Open files to hash without blocking and reject non-regular ones (closes #100)

A regular file replaced by a FIFO after the walk statted it made the
hash phase's open wait forever for a writer, so the scan never ended
and kept the lock. The hash and content phases now open each file with
O_NONBLOCK and check with fstat that it is still a regular file;
anything else is a per-path error, warned about and skipped. The new
test replaces a walked file with a FIFO before the hash phase reads it.

Model: opus-5-5

scan.go

@@ -1309,6 +1309,38 @@ func hashWorker(ctx context.Context, jobs <-chan []fileRec,
 	}
 }
 
+// errNotRegular reports a path that is no longer a regular file when it
+// is opened to be read.
+var errNotRegular = errors.New("not a regular file")
+
+// openRegularFile opens path for reading and returns it only if it is
+// still a regular file, since the path may have been replaced after it
+// was statted. O_NONBLOCK keeps the open of a FIFO or a device node
+// from waiting forever, and fstat then rejects it. Reads of a regular
+// file ignore O_NONBLOCK.
+func openRegularFile(path string) (*os.File, error) {
+	//nolint:gosec // hashing operator-supplied paths is the tool's purpose
+	f, err := os.OpenFile(path, os.O_RDONLY|syscall.O_NONBLOCK, 0)
+	if err != nil {
+		return nil, err
+	}
+
+	fi, err := f.Stat()
+	if err != nil {
+		_ = f.Close()
+
+		return nil, err
+	}
+
+	if !fi.Mode().IsRegular() {
+		_ = f.Close()
+
+		return nil, errNotRegular
+	}
+
+	return f, nil
+}
+
 // emptyHash is the lowercase-hex SHA-256 of the empty input: the head,
 // tail, and content hash of every zero-length file.
 const emptyHash = "e3b0c44298fc1c149afbf4c8996fb924" +
@@ -1331,8 +1363,7 @@ func hashSignature(path string, size int64) (string, string, string, error) {
 		return emptyHash, emptyHash, emptyHash, nil
 	}
 
-	//nolint:gosec // hashing operator-supplied paths is the tool's purpose
-	f, err := os.Open(path)
+	f, err := openRegularFile(path)
 	if err != nil {
 		return "", "", "", err
 	}
@@ -1363,8 +1394,7 @@ func hashSignature(path string, size int64) (string, string, string, error) {
 // tail are returned empty, because the content phase keeps the ones its
 // records already hold.
 func hashContentOnly(path string, size int64) (string, string, string, error) {
-	//nolint:gosec // hashing operator-supplied paths is the tool's purpose
-	f, err := os.Open(path)
+	f, err := openRegularFile(path)
 	if err != nil {
 		return "", "", "", err
 	}