sneak a10c588152 Refuse to freshen a signed manifest without --sign-key (closes #191) ...

freshen built the new manifest from its flags alone, so a signed
manifest freshened without --sign-key came out unsigned while the log
said its signature verified. freshen now stops after loading such a
manifest, before scanning, with an error naming the signer's
fingerprint and --sign-key, and leaves the manifest as it was. With
--sign-key it rewrites and signs as before.

The library gains Signer() on the loaded manifest: the signing key's
fingerprint, or nil when the manifest is unsigned, as Checker.Signer
gives it.

Model: opus-5-5

2026-10-13 15:15:13 +00:00

..

testdata

Raise Go to the latest release, update dependencies, use the standard library uuid, add a vulnerability check (closes #102)

2026-10-06 20:26:15 +02:00

check.go

Log failed files at error level so check -q shows them (closes #195)

2026-10-13 16:46:13 +02:00

entry_test.go

Log failed files at error level so check -q shows them (closes #195)

2026-10-13 16:46:13 +02:00

entry.go

Limit how much fetch and check read for a manifest or a file (closes #168)

2026-10-07 14:25:45 +02:00

errmsg_test.go

Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

2026-10-08 09:42:45 +02:00

export_test.go

Record file mode in the manifest, 0000 unless asked (closes #161)

2026-10-06 11:43:18 +02:00

export.go

Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

2026-10-08 09:42:45 +02:00

fetch_test.go

Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

2026-10-08 09:42:45 +02:00

fetch.go

Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

2026-10-08 09:42:45 +02:00

freshen_test.go

List a directory named through a symlink in gen and freshen (closes #185)

2026-10-08 05:59:02 +02:00

freshen.go

Refuse to freshen a signed manifest without --sign-key (closes #191)

2026-10-13 15:15:13 +00:00

gen.go

Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

2026-10-08 09:42:45 +02:00

list.go

Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

2026-10-08 09:42:45 +02:00

manifest_loader.go

Resolve check and freshen paths against the manifest's directory (closes #177)

2026-10-07 17:28:38 +02:00

mfer.go

Read options after the path or URL and refuse a second argument (closes #196)

2026-10-13 14:21:56 +02:00

mtime.go

Update golangci-lint to v2.12.2 with canonical config (closes #60)

2026-08-10 16:06:12 +02:00

pipe_test.go

Read only regular files in gen, freshen and check (closes #189)

2026-10-13 16:39:09 +02:00

signing_test.go

Refuse to freshen a signed manifest without --sign-key (closes #191)

2026-10-13 15:15:13 +00:00

signing.go

Sign and verify manifests in Go with OpenPGP instead of running gpg (closes #181)

2026-10-08 09:42:45 +02:00