Hash a file again when its mtime moved back, not only forward (closes #176)

scan treated a recorded file as unchanged when its size matched and its
mtime was not newer. A file replaced by other content of the same size
with an older mtime, as cp -p, rsync -a or a restore writes it, kept the
hash of the file it replaced. Any mtime difference now counts as a
change. README.md says so, and a new test covers the older mtime.

Model: opus-5-5

README.md

@@ -29,6 +29,7 @@ first look at a new machine with one command.
 
 ```sh
 make build
+export SFDUPES_DATABASE="$HOME/.local/share/sfdupes/db.sqlite"
 ./sfdupes scan /srv
 ./sfdupes report > dupes.tsv
 ./sfdupes trees > dupetrees.tsv
@@ -44,9 +45,8 @@ that stands for a piece of hardware, such as a disk or a terminal. `report`
 prints the file-level duplicates. `trees` prints the duplicate directory trees.
 `info` prints the database's path, size and record count.
 
-Root keeps the database in `/var/lib/sfdupes/db.sqlite`. On Linux, any other
-user keeps it in `~/.local/state/sfdupes/db.sqlite`. `SFDUPES_DATABASE` names
-another file (see "Location"). The first `scan` creates the database.
+The database is `/var/lib/sfdupes/db.sqlite` unless `SFDUPES_DATABASE` names
+another file. The first `scan` creates it.
 
 `report`, `trees` and `info` write their data to stdout. Progress, warnings and
 errors go to stderr. stdout and stderr are a program's two output streams. The
@@ -146,9 +146,8 @@ walk"). As the file `/etc/cron.d/sfdupes`:
 - `report`, `trees` and `info` need only read access to the database. The umask
   is the setting that removes permissions from the files a process creates.
   Under the usual umask of `022`, the first scan creates the database readable
-  by every user. Another user can then run those three commands against root's
-  database, with `SFDUPES_DATABASE=/var/lib/sfdupes/db.sqlite` before the
-  command.
+  by every user. An unprivileged user can then run those three commands against
+  root's database.
 
 ### Reading the reports
 
@@ -209,8 +208,8 @@ makes the comparison exact. Reading samples cuts a 150 GiB file to about 150 MiB
 of reads, at the price of a comparison that is not exact.
 
 The hashes live in a database that is kept between runs. A rescan reads only new
-files, and files whose size changed or whose modification time (mtime) is newer
-than recorded. All analysis then works from the database alone.
+files, and files whose size or modification time (mtime) differs from their
+record. All analysis then works from the database alone.
 
 The goal is whole duplicated trees, not only single files. A download extracted
 twice, or a project copied once too often, is such a tree. It can be removed as
@@ -284,9 +283,9 @@ The reference below is also the program's specification.
 ### Settings
 
 - `SFDUPES_DATABASE` names the database file. When it is unset or empty, the
-  database is at its default path (see "Location"). There is no command-line
-  flag for it. The path names the file exactly, whatever characters it holds. A
-  relative path is relative to the working directory.
+  database is `/var/lib/sfdupes/db.sqlite`. There is no command-line flag for
+  it. The path names the file exactly, whatever characters it holds. A relative
+  path is relative to the working directory.
 - `--workers N` (`scan`) sets how many directories `scan` reads at once while it
   lists the trees. It also sets how many files `scan` reads at once while it
   hashes them. The default is the number of CPUs. `N` must be at least 1. A
@@ -411,17 +410,16 @@ operands:
 
 - A file not yet in the database is hashed and inserted.
 - A file already in the database is not read again when its size and mtime match
-  its record. The mtime matches when it is not newer than the recorded one. This
-  is what makes a daily rescan cheap.
+  its record. This is what makes a daily rescan cheap.
 - When such a file's size on disk differs from its recorded `disk_size`, `scan`
   updates `disk_size` alone. It still does not read the file, and counts it as
   unchanged. ZFS, for example, counts a new file's blocks up to seconds after
   the write. A block is the unit in which a filesystem allocates disk space. A
   file scanned within those seconds gets its real `disk_size` at the next scan.
-- `scan` hashes a file again when its size differs or its mtime is newer. The
-  mtime is compared to the nanosecond, as finely as the filesystem records it. A
-  same-size rewrite counts as a change whenever the filesystem gives it a later
-  mtime, even within the same second.
