check, fetch, gen and freshen now refuse --require-signature or --sign-key given with an empty value, on the command line or through MFER_REQUIRE_SIGNATURE or MFER_SIGN_KEY, instead of taking it as the flag not given. Each of the four functions asks cmd.IsSet, as outputPath does for --output.
An empty fingerprint fails with invalid fingerprint: must be exactly 40 hex characters, got 0. fetch refuses it before it requests anything.
An empty --sign-key fails with --sign-key must not be empty before gen or freshen reads any file, and the manifest is left as it was. The message names the flag even when the empty value came from MFER_SIGN_KEY.
Judgement call: fetch refuses only the empty fingerprint before the download. Any other malformed one is still refused once the manifest is in, as before; refusing those earlier too would mean changing verifyRequiredSigner, outside the four functions the issue names.
fetch builds the empty-fingerprint error from errInvalidFingerprint with got 0 written out, so it prints what check prints without calling verifyRequiredSigner, which needs a loaded manifest.
#203 adds a cmd.String("sign-key") == "" test to loadExistingEntries. newFreshenBuilder runs before it, so after this change an empty value is refused before that test is reached, and the two merge in either order.
Model: opus-5-5
`check`, `fetch`, `gen` and `freshen` now refuse `--require-signature` or `--sign-key` given with an empty value, on the command line or through `MFER_REQUIRE_SIGNATURE` or `MFER_SIGN_KEY`, instead of taking it as the flag not given. Each of the four functions asks `cmd.IsSet`, as `outputPath` does for `--output`.
- An empty fingerprint fails with `invalid fingerprint: must be exactly 40 hex characters, got 0`. `fetch` refuses it before it requests anything.
- An empty `--sign-key` fails with `--sign-key must not be empty` before `gen` or `freshen` reads any file, and the manifest is left as it was. The message names the flag even when the empty value came from `MFER_SIGN_KEY`.
- A flag not given at all behaves as before.
Closes https://git.eeqj.de/sneak/mfer/issues/205
What the diff does not show:
- Judgement call: `fetch` refuses only the empty fingerprint before the download. Any other malformed one is still refused once the manifest is in, as before; refusing those earlier too would mean changing `verifyRequiredSigner`, outside the four functions the issue names.
- `fetch` builds the empty-fingerprint error from `errInvalidFingerprint` with `got 0` written out, so it prints what `check` prints without calling `verifyRequiredSigner`, which needs a loaded manifest.
- https://git.eeqj.de/sneak/mfer/pulls/203 adds a `cmd.String("sign-key") == ""` test to `loadExistingEntries`. `newFreshenBuilder` runs before it, so after this change an empty value is refused before that test is reached, and the two merge in either order.
Model: opus-5-5
check, fetch, gen and freshen took --require-signature or --sign-key
given an empty value, on the command line or through
MFER_REQUIRE_SIGNATURE or MFER_SIGN_KEY, as the flag not given, so an
unset shell variable skipped the signature check or the signing. Each
now asks whether the flag was given, as gen's --output does. An empty
fingerprint is refused as one of the wrong length, by fetch before it
requests anything; an empty --sign-key is refused, naming the flag,
before any file is read.
Model: opus-5-5
Judgement call: --sign-key must not be empty is also the error when the empty value comes from MFER_SIGN_KEY. I accept it: the issue asks for an error naming the flag, and --help shows the variable beside the flag.
Judgement call: check given a manifest URL still downloads the manifest before it refuses an empty fingerprint. The issue requires a refusal before any request only from fetch.
Model: opus-5-5
Review passed.
- Judgement call: `--sign-key must not be empty` is also the error when the empty value comes from `MFER_SIGN_KEY`. I accept it: the issue asks for an error naming the flag, and `--help` shows the variable beside the flag.
- Judgement call: `check` given a manifest URL still downloads the manifest before it refuses an empty fingerprint. The issue requires a refusal before any request only from `fetch`.
Model: opus-5-5
clawbot
merged commit 6540e5f285 into next2026-10-14 00:01:32 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
check,fetch,genandfreshennow refuse--require-signatureor--sign-keygiven with an empty value, on the command line or throughMFER_REQUIRE_SIGNATUREorMFER_SIGN_KEY, instead of taking it as the flag not given. Each of the four functions askscmd.IsSet, asoutputPathdoes for--output.invalid fingerprint: must be exactly 40 hex characters, got 0.fetchrefuses it before it requests anything.--sign-keyfails with--sign-key must not be emptybeforegenorfreshenreads any file, and the manifest is left as it was. The message names the flag even when the empty value came fromMFER_SIGN_KEY.Closes #205
What the diff does not show:
fetchrefuses only the empty fingerprint before the download. Any other malformed one is still refused once the manifest is in, as before; refusing those earlier too would mean changingverifyRequiredSigner, outside the four functions the issue names.fetchbuilds the empty-fingerprint error fromerrInvalidFingerprintwithgot 0written out, so it prints whatcheckprints without callingverifyRequiredSigner, which needs a loaded manifest.cmd.String("sign-key") == ""test toloadExistingEntries.newFreshenBuilderruns before it, so after this change an empty value is refused before that test is reached, and the two merge in either order.Model: opus-5-5
Review passed.
--sign-key must not be emptyis also the error when the empty value comes fromMFER_SIGN_KEY. I accept it: the issue asks for an error naming the flag, and--helpshows the variable beside the flag.checkgiven a manifest URL still downloads the manifest before it refuses an empty fingerprint. The issue requires a refusal before any request only fromfetch.Model: opus-5-5