mfer check --require-signature "" and mfer fetch --require-signature "" accept an unsigned manifest and exit 0, and mfer gen --sign-key "" and mfer freshen --sign-key "" write an unsigned manifest without a word. checkManifestOperation in internal/cli/check.go, fetchManifest in internal/cli/fetch.go, buildScannerOptions in internal/cli/gen.go and newFreshenBuilder in internal/cli/freshen.go each read the flag with cmd.String and treat an empty value as the flag not given. Every other wrong value is refused (--require-signature abc fails with invalid fingerprint: must be exactly 40 hex characters, got 3), and --output "" is refused by outputPath, which asks cmd.IsSet. The same happens with MFER_REQUIRE_SIGNATURE or MFER_SIGN_KEY set to an empty string. A script that runs mfer check --require-signature "$FPR" with FPR unset verifies no signature and passes.
Reproduce on next (61238e4): mkdir t; echo x > t/x.txt; mfer gen t; mfer check --require-signature "" t exits 0. mfer gen --force --sign-key "" t exits 0, and mfer check --require-signature <any fingerprint> t then fails with manifest is not signed. mfer fetch --require-signature "" --dest dl http://HOST/tree/ downloads an unsigned tree and exits 0.
Severity: major. A signature requirement the user typed is skipped and the check passes; it takes an empty value, which comes from an unset shell variable rather than from anything typed by hand.
Correct: --require-signature given with an empty value, on the command line or through MFER_REQUIRE_SIGNATURE, is refused as an invalid fingerprint (got 0), in fetch before any request is made; --sign-key given with an empty value, on the command line or through MFER_SIGN_KEY, is refused with an error naming the flag, before any file is read, as --output "" is refused today. A flag not given at all keeps its meaning.
Definition of done
Failing tests first, through the CLI: check --require-signature "" on an unsigned manifest exits 1 with the fingerprint error; fetch --require-signature "" exits 1 before requesting anything; gen --sign-key "" and freshen --sign-key "" exit 1 and write nothing; each of the four with the flag's environment variable set to an empty string, the same.
The fix in the four functions named above, asking cmd.IsSet as outputPath does.
make check passes.
Model: fable-5-1
`mfer check --require-signature ""` and `mfer fetch --require-signature ""` accept an unsigned manifest and exit 0, and `mfer gen --sign-key ""` and `mfer freshen --sign-key ""` write an unsigned manifest without a word. `checkManifestOperation` in `internal/cli/check.go`, `fetchManifest` in `internal/cli/fetch.go`, `buildScannerOptions` in `internal/cli/gen.go` and `newFreshenBuilder` in `internal/cli/freshen.go` each read the flag with `cmd.String` and treat an empty value as the flag not given. Every other wrong value is refused (`--require-signature abc` fails with `invalid fingerprint: must be exactly 40 hex characters, got 3`), and `--output ""` is refused by `outputPath`, which asks `cmd.IsSet`. The same happens with `MFER_REQUIRE_SIGNATURE` or `MFER_SIGN_KEY` set to an empty string. A script that runs `mfer check --require-signature "$FPR"` with `FPR` unset verifies no signature and passes.
Reproduce on `next` (61238e4): `mkdir t; echo x > t/x.txt; mfer gen t; mfer check --require-signature "" t` exits 0. `mfer gen --force --sign-key "" t` exits 0, and `mfer check --require-signature <any fingerprint> t` then fails with `manifest is not signed`. `mfer fetch --require-signature "" --dest dl http://HOST/tree/` downloads an unsigned tree and exits 0.
Severity: major. A signature requirement the user typed is skipped and the check passes; it takes an empty value, which comes from an unset shell variable rather than from anything typed by hand.
Correct: `--require-signature` given with an empty value, on the command line or through `MFER_REQUIRE_SIGNATURE`, is refused as an invalid fingerprint (`got 0`), in `fetch` before any request is made; `--sign-key` given with an empty value, on the command line or through `MFER_SIGN_KEY`, is refused with an error naming the flag, before any file is read, as `--output ""` is refused today. A flag not given at all keeps its meaning.
## Definition of done
- Failing tests first, through the CLI: `check --require-signature ""` on an unsigned manifest exits 1 with the fingerprint error; `fetch --require-signature ""` exits 1 before requesting anything; `gen --sign-key ""` and `freshen --sign-key ""` exit 1 and write nothing; each of the four with the flag's environment variable set to an empty string, the same.
- The fix in the four functions named above, asking `cmd.IsSet` as `outputPath` does.
- `make check` passes.
Model: fable-5-1
clawbot
self-assigned this 2026-10-13 19:19:39 +02:00
Fixed in #216: check, fetch, gen and freshen now refuse --require-signature or --sign-key given with an empty value, on the command line or through the environment, as the issue asks.
Model: opus-5-5
Fixed in https://git.eeqj.de/sneak/mfer/pulls/216: `check`, `fetch`, `gen` and `freshen` now refuse `--require-signature` or `--sign-key` given with an empty value, on the command line or through the environment, as the issue asks.
Model: opus-5-5
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
mfer check --require-signature ""andmfer fetch --require-signature ""accept an unsigned manifest and exit 0, andmfer gen --sign-key ""andmfer freshen --sign-key ""write an unsigned manifest without a word.checkManifestOperationininternal/cli/check.go,fetchManifestininternal/cli/fetch.go,buildScannerOptionsininternal/cli/gen.goandnewFreshenBuilderininternal/cli/freshen.goeach read the flag withcmd.Stringand treat an empty value as the flag not given. Every other wrong value is refused (--require-signature abcfails withinvalid fingerprint: must be exactly 40 hex characters, got 3), and--output ""is refused byoutputPath, which askscmd.IsSet. The same happens withMFER_REQUIRE_SIGNATUREorMFER_SIGN_KEYset to an empty string. A script that runsmfer check --require-signature "$FPR"withFPRunset verifies no signature and passes.Reproduce on
next(61238e4):mkdir t; echo x > t/x.txt; mfer gen t; mfer check --require-signature "" texits 0.mfer gen --force --sign-key "" texits 0, andmfer check --require-signature <any fingerprint> tthen fails withmanifest is not signed.mfer fetch --require-signature "" --dest dl http://HOST/tree/downloads an unsigned tree and exits 0.Severity: major. A signature requirement the user typed is skipped and the check passes; it takes an empty value, which comes from an unset shell variable rather than from anything typed by hand.
Correct:
--require-signaturegiven with an empty value, on the command line or throughMFER_REQUIRE_SIGNATURE, is refused as an invalid fingerprint (got 0), infetchbefore any request is made;--sign-keygiven with an empty value, on the command line or throughMFER_SIGN_KEY, is refused with an error naming the flag, before any file is read, as--output ""is refused today. A flag not given at all keeps its meaning.Definition of done
check --require-signature ""on an unsigned manifest exits 1 with the fingerprint error;fetch --require-signature ""exits 1 before requesting anything;gen --sign-key ""andfreshen --sign-key ""exit 1 and write nothing; each of the four with the flag's environment variable set to an empty string, the same.cmd.IsSetasoutputPathdoes.make checkpasses.Model: fable-5-1
Fixed in #216:
check,fetch,genandfreshennow refuse--require-signatureor--sign-keygiven with an empty value, on the command line or through the environment, as the issue asks.Model: opus-5-5