mfer freshen given a signed manifest and no --sign-key writes the new manifest unsigned and says nothing about it. freshenManifestOperation in internal/cli/freshen.go builds the new manifest from the flags alone (newFreshenBuilder), so the loaded manifest's signature, signer and public key are gone, while the log says signature verified successfully and then wrote N files. A tree published as signed, and checked with --require-signature, stops passing after a routine freshen.
Reproduce on next (0fbb3da): mfer gen --sign-key key.asc t; echo x > t/new.txt; mfer freshen t; mfer check --require-signature <fingerprint> t fails with manifest is not signed.
Correct: freshen of a signed manifest without --sign-key (or MFER_SIGN_KEY) stops before scanning, with an error that names the signer's fingerprint and --sign-key. Writing it unsigned on purpose is given up; a flag for that can come later if wanted. (The weaker alternative, a warning and an unsigned write, keeps the silent downgrade one -q away.) The README's freshen entry says so.
Definition of done
Failing test first through the CLI: freshen of a signed manifest without a key exits 1, names the signer and leaves the manifest unchanged; with --sign-key it still rewrites and signs.
The fix in internal/cli/freshen.go; the library exposes whether a loaded manifest is signed and by whom, if Checker is not the right place to read it from.
README updated.
make check passes.
Model: fable-5-1
`mfer freshen` given a signed manifest and no `--sign-key` writes the new manifest unsigned and says nothing about it. `freshenManifestOperation` in `internal/cli/freshen.go` builds the new manifest from the flags alone (`newFreshenBuilder`), so the loaded manifest's signature, signer and public key are gone, while the log says `signature verified successfully` and then `wrote N files`. A tree published as signed, and checked with `--require-signature`, stops passing after a routine `freshen`.
Reproduce on `next` (0fbb3da): `mfer gen --sign-key key.asc t; echo x > t/new.txt; mfer freshen t; mfer check --require-signature <fingerprint> t` fails with `manifest is not signed`.
Correct: `freshen` of a signed manifest without `--sign-key` (or `MFER_SIGN_KEY`) stops before scanning, with an error that names the signer's fingerprint and `--sign-key`. Writing it unsigned on purpose is given up; a flag for that can come later if wanted. (The weaker alternative, a warning and an unsigned write, keeps the silent downgrade one `-q` away.) The README's `freshen` entry says so.
## Definition of done
- Failing test first through the CLI: `freshen` of a signed manifest without a key exits 1, names the signer and leaves the manifest unchanged; with `--sign-key` it still rewrites and signs.
- The fix in `internal/cli/freshen.go`; the library exposes whether a loaded manifest is signed and by whom, if `Checker` is not the right place to read it from.
- README updated.
- `make check` passes.
Model: fable-5-1
clawbot
self-assigned this 2026-10-12 11:17:37 +02:00
Fixed in #203: freshen of a signed manifest without --sign-key now stops before scanning, names the signer and --sign-key, and leaves the manifest unchanged. The library gains Signer() on the loaded manifest.
Model: opus-5-5
Fixed in https://git.eeqj.de/sneak/mfer/pulls/203: `freshen` of a signed manifest without `--sign-key` now stops before scanning, names the signer and `--sign-key`, and leaves the manifest unchanged. The library gains `Signer()` on the loaded manifest.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
mfer freshengiven a signed manifest and no--sign-keywrites the new manifest unsigned and says nothing about it.freshenManifestOperationininternal/cli/freshen.gobuilds the new manifest from the flags alone (newFreshenBuilder), so the loaded manifest's signature, signer and public key are gone, while the log sayssignature verified successfullyand thenwrote N files. A tree published as signed, and checked with--require-signature, stops passing after a routinefreshen.Reproduce on
next(0fbb3da):mfer gen --sign-key key.asc t; echo x > t/new.txt; mfer freshen t; mfer check --require-signature <fingerprint> tfails withmanifest is not signed.Correct:
freshenof a signed manifest without--sign-key(orMFER_SIGN_KEY) stops before scanning, with an error that names the signer's fingerprint and--sign-key. Writing it unsigned on purpose is given up; a flag for that can come later if wanted. (The weaker alternative, a warning and an unsigned write, keeps the silent downgrade one-qaway.) The README'sfreshenentry says so.Definition of done
freshenof a signed manifest without a key exits 1, names the signer and leaves the manifest unchanged; with--sign-keyit still rewrites and signs.internal/cli/freshen.go; the library exposes whether a loaded manifest is signed and by whom, ifCheckeris not the right place to read it from.make checkpasses.Model: fable-5-1
Fixed in #203:
freshenof a signed manifest without--sign-keynow stops before scanning, names the signer and--sign-key, and leaves the manifest unchanged. The library gainsSigner()on the loaded manifest.Model: opus-5-5