sneak/mfer
1
0
Fork 0
Code Issues 32 Pull Requests 4 Actions Releases Wiki Activity
Files
0deacfc7edd98fe5e2ba4833ab5f31388ffb40d3
mfer/TODO.md
T
clawbot 0deacfc7ed
check / check (push) Failing after 1s
Details
Validate manifest entry paths on deserialize (closes #61) 
Untrusted .mf files were parsed with no path validation, so an entry like ../../etc/passwd reached filepath.Join against the checker's base path and mfer check could stat and read outside it. ValidatePath ran only when building a manifest. It now runs on every entry as the manifest loads, so every consumer is covered. The whole manifest is rejected on the first bad entry instead of dropping it, which could hide files from a check; the error wraps errInvalidManifestPath and names the path.

Disclosure: a path that is not valid UTF-8 is refused earlier, by the protobuf string decoder, so that error does not name the path.

Model: opus-4-8 (implementation); fable-5-1 (summary)
2026-09-22 00:47:26 +02:00

5.8 KiB
Raw Blame History

Workflow

  • branch (from main)
  • do the work in Next Step
  • move Next Step to the top of Completed Steps
  • move the top item of Future Steps into Next Step
  • commit (TODO.md changes in the same commit as the work)
  • merge to main if the branch is not protected, otherwise open a PR
  • push

Status

pre-1.0. No git tags. README section "TODO: Remaining Work for 1.0" lists open design questions and implementation tasks; policy compliance work is in flight and unmerged.

Next Step

Work through the remaining compliance items folded from the 2026-07-02 audit (the first group under Future Steps): .editorconfig, .gitignore coverage, gofumpt-based fmt-check, README "Getting Started", and the rest. .golangci.yml and TODO.md are tracked and committed as of 2026-08-07, so the only thing left of the chore/align-repo-policies branch is the list below.

Completed Steps

  • 2026-09-21: validate manifest entry paths on deserialize so untrusted .mf files cannot make Checker stat or read outside basePath (#61)
  • 2026-09-21: rewrote script/test to the canonical pattern (30s timeout, -race -cover, quiet-first with verbose-on-failure rerun) and fixed the process-global logger data race it surfaced (#67)
  • 2026-09-21: added the canonical .editorconfig, made .gitignore cover secrets, OS, editor, and Go artifacts, and removed the dead Drone CI references from .gitignore and bin/gitrev.sh (#72)
  • 2026-08-09: added .prettierrc/.prettierignore, gave script/fmt and script/fmt-check one shared prettier file set via script/prettier, dropped the || true that hid prettier failures, and added a node-based Dockerfile stage so a markdown formatting violation fails docker build . (#69)
  • 2026-08-07: updated golangci-lint to v2.12.2 everywhere it is pinned (Makefile, Dockerfile), added the canonical .golangci.yml (default: all), and fixed all resulting lint findings across the codebase
  • 2026-07-07 Adopted scripts-to-rule-them-all: script/ entrypoints, Makefile shims, README Entrypoints section
  • 2026-07-03: aligned repo tooling, docs, and config with standardized policies (7d9a138, on chore/align-repo-policies, unmerged)
  • 2026-06-28: moved to standardized repo policies (#56, on main)
  • 2026-04-07: added 1.0 roadmap as README TODO section, removed old TODO.md (#54)
  • 2026-03-20: added Gitea Actions CI workflow (#53)
  • 2026-03-17: added REPO_POLICIES.md, renamed CLAUDE.md to AGENTS.md (#51); removed committed .index.mf (#52)
  • 2026-03-15: split Dockerfile with pre-built golangci-lint stage for faster CI (#45)
  • 2026-03-01: 1.0 quality polish: code review, tests, bug fixes, docs (#32)
  • 2026-02-20: deterministic file ordering in Builder.Build() (#28); removed committed vendor/modcache archives (#35)
  • 2026-02-08: added --seed flag for deterministic manifest UUID

Future Steps

  • Compliance (fold of TODO.md audit 2026-07-02; verify which items the in-flight branch already closes, then check off):
    • Add .editorconfig (canonical copy from sneak/prompts)
    • Make .gitignore cover secrets (.env, _.key, .pem), OS files (.DS_Store), and editor files (.swp, _~)
    • Make fmt-check/lint verify with gofumpt, not gofmt -l, so make check matches what make fmt writes
    • Add README "Getting Started" section with copy-pasteable install/usage block
    • Move FORMAT.md from repo root to docs/ and update the AGENTS.md reference
    • Pin Makefile-installed Go tools (protoc-gen-go@v1.28.1, golangci-lint@v2.12.2) by module hash, not mutable tag
    • Add explicit README "Rationale" heading (content exists under other names); name the author in the README Description first line
    • Reconcile root-level AGENTS.md with directory-hygiene policy (keep or relocate)
    • Add a make build target
    • Rewrite make hooks to use printf or a heredoc instead of non-portable echo '...\n...'
  • Answer the 14 owner design questions in the README 1.0 roadmap:
    • Format: simplify MFFileChecksum; store file mode; drop atime; specify path normalization rules; version byte after magic; length-prefix after magic
    • Signatures: hash covers compressed or uncompressed data; sign raw bytes vs hex canonical string; detached .mf.sig support; GPG subprocess vs pure-Go crypto
    • Implementation: deterministic manifests by default; consolidate duplicate scanner/checker implementations; export the manifest type; canonical Go module path for 1.0
  • Format and correctness:
    • Resolve proto go_package vs go.mod module path inconsistency
    • Specify and validate path invariants (UTF-8, forward-slash, relative, no .., no leading /)
    • Remove or deprecate atime; reserve mode field; add version byte (all pending design answers)
    • Write a standalone format specification document
  • Library:
    • Delete internal/scanner and internal/checker; consolidate on the mfer/ package versions (pending design answer)
    • Add decompression size limit via io.LimitReader in deserializeInner()
    • Fix errors.Is dead code in checker; make AddFile verify totalRead == size
    • Export manifest type or define a public interface (pending)
    • Replace GPG subprocess with pure-Go crypto (pending); add timeouts to remaining subprocess calls
  • CLI:
    • Kebab-case primary flag names; fix fetch URL construction with url.JoinPath; add http.Client timeout and retry with backoff to fetch; rate-limit Checker progress output; add --deterministic flag or default; wire top-level --version properly
  • Testing:
    • Fuzz NewManifestFromReader; end-to-end tests for freshen and fetch
  • Documentation:
    • Promote docs/FORMAT.md as primary spec reference; audit error messages; document the signature scheme fully
  • Release:
    • Finalize module path, bump version constant, SemVer --version output, tag v1.0.0
Reference in New Issue View Git Blame Copy Permalink