mfer check DIR --require-signature FPR and mfer fetch URL --require-signature FPR accept an unsigned manifest and exit 0. Every command reads options only before its first argument (stopOnFirstArg in internal/cli/mfer.go, kept from urfave/cli v2 by #110), and check, fetch, freshen, list and export, which take one argument, ignore everything after it without a word. So an option written after the path or URL is dropped: --require-signature, --no-extra-files, --include-permissions, and --dest, where fetch then writes into the current directory. check a b checks only a; fetch URL1 URL2 fetches only the first.
Reproduce on next (0fbb3da): mkdir u; echo x > u/x.txt; mfer gen u; mfer check u --require-signature <any fingerprint> exits 0; with the option before u it exits 1 with manifest is not signed.
Severity: critical. A signature requirement the user typed is skipped and the check passes.
Correct: options are read wherever they appear, as urfave/cli v3 does by default, and -- still ends them for a path that starts with -. A command that takes one argument refuses a second one with an error naming it. gen, which takes several paths, changes only in reading options anywhere.
Definition of done
Failing tests first, through the CLI: check DIR --require-signature FPR on an unsigned manifest exits 1; fetch URL --dest D writes into D; freshen DIR --include-permissions records modes; check a b exits 1 and names b; gen -- -x treats -x as a path.
The fix in internal/cli: stopOnFirstArg goes, and each one-argument command refuses extra arguments.
README usage text still matches mfer --help.
make check passes.
Model: opus-5-5
`mfer check DIR --require-signature FPR` and `mfer fetch URL --require-signature FPR` accept an unsigned manifest and exit 0. Every command reads options only before its first argument (`stopOnFirstArg` in `internal/cli/mfer.go`, kept from urfave/cli v2 by https://git.eeqj.de/sneak/mfer/issues/110), and `check`, `fetch`, `freshen`, `list` and `export`, which take one argument, ignore everything after it without a word. So an option written after the path or URL is dropped: `--require-signature`, `--no-extra-files`, `--include-permissions`, and `--dest`, where `fetch` then writes into the current directory. `check a b` checks only `a`; `fetch URL1 URL2` fetches only the first.
Reproduce on `next` (0fbb3da): `mkdir u; echo x > u/x.txt; mfer gen u; mfer check u --require-signature <any fingerprint>` exits 0; with the option before `u` it exits 1 with `manifest is not signed`.
Severity: critical. A signature requirement the user typed is skipped and the check passes.
Correct: options are read wherever they appear, as urfave/cli v3 does by default, and `--` still ends them for a path that starts with `-`. A command that takes one argument refuses a second one with an error naming it. `gen`, which takes several paths, changes only in reading options anywhere.
## Definition of done
- Failing tests first, through the CLI: `check DIR --require-signature FPR` on an unsigned manifest exits 1; `fetch URL --dest D` writes into `D`; `freshen DIR --include-permissions` records modes; `check a b` exits 1 and names `b`; `gen -- -x` treats `-x` as a path.
- The fix in `internal/cli`: `stopOnFirstArg` goes, and each one-argument command refuses extra arguments.
- README usage text still matches `mfer --help`.
- `make check` passes.
Model: opus-5-5
clawbot
self-assigned this 2026-10-13 13:03:06 +02:00
Fixed in #197: options are read wherever they appear, -- still ends them, and check, fetch, freshen, list and export refuse a second argument, naming it.
Model: opus-5-5
Fixed in https://git.eeqj.de/sneak/mfer/pulls/197: options are read wherever they appear, `--` still ends them, and `check`, `fetch`, `freshen`, `list` and `export` refuse a second argument, naming it.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
mfer check DIR --require-signature FPRandmfer fetch URL --require-signature FPRaccept an unsigned manifest and exit 0. Every command reads options only before its first argument (stopOnFirstArgininternal/cli/mfer.go, kept from urfave/cli v2 by #110), andcheck,fetch,freshen,listandexport, which take one argument, ignore everything after it without a word. So an option written after the path or URL is dropped:--require-signature,--no-extra-files,--include-permissions, and--dest, wherefetchthen writes into the current directory.check a bchecks onlya;fetch URL1 URL2fetches only the first.Reproduce on
next(0fbb3da):mkdir u; echo x > u/x.txt; mfer gen u; mfer check u --require-signature <any fingerprint>exits 0; with the option beforeuit exits 1 withmanifest is not signed.Severity: critical. A signature requirement the user typed is skipped and the check passes.
Correct: options are read wherever they appear, as urfave/cli v3 does by default, and
--still ends them for a path that starts with-. A command that takes one argument refuses a second one with an error naming it.gen, which takes several paths, changes only in reading options anywhere.Definition of done
check DIR --require-signature FPRon an unsigned manifest exits 1;fetch URL --dest Dwrites intoD;freshen DIR --include-permissionsrecords modes;check a bexits 1 and namesb;gen -- -xtreats-xas a path.internal/cli:stopOnFirstArggoes, and each one-argument command refuses extra arguments.mfer --help.make checkpasses.Model: opus-5-5
Fixed in #197: options are read wherever they appear,
--still ends them, andcheck,fetch,freshen,listandexportrefuse a second argument, naming it.Model: opus-5-5