sneak 814859c4f3 Require a SHA-256 hash in every manifest entry (closes #224) ...

Loading accepted an entry whose hashes held no SHA-256 multihash, and
check and fetch, which compute only SHA-256, then reported the intact
file as a hash mismatch. Loading now refuses such an entry, naming its
path. AddFileWithHash accepts only a SHA-256 multihash, and freshen
carries an unchanged entry's SHA-256 hash over instead of its first
hash. SHA256Multihash, new in package mfer, finds that hash for both.
docs/FORMAT.md states the rule for writers and readers. Two loading
tests whose entries held an empty hash now give each entry a SHA-256
hash; the decoding-size test's path lengths change with it.

Model: opus-5-5

2026-10-15 18:16:16 +00:00

..

testdata

Raise Go to the latest release, update dependencies, use the standard library uuid, add a vulnerability check (closes #102)

2026-10-06 20:26:15 +02:00

check.go

Refuse an empty --require-signature or --sign-key (closes #205)

2026-10-14 00:01:30 +02:00

entry_test.go

Report only symlinks to regular files as extra files in check (closes #192)

2026-10-14 00:00:53 +02:00

entry.go

Take the version from the git tag, not a constant (closes #80)

2026-10-14 00:00:35 +02:00

errmsg_test.go

Refuse a file whose size changed between freshen's scan and hash (closes #207)

2026-10-14 00:01:34 +02:00

export_test.go

Hold runMu in internal/cli tests that log outside a CLI run (closes #210)

2026-10-14 00:00:14 +02:00

export.go

Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

2026-10-08 09:42:45 +02:00

fetch_test.go

Return the context's error when it ends during a fetch request (closes #221)

2026-10-14 01:55:41 +02:00

fetch.go

Return the context's error when it ends during a fetch request (closes #221)

2026-10-14 01:55:41 +02:00

freshen_test.go

Require a SHA-256 hash in every manifest entry (closes #224)

2026-10-15 18:16:16 +00:00

freshen.go

Require a SHA-256 hash in every manifest entry (closes #224)

2026-10-15 18:16:16 +00:00

gen.go

Refuse an empty --require-signature or --sign-key (closes #205)

2026-10-14 00:01:30 +02:00

list.go

Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

2026-10-08 09:42:45 +02:00

manifest_loader.go

Resolve check and freshen paths against the manifest's directory (closes #177)

2026-10-07 17:28:38 +02:00

mfer.go

Read a path or URL named help or h as an argument (closes #198)

2026-10-14 00:00:44 +02:00

mtime.go

Update golangci-lint to v2.12.2 with canonical config (closes #60)

2026-08-10 16:06:12 +02:00

pipe_test.go

Read only regular files in gen, freshen and check (closes #189)

2026-10-13 16:39:09 +02:00

signing_test.go

Sign or timestamp an unchanged tree's manifest in freshen (closes #190)

2026-10-14 00:42:44 +02:00

signing.go

Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

2026-10-08 09:42:45 +02:00