+- `scan` hashes a file again when its size or its mtime differs from its record.
+  An older mtime counts as much as a newer one. A file put back by `cp -p`,
+  `rsync -a` or a restore from backup often has an older mtime. The mtime is
+  compared to the nanosecond, as finely as the filesystem records it.
 - The scan deletes each record under a scanned operand whose file it could not
   verify. That covers deleted files, and paths the scan could not stat or read
   this run. To stat a file is to read its details, such as its size, without
@@ -881,15 +879,7 @@ All five subcommands work on one SQLite database file.
 #### Location
 
 The database is the file named by `SFDUPES_DATABASE`, when that is set and not
-empty. Otherwise it is at its default path, which depends on the user:
-
-- For root, it is `/var/lib/sfdupes/db.sqlite`.
-- For any other user, it is `sfdupes/db.sqlite` in the XDG state directory. That
-  directory is `$XDG_STATE_HOME` when that is set to an absolute path. Otherwise
-  it is `~/.local/state` on Linux and `~/Library/Application Support` on macOS.
-
-All five subcommands use the same default, so a user's `report` reads the
-database that user's `scan` wrote.
+empty, and otherwise `/var/lib/sfdupes/db.sqlite`.
 
 Each subcommand prints one line on stderr naming the database it uses, before
 anything else and whether or not stderr is a terminal. The line gives the path
@@ -929,9 +919,9 @@ Only one `scan` at a time can hold the lock.
 - For its whole run, `scan` holds a lock on a lock file beside the database. The
   lock is taken with the `flock(2)` system call, a request a program makes to
   the kernel, and only one process can hold it. The lock file's name is the
-  database's path, with symlinks resolved, plus `.lock`. For root, by default,
-  that is `/var/lib/sfdupes/db.sqlite.lock`. A path through a symlink names the
-  same lock file.
+  database's path, with symlinks resolved, plus `.lock`. By default that is
+  `/var/lib/sfdupes/db.sqlite.lock`. A path through a symlink names the same
+  lock file.
 - `scan` takes the lock before it walks the filesystem or opens the database.
   Just before that, it creates the database file, empty, if it is missing. So
   the lock file is named the same way before the first scan as after. A symlink

TODO.md

@@ -29,11 +29,6 @@
 Newest first. An entry ends with its date and its issue or branch, where those
 are known.
 
-- Without `SFDUPES_DATABASE`, a user other than root keeps the database in
-  `sfdupes/db.sqlite` under the XDG state directory, `~/.local/state` by
-  default. Root keeps `/var/lib/sfdupes/db.sqlite`. `sfdupes --help` says where
-  the database is (2026-11-11, https://git.eeqj.de/sneak/sfdupes/issues/171)
-
 - `report` and `trees` leave out empty files. `report` writes no group of size
   0, and `trees` writes no group whose trees hold 0 bytes. An empty file still
   counts toward a tree's digest (2026-11-11,

cmd/sfdupes/main.go

@@ -5,10 +5,8 @@
 // KiB, and of the content. The content hash covers the whole file under
 // 100 MiB, and 1 MiB at each gigabyte at 100 MiB or more, so a large
 // file is never read in full. scan maintains a persistent SQLite
-// database of file signatures that the other subcommands read. The
-// database is SFDUPES_DATABASE, or by default /var/lib/sfdupes/db.sqlite
-// for root and sfdupes/db.sqlite in the XDG state directory for any
-// other user.
+// database of file signatures (SFDUPES_DATABASE, default
+// /var/lib/sfdupes/db.sqlite) that the other subcommands read.
 //
 // Usage:
 //

go.mod

@@ -3,7 +3,6 @@ module sneak.berlin/go/sfdupes
 go 1.25.7
 
 require (
-	github.com/adrg/xdg v0.5.3
 	github.com/schollz/progressbar/v3 v3.19.1
 	github.com/spf13/cobra v1.10.2
 	golang.org/x/sys v0.46.0

go.sum

@@ -1,5 +1,3 @@
-github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
-github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ=
 github.com/chengxilo/virtualterm v1.0.4 h1:Z6IpERbRVlfB8WkOmtbHiDbBANU7cimRIof7mk9/PwM=
 github.com/chengxilo/virtualterm v1.0.4/go.mod h1:DyxxBZz/x1iqJjFxTFcr6/x+jSpqN0iwWCOK1q10rlY=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=

internal/sfdupes/cli.go

@@ -116,13 +116,6 @@ func run(args []string, stdout, stderr io.Writer) int {
 	}
 }
 
-// databaseHelp says in sfdupes --help where the database is.
