[quality debt] archive reproducibility, test portability, and deferred compatibility gaps

[Vonng]

Purpose

Archive non-blocking release-quality debt found during the mcli candidate audit. These items must not be mistaken for completed validation, but they should not be mixed into the credential/provenance blocker patches unless directly required.

Build and reproducibility

• Raw Go binaries were byte-identical across two clean builds, but tar/RPM/DEB/APK outputs were not bit-for-bit reproducible.
• Normalize archive/package timestamps if reproducible distribution artifacts become a stated guarantee.
• Docker base digests are pinned, but the DNF certificate layer uses a floating repository; keep documentation honest about this boundary.
• Decide whether SBOM, container scanning and image signing are release requirements or later hardening.

Test harness and output debt

• functional-tests.sh uses GNU grep -P and fails under stock macOS BSD grep.
• legacy localhost certificate lacks a Go 1.27-compliant SAN; tests currently need a generated SAN certificate.
• malformed --json usage can return human help rather than machine-readable JSON.
• help/error text still contains several stale mc examples in the mcli distribution.
• actionlint/ShellCheck warnings and the CONTRIBUTING/new-file copyright-header mismatch need a separate cleanup decision.

Coverage and deferred compatibility matrix

• cmd statement coverage remains low; no fuzz target is currently a required gate.
• KMS and SSE-S3 integration are not covered by the current environment.
• real dual-site replication, long-duration load and large-scale object sets remain untested.
• real storage corruption cannot be safely manufactured externally; MISMATCH remains mock/fault-injection coverage.
• amd64 package metadata/hash and crosscompile passed; keep real per-architecture install/runtime coverage explicit.

Dependency/security observations

• govulncheck reports no reachable vulnerability, but tracks module-level GO-2026-5932 in indirect x/crypto/openpgp; no fixed version exists and mcli does not import/call it.
• non-provider secret patterns and secret validity checks remain disabled; decide whether available account tier/features justify enabling them.

Decision

• Credential-output, provenance, release-event and governance issues are release blockers and tracked separately.
• This issue is the accepted-debt ledger. Each item must be explicitly closed, split into a focused issue, or documented as a retained boundary before declaring the release audit complete.

Related

• [release] integrate and ship the checksum-audit mcli candidate #7 release sequencing umbrella.
• PR release: silo-pkg v3.13.0 module path, fail-closed credential redaction, release gates #13.