Fix/rsync publishable

.github/workflows/ci.yml

@@ -51,6 +51,7 @@ jobs:
           test -e /proc/sys/fs/binfmt_misc/qemu-aarch64
       - run: make fmt
       - run: make vet
+      - run: make lint
       - run: make test-race
       # The S3 adapters are build-tagged out for smaller binaries; that
       # configuration has to keep compiling and passing.

.gitignore

@@ -1,6 +1,11 @@
-dist
-snailmail
+# Anchored to the repository root. Without the leading slash, "snailmail"
+# matched any path component of that name — which includes the cmd/snailmail
+# directory, so every new file added to the CLI was silently invisible to git.
+# Already-tracked files kept working, which is what hid it.
+/snailmail
 /build/
 /dist/
 *.test
-
+# Workspace runtime state: a lock and a staging directory, written wherever a
+# command runs. Never reviewed, never published.
+.snailmail/

Dockerfile

@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1@sha256:87999aa3d42bdc6bea60565083ee17e86d1f3339802f543c0d03998580f9cb89
-FROM golang:1.25-alpine@sha256:56961d79ea8129efddcc0b8643fd8a5416b4e6228cfd477e3fd61deb2672c587 AS build
+FROM golang:1.25-alpine@sha256:1ae0735f00daffa3aaf1363a5184c0d2dc55c78e3db4ec70241cdac97bf84b59 AS build
 WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
@@ -9,7 +9,14 @@ RUN CGO_ENABLED=0 go test -c -o /out/openpgp.test ./signer/openpgp
 
 # Scanned here rather than on the runner: `go run tool@version` builds the tool
 # with the ambient toolchain, so a runner older than go.mod's requirement cannot
-# load these packages at all. The build image is digest-pinned and current.
+# load these packages at all.
+#
+# The build image is digest-pinned, which means it has to be repinned when the
+# standard library is patched — a pin freezes the toolchain along with
+# everything else, so this job failing is the pin doing its job rather than a
+# surprise. The digest above is what `docker pull golang:1.25-alpine` resolves
+# to; take the new one from there and check `go version` moved past whatever
+# govulncheck named.
 FROM build AS vulncheck
 RUN go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./...
 

Makefile

@@ -51,7 +51,7 @@ help: ## Show the available targets
 # ---------------------------------------------------------------- checks
 
 .PHONY: check
-check: fmt vet test ## Everything CI checks, in the order that fails fastest
+check: fmt vet lint test ## Everything CI checks, in the order that fails fastest
 
 .PHONY: fmt
 fmt: ## Fail if anything is unformatted
@@ -63,10 +63,32 @@ vet: ## Vet the default build and the one with S3 compiled out
 	go vet ./...
 	go vet -tags nos3 ./...
 
+.PHONY: lint
+# staticcheck finds what vet does not: unused code, impossible conditions,
+# results ignored where they matter. An error taxonomy sat here fully populated
+# and entirely unread for long enough to be worth a tool that says so.
+#
+# Pinned like every other tool here, so a lint that passes today passes
+# tomorrow and an upgrade is a reviewable change rather than a surprise. The pin
+# has to be recent enough to read the toolchain go.mod asks for: an older
+# staticcheck cannot decode a newer Go export format and fails on the standard
+# library rather than on this code.
+STATICCHECK ?= go run honnef.co/go/tools/cmd/staticcheck@2026.2.1
+lint: ## Run staticcheck
+	$(STATICCHECK) ./...
+
 .PHONY: test
 test: ## Run the suite
 	go test -count=1 ./...
 
+.PHONY: test-short
+# The inner loop. Leaves out what needs a container, a pip install, or a lock
+# sharded past its threshold — everything whose cost is the machine rather than
+# the code. `check` and CI still run the full suite, so this skips nothing
+# permanently, only between edits.
+test-short: ## Run the suite without the slow machine-dependent tests
+	go test -short -count=1 ./...
+
 .PHONY: test-race
 # The race detector is written in C, so it needs cgo — and the CGO_ENABLED=0 above
 # turns that into "go: -race requires cgo" rather than into a static binary. That

PLAN.md

@@ -1450,8 +1450,10 @@ The format-and-host coupling that this phase owed is closed for its first
 cases: GitHub Pages serves signed Debian, rpm, apk, raw and Helm alongside PyPI.
 The matrix itself is declared in `host/support.go` rather than inferred, so the
 gaps that remain are readable rather than discovered — and each undeclared pair
-records why. Remaining: S3 beyond PyPI, additional key backends, `import`, and
-the TUI. The next formats are nix cache, cargo, go, and maven, in that order.
+records why. Remaining: additional key backends and the TUI. The next formats
+are nix cache, cargo, go, and maven, in that order. `import` is implemented, and
+so is S3 beyond PyPI — see the paragraph below, which was written when it landed
+and outlived this sentence.
 
 S3 beyond PyPI turned out not to be a declaration. The adapter no longer
 hardcodes `simple/index.html`: `host.Repository` carries `CommitPaths`, filled