-`make lint` runs in Docker. The `main` branch is protected and all changes must
-be made via [pull requests](https://git.eeqj.de/sneak/mfer/pulls) and pass CI to
-be merged. Any changes submitted to this project must also be
+and must pass the linting defined in the repository (presently only the
+`golangci-lint` defaults), which can be run with a `make lint`. The `main`
+branch is protected and all changes must be made via
+[pull requests](https://git.eeqj.de/sneak/mfer/pulls) and pass CI to be merged.
+Any changes submitted to this project must also be
 [WTFPL-licensed](https://wtfpl.net) to be considered.
 
 See [`REPO_POLICIES.md`](REPO_POLICIES.md) for detailed coding standards,

mfer/gpg_test.go

@@ -10,7 +10,6 @@ import (
 	"path/filepath"
 	"strconv"
 	"strings"
-	"syscall"
 	"testing"
 	"time"
 
@@ -426,51 +425,36 @@ func TestGPGTimeoutKillsGPG(t *testing.T) {
 	assert.Contains(t, err.Error(), "gpg sign failed: gpg timed out")
 }
 
-// TestGPGCancelWhenChildHoldsOutput uses a fake gpg that runs sleep as a
+// TestGPGTimeoutWhenChildHoldsOutput uses a fake gpg that runs sleep as a
 // child instead of exec-ing it, the way a wrapper script around the real
 // gpg might. Killing the fake gpg leaves sleep holding its stdout and
-// stderr open; the call must still return once ctx ends instead of waiting
-// for sleep to exit. The fake gpg writes the process ID of sleep to a named
-// pipe; the test ends ctx only after reading it, so sleep is running by
-// then, and kills sleep before returning.
-func TestGPGCancelWhenChildHoldsOutput(t *testing.T) {
-	pidPipe := filepath.Join(t.TempDir(), "sleep.pid")
-	require.NoError(t, syscall.Mkfifo(pidPipe, 0o600))
-	// sleep outlasts the 10 s wait below, so a call that waits for it fails.
+// stderr open; the call must still return shortly after the deadline
+// instead of waiting for sleep to exit. The fake gpg writes the process ID
+// of sleep to a file so that the test can kill it before returning.
+func TestGPGTimeoutWhenChildHoldsOutput(t *testing.T) {
+	pidFile := filepath.Join(t.TempDir(), "sleep.pid")
 	t.Setenv("PATH", fakeGPGPath(t,
-		"#!/bin/sh\nsleep 60 &\necho $! >'"+pidPipe+"'\nwait\n"))
+		"#!/bin/sh\nsleep 3 &\necho $! >'"+pidFile+"'\nwait\n"))
+	t.Cleanup(func() {
+		pid, err := os.ReadFile(pidFile) //nolint:gosec // G304: path inside t.TempDir()
+		require.NoError(t, err)
 
-	ctx, cancel := context.WithCancel(context.Background())
+		n, err := strconv.Atoi(strings.TrimSpace(string(pid)))
+		require.NoError(t, err)
+
+		sleep, err := os.FindProcess(n)
+		require.NoError(t, err)
+		require.NoError(t, sleep.Kill())
+	})
+
+	ctx, cancel := context.WithTimeout(context.Background(), 100*time.Millisecond)
 	defer cancel()
 
-	signErr := make(chan error, 1)
-
-	go func() {
-		_, err := gpgSign(ctx, []byte("data"), GPGKeyID("any"))
-		signErr <- err
-	}()
-
-	pid, err := os.ReadFile(pidPipe) //nolint:gosec // G304: path inside t.TempDir()
-	require.NoError(t, err)
-
-	n, err := strconv.Atoi(strings.TrimSpace(string(pid)))
-	require.NoError(t, err)
-
-	sleep, err := os.FindProcess(n)
-	require.NoError(t, err)
-	t.Cleanup(func() { require.NoError(t, sleep.Kill()) })
-
-	cancel()
-
-	// The call should return about gpgWaitDelay (one second) after the
-	// cancel. 10 s is far above that and well under the 30 s test timeout,
-	// which would abort the whole package before the cleanup kills sleep.
-	select {
-	case err := <-signErr:
-		require.ErrorIs(t, err, context.Canceled)
-	case <-time.After(10 * time.Second):
-		t.Fatal("the call waited for the child holding gpg's output to exit")
-	}
+	start := time.Now()
+	_, err := gpgSign(ctx, []byte("data"), GPGKeyID("any"))
+	require.ErrorIs(t, err, context.DeadlineExceeded)
+	assert.Less(t, time.Since(start), 3*time.Second,
+		"the call waited for the child holding gpg's output to exit")
 }
 
