Skip to content
go-libfossil Tags and Properties
Login

Tags and Properties

Tags and Properties for Check-in c1cbd26795

Context
2026-07-24
22:49 • Edit [c1cbd26795]: Add tag "observer/otel/v0.2.0" with note "observer/otel v0.2.0

First tag under the corrected module path (github.com/danmestas/go-libfossil/observer/otel), unblocking release of the parent module without local replace directives.". artifact: 50c3dc1e8c user: [email protected]

22:49 • Edit [c1cbd26795]: Add tag "db/driver/ncruces/v0.3.0" with note "db/driver/ncruces v0.3.0

First tag under the corrected module path (github.com/danmestas/go-libfossil/db/driver/ncruces), unblocking release of the parent module without local replace directives.". artifact: b06dadc22f user: [email protected]

22:49 • Edit [c1cbd26795]: Add tag "db/driver/modernc/v0.3.0" with note "db/driver/modernc v0.3.0

First tag under the corrected module path (github.com/danmestas/go-libfossil/db/driver/modernc), unblocking release of the parent module without local replace directives.". artifact: f015266b43 user: [email protected]

22:17
deck: strip PGP/SSH clearsign framing before VerifyZ (#156) (#160)

VerifyZ validated a control artifact by hashing everything up to the last 35 bytes and comparing against the Z card it expected to find there. When a manifest arrived PGP-clearsigned, the raw blob carried a trailing "-----BEGIN PGP SIGNATURE-----" ... "-----END PGP SIGNATURE-----" block after the Z card, so the last-35-byte window landed inside the signature framing instead of on the Z card, and verification failed. deck.Parse propagated that failure, so ~95 of Fossil's own 2007-era clearsigned check-ins could not be parsed -- and any child whose primary parent was one of them lost its parent's file tree in loadPrimaryParentFiles, cascading into all-added mlink data (~98 affected children on the real corpus).

Mirror fossil's src/manifest.c remove_pgp_signature: strip the armor header (up to the blank line that ends it) and the trailing signature block, isolating the inner content the Z card is actually computed over, then verify and parse that. The stripping is an identity on non-clearsigned input (the common case) and idempotent.

The artifact's content-addressed hash is taken over the raw blob elsewhere and is untouched by this change: a clearsigned manifest still resolves to the same UUID it always has. Verified against the real Fossil check-in 61829b07 (aku, 2007-11-29), whose raw-blob SHA-1 still equals its UUID and whose inner Z-card MD5 now validates; cross-checked byte-for-byte against fossil 2.28. check-in: c1cbd26795 user: [email protected] tags: trunk, observer/otel/v0.2.0, db/driver/ncruces/v0.3.0, db/driver/modernc/v0.3.0

2026-04-19
16:30
Initial open source release

libfossil is a pure-Go implementation of the Fossil SCM, reading and writing the same .fossil SQLite repository format as upstream Fossil.

This is the first public release of code that previously lived in a private repository. The module path is github.com/danmestas/libfossil and the binary is named libfossil to avoid $PATH collisions with upstream fossil.

Included: - Repo lifecycle (create, clone), checkout/checkin, timeline, merge, diff, annotate, shun, tag, branch, bisect, stash, undo/redo - Sync-over-HTTP protocol (client and handler) - Two SQLite drivers: modernc (pure Go, default) and ncruces (wasm-capable) - Observer interfaces (SyncObserver, CheckoutObserver) with an optional OpenTelemetry implementation in observer/otel (separate submodule) - Deterministic simulation testing harness with BUGGIFY fault injection - Kong-based embeddable CLI under cli/ and a standalone binary under cmd/libfossil/ check-in: f5744359d3 user: [email protected] tags: trunk