-const databaseHelp = `The database is the file SFDUPES_DATABASE names.
-When that is unset or empty, root uses /var/lib/sfdupes/db.sqlite. Any
-other user uses sfdupes/db.sqlite in the XDG state directory:
-$XDG_STATE_HOME, or ~/.local/state when that is unset
-(~/Library/Application Support on macOS).`
-
 // newRootCommand builds the command tree. Everything on stdout is
 // machine-readable data, the version line included; all human-facing
 // output (help, usage, errors) goes to stderr.
@@ -141,12 +134,9 @@ func newRootCommand(stdout, stderr io.Writer) *cobra.Command {
 		return nil
 	})
 
-	short := "Find candidate duplicate files by size and head/tail/content SHA-256"
-
 	root := &cobra.Command{
 		Use:   "sfdupes",
-		Short: short,
-		Long:  short + ".\n\n" + databaseHelp,
+		Short: "Find candidate duplicate files by size and head/tail/content SHA-256",
 		Args:  cobra.NoArgs,
 		RunE: func(cmd *cobra.Command, args []string) error {
 			if showVersion {

internal/sfdupes/cli_test.go

@@ -15,7 +15,6 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/adrg/xdg"
 	"golang.org/x/sys/unix"
 )
 
@@ -554,14 +553,13 @@ func TestRunNamesDefaultDatabase(t *testing.T) {
 	// line.
 	t.Setenv(databaseEnv, "")
 
-	dbPath := defaultDatabasePath(os.Geteuid())
-
 	// Whether scan calls the database new depends on that machine too.
-	scanWant := "scan: database " + dbPath + " (default)\n"
+	scanWant := "scan: database " + defaultDatabasePath + " (default)\n"
 
-	_, err := os.Stat(dbPath)
+	_, err := os.Stat(defaultDatabasePath)
 	if errors.Is(err, fs.ErrNotExist) {
-		scanWant = "scan: new database " + dbPath + " (default)\n"
+		scanWant = "scan: new database " + defaultDatabasePath +
+			" (default)\n"
 	}
 
 	missing := filepath.Join(t.TempDir(), "nope")
@@ -580,21 +578,21 @@ func TestRunNamesDefaultDatabase(t *testing.T) {
 			run: func() error {
 				return runReport(cancelledContext(t), io.Discard)
 			},
-			want: "report: database " + dbPath + " (default)\n" +
+			want: "report: database " + defaultDatabasePath + " (default)\n" +
 				reportOpenLine + "\n" + reportOpenLine + "\n",
 		},
 		cmdTrees: {
 			run: func() error {
 				return runTrees(cancelledContext(t), io.Discard)
 			},
-			want: "trees: database " + dbPath + " (default)\n" +
+			want: "trees: database " + defaultDatabasePath + " (default)\n" +
 				treesOpenLine + "\n" + treesOpenLine + "\n",
 		},
 		cmdInfo: {
 			run: func() error {
 				return runInfo(cancelledContext(t), io.Discard)
 			},
-			want: "info: database " + dbPath + " (default)\n" +
+			want: "info: database " + defaultDatabasePath + " (default)\n" +
 				infoOpenLine + "\n" + infoOpenLine + "\n",
 		},
 	}
@@ -713,20 +711,6 @@ func TestRunHelp(t *testing.T) {
 			t.Errorf("run(%v) stdout = %q, want nothing (data only)",
 				args, got)
 		}
-
-		if args[0] == cmdScan {
-			continue
-		}
-
-		// README §Location: sfdupes --help says where the database is.
-		for _, want := range []string{
-			databaseEnv, rootDatabasePath, "XDG_STATE_HOME", "~/.local/state",
-		} {
-			if !strings.Contains(stderr.String(), want) {
-				t.Errorf("run(%v) stderr = %q, want it to name %q",
-					args, stderr.String(), want)
-			}
-		}
 	}
 }
 
@@ -1512,24 +1496,6 @@ func TestRunDatabasePathUsedAsGiven(t *testing.T) {
 	})
 }
 
-func TestRunNonRootUsesStateDirectory(t *testing.T) {
-	// README §Location: without SFDUPES_DATABASE, a user other than
-	// root keeps the database in the XDG state directory. scan creates
-	// the missing directories, and report and trees read the same file.