 // TestBuildPassesContextToSigning checks that a caller can cancel the gpg

mfer/scanner_test.go

@@ -304,19 +304,46 @@ func TestScannerEnumerateFS(t *testing.T) {
 func TestSendEnumerateStatusNonBlocking(t *testing.T) {
 	t.Parallel()
 
-	// Nobody receives, so a blocking send would hang the test into its timeout.
+	// Channel with no buffer - send should not block
 	ch := make(chan EnumerateStatus)
 
-	sendEnumerateStatus(ch, EnumerateStatus{FilesFound: 1})
+	// This should not block
+	done := make(chan bool)
+
+	go func() {
+		sendEnumerateStatus(ch, EnumerateStatus{FilesFound: 1})
+
+		done <- true
+	}()
+
+	select {
+	case <-done:
+		// Success - did not block
+	case <-time.After(100 * time.Millisecond):
+		t.Fatal("sendEnumerateStatus blocked on full channel")
+	}
 }
 
 func TestSendScanStatusNonBlocking(t *testing.T) {
 	t.Parallel()
 
-	// Nobody receives, so a blocking send would hang the test into its timeout.
+	// Channel with no buffer - send should not block
 	ch := make(chan ScanStatus)
 
-	sendScanStatus(ch, ScanStatus{ScannedFiles: 1})
+	done := make(chan bool)
+
+	go func() {
+		sendScanStatus(ch, ScanStatus{ScannedFiles: 1})
+
+		done <- true
+	}()
+
+	select {
+	case <-done:
+		// Success - did not block
+	case <-time.After(100 * time.Millisecond):
+		t.Fatal("sendScanStatus blocked on full channel")
+	}
 }
 
 func TestSendStatusNilChannel(t *testing.T) {

script/bootstrap

@@ -140,7 +140,12 @@ main() {
 
     # ---- Go repos ----
     if missing go; then pkg_install go golang go go; fi
-    # No golangci-lint: script/lint runs it in Docker only.
+    # golangci-lint: packaged in nix, brew, and apk. On apt there is no
+    # package: download a specific release archive from GitHub and
+    # verify its hash (verify_sha256), never curl | sh.
+    if missing golangci-lint; then
+        pkg_install golangci-lint golangci-lint golangci-lint golangci-lint
+    fi
     go mod download
 
     # ---- Python repos ----

script/fmt

@@ -19,6 +19,7 @@ main() {
     cd "$ROOT"
     ensure_pb
     gofumpt -l -w mfer internal cmd
+    golangci-lint run --fix
     # Markdown and JSON, over the same file set script/fmt-check verifies.
     "$SCRIPT_DIR/prettier" --write
 }

script/lint

@@ -1,20 +1,17 @@
 #!/bin/sh
-# script/lint: run golangci-lint, in Docker only. Builds the lint stage of
-# the Dockerfile, whose build runs the linter, so a successful build is a
-# clean lint. --no-cache because a cached build runs no linter. The image
-# is removed afterwards, whatever the outcome.
+# script/lint: run the linter.
 set -eu
 
-SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd -P)"
-ROOT="$(cd "$SCRIPT_DIR/.." && pwd -P)"
+ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 
 main() {
     cd "$ROOT"
-    # Tagged per run, so concurrent runs never remove each other's image.
-    image="$("$SCRIPT_DIR/projectname")-lint:$$"
-    # A failed build leaves no image, so there is nothing to remove then.
-    trap 'docker image rm "$image" >/dev/null 2>&1 || true' EXIT INT TERM
-    docker build --no-cache --target lint -t "$image" .
+    golangci-lint run
+    if [ -n "$(gofmt -l .)" ]; then
+        echo "gofmt: files need formatting:" >&2
+        gofmt -l . >&2
+        exit 1
+    fi
 }
 
 main "$@"