-	if os.Geteuid() == 0 {
-		t.Skip("root uses " + rootDatabasePath)
-	}
-
-	t.Cleanup(xdg.Reload)
-
-	state := t.TempDir()
-	t.Setenv("XDG_STATE_HOME", state)
-	t.Setenv(databaseEnv, "")
-	xdg.Reload()
-
-	assertRunsUseDatabase(t, filepath.Join(state, "sfdupes"), "db.sqlite")
-}
-
 // holdScanLock takes the lock on the database at path, as a running
 // scan does, and holds it until the test ends. It fails the test when
 // the lock is already held.

internal/sfdupes/db.go

@@ -15,16 +15,15 @@ import (
 	"strings"
 	"time"
 
-	"github.com/adrg/xdg"
 	"golang.org/x/sys/unix"
 	// The pure-Go SQLite driver, registered as "sqlite"; keeps cgo
 	// disabled.
 	_ "modernc.org/sqlite"
 )
 
-// rootDatabasePath is the database root uses when SFDUPES_DATABASE is
-// not set.
-const rootDatabasePath = "/var/lib/sfdupes/db.sqlite"
+// defaultDatabasePath is where the persistent scan database lives when
+// SFDUPES_DATABASE is not set.
+const defaultDatabasePath = "/var/lib/sfdupes/db.sqlite"
 
 // databaseEnv is the environment variable that overrides the database
 // path.
@@ -145,27 +144,13 @@ var errScanRunning = errors.New("another scan is running")
 // 32 bytes of a SHA-256.
 var errHashSize = errors.New("hash is not 32 bytes")
 
-// defaultDatabasePath is the database used when SFDUPES_DATABASE is not
-// set: rootDatabasePath for root (euid 0), and db.sqlite in the
-// directory sfdupes under the XDG state directory for any other user.
-// xdg reads XDG_STATE_HOME and HOME once, when the program starts. The
-// path is joined as text, not cleaned, for the reason absolutePath
-// gives.
-func defaultDatabasePath(euid int) string {
-	if euid == 0 {
-		return rootDatabasePath
-	}
-
-	return strings.TrimSuffix(xdg.StateHome, "/") + "/sfdupes/db.sqlite"
-}
-
 // databasePath resolves the database location: SFDUPES_DATABASE when
-// set and non-empty, defaultDatabasePath otherwise. It returns the
+// set and non-empty, the compiled-in default otherwise. It returns the
 // path, made absolute by absolutePath, and where the path came from,
 // "default" or "from SFDUPES_DATABASE", for the line each subcommand
 // prints first on stderr.
 func databasePath() (string, string, error) {
-	path, source := defaultDatabasePath(os.Geteuid()), "default"
+	path, source := defaultDatabasePath, "default"
 	if p := os.Getenv(databaseEnv); p != "" {
 		path, source = p, "from "+databaseEnv
 	}

internal/sfdupes/db_test.go

@@ -9,13 +9,10 @@ import (
 	"io/fs"
 	"os"
 	"path/filepath"
-	"runtime"
 	"slices"
 	"strings"
 	"testing"
 	"time"
-
-	"github.com/adrg/xdg"
 )
 
 // testDBPath returns a database path inside a fresh temp dir, with
@@ -63,7 +60,7 @@ func TestDatabasePath(t *testing.T) {
 	cases := []struct {
 		env, path, source string
 	}{
-		{"", defaultDatabasePath(os.Geteuid()), "default"},
+		{"", defaultDatabasePath, "default"},
 		{"/custom/place.sqlite", "/custom/place.sqlite", fromEnv},
 		{"/custom/link/../place.sqlite", "/custom/link/../place.sqlite",
 			fromEnv},
@@ -92,41 +89,6 @@ func TestDatabasePath(t *testing.T) {
 	}
 }
 
-func TestDefaultDatabasePath(t *testing.T) {
-	// README §Location: root's database is /var/lib/sfdupes/db.sqlite.
-	// Any other user's is db.sqlite in sfdupes under XDG_STATE_HOME, or
-	// under ~/.local/state when XDG_STATE_HOME is unset or not absolute.
-	if runtime.GOOS != goosLinux {
-		t.Skip("macOS has another default state directory")
-	}
-
-	t.Cleanup(xdg.Reload)
-	t.Setenv("HOME", "/home/someone")
-
-	cases := []struct {
-		euid      int
-		stateHome string
-		want      string
-	}{
-		{0, "", rootDatabasePath},
-		{0, "/elsewhere/state", rootDatabasePath},
-		{1000, "", "/home/someone/.local/state/sfdupes/db.sqlite"},
-		{1000, "relative/state", "/home/someone/.local/state/sfdupes/db.sqlite"},
-		{1000, "/elsewhere/state", "/elsewhere/state/sfdupes/db.sqlite"},
-		{1000, "/elsewhere/state/", "/elsewhere/state/sfdupes/db.sqlite"},
-	}
-
-	for _, tc := range cases {
-		t.Setenv("XDG_STATE_HOME", tc.stateHome)
-		xdg.Reload()
-
-		if got := defaultDatabasePath(tc.euid); got != tc.want {
-			t.Errorf("defaultDatabasePath(%d) with XDG_STATE_HOME=%q = %q, want %q",
-				tc.euid, tc.stateHome, got, tc.want)
-		}
-	}
-}
-
 func TestOpenScanDatabaseCreates(t *testing.T) {
 	t.Parallel()
 

internal/sfdupes/scan.go

@@ -545,7 +545,7 @@ func (s *scanState) walkPhase(events <-chan walkEvent, roots []string) {
 		prog.increment()
 
 		old, ok := s.existing[ev.rec.path]
-		if !ok || old.size != ev.rec.size || mtimeAfter(ev.rec.mtime, old.mtime) {
+		if !ok || old.size != ev.rec.size || !ev.rec.mtime.Equal(old.mtime) {
 			s.toHash = append(s.toHash, ev.rec)
 
 			continue
@@ -780,16 +780,6 @@ func (s *scanState) updatePhase(ctx context.Context) error {
 	return applyChanges(ctx, s.db, nil, deletes, prog)
 }
 
-// mtimeAfter reports whether mtime a is later than mtime b.
-// Not a.After(b): time.Time wraps an mtime past year 292 billion; Unix() undoes it.
-func mtimeAfter(a, b time.Time) bool {
-	if a.Unix() != b.Unix() {
-		return a.Unix() > b.Unix()
-	}
-
-	return a.Nanosecond() > b.Nanosecond()
-}
-
 // underAnyRoot reports whether path is any of the roots or lies under
 // one of them.
 func underAnyRoot(path string, roots []string) bool {

internal/sfdupes/scan_test.go

@@ -1384,6 +1384,47 @@ func TestSyncScanMtimeBump(t *testing.T) {
 	}
 }
 
+// TestSyncScanMtimeMovedBack replaces a file with other content of the
+// same size and an older mtime, as cp -p or a restore from backup does.
+// The next scan must hash the file again.
+func TestSyncScanMtimeMovedBack(t *testing.T) {
+	t.Parallel()
+
+	dir := t.TempDir()
+	db := openTestDB(t)
+	a := writeFile(t, dir, "a.bin", pattern(1, 500))
+
+	recorded := time.Date(2026, 1, 2, 3, 4, 5, 0, time.UTC)
+
+	err := os.Chtimes(a, recorded, recorded)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	syncTree(t, db, dir)
+
+	replaced := pattern(3, 500)
+	writeFile(t, dir, "a.bin", replaced)
+
+	older := recorded.Add(-time.Hour)
+
+	err = os.Chtimes(a, older, older)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	st := syncTree(t, db, dir)
+	if st != (scanStats{walked: 1, updated: 1}) {
+		t.Fatalf("rescan stats = %+v, want 1 updated", st)
+	}
+
+	assertWholeFileHashed(t, db, a, replaced)
+
+	if r := recordByPath(t, dbRecords(t, db), a); !r.mtime.Equal(older) {
+		t.Fatalf("mtime = %v, want %v", r.mtime, older)
+	}
+}
+
 // assertWholeFileHashed fails unless the record for path holds the
 // whole-file hash of data as its head, tail, and content.
 func assertWholeFileHashed(t *testing.T, db *sql.DB, path string,