switch back to qt

.gitignore

@@ -1,6 +1,7 @@
 /cli
 /server
 /web
+/gui
 /env/
 /build/
 *.exe

build.sh

@@ -35,7 +35,7 @@ fi
 
 ## SERVER
 
-platforms=("linux/amd64" "linux/arm64" "linux/riscv64" "linux/ppc64le", "windows/amd64")
+platforms=("linux/amd64" "linux/arm64" "linux/riscv64" "linux/ppc64le" "windows/amd64")
 
 for platform in "${platforms[@]}"; do
     echo "* Compiling server for $platform..."
@@ -48,10 +48,24 @@ for platform in "${platforms[@]}"; do
 
     if [ "$MAKE_PACKAGE" == "true" ]; then
         CGO_ENABLED=0 GOOS=${platform_split[0]} GOARCH=${platform_split[1]} GORISCV64=rva22u64 GOAMD64=v3 GOARM64=v8.2 go build -o build/cloudsave_server$EXT -a ./cmd/server
+        if [ $? -ne 0 ]; then
+          exit 1
+        fi
+
         tar -czf build/server_${platform_split[0]}_${platform_split[1]}.tar.gz build/cloudsave_server$EXT
+        if [ $? -ne 0 ]; then
+          exit 1
+        fi
+
         rm build/cloudsave_server$EXT
+        if [ $? -ne 0 ]; then
+          exit 1
+        fi
     else
       CGO_ENABLED=0 GOOS=${platform_split[0]} GOARCH=${platform_split[1]} GORISCV64=rva22u64 GOAMD64=v3 GOARM64=v8.2 go build -o build/cloudsave_server_${platform_split[0]}_${platform_split[1]}$EXT -a ./cmd/server
+      if [ $? -ne 0 ]; then
+        exit 1
+      fi
     fi
 done
 
@@ -70,10 +84,24 @@ for platform in "${platforms[@]}"; do
 
     if [ "$MAKE_PACKAGE" == "true" ]; then
         CGO_ENABLED=0 GOOS=${platform_split[0]} GOARCH=${platform_split[1]} go build -o build/cloudsave_web$EXT -a ./cmd/web
+        if [ $? -ne 0 ]; then
+          exit 1
+        fi
+
         tar -czf build/web_${platform_split[0]}_${platform_split[1]}.tar.gz build/cloudsave_web$EXT
+        if [ $? -ne 0 ]; then
+          exit 1
+        fi
+
         rm build/cloudsave_web$EXT
+        if [ $? -ne 0 ]; then
+          exit 1
+        fi
     else
       CGO_ENABLED=0 GOOS=${platform_split[0]} GOARCH=${platform_split[1]} go build -o build/cloudsave_web_${platform_split[0]}_${platform_split[1]}$EXT -a ./cmd/web
+      if [ $? -ne 0 ]; then
+        exit 1
+      fi
     fi
 done
 
@@ -92,9 +120,23 @@ for platform in "${platforms[@]}"; do
 
     if [ "$MAKE_PACKAGE" == "true" ]; then
         CGO_ENABLED=0 GOOS=${platform_split[0]} GOARCH=${platform_split[1]} go build -o build/cloudsave$EXT -a ./cmd/cli
+        if [ $? -ne 0 ]; then
+          exit 1
+        fi
+
         tar -czf build/cli_${platform_split[0]}_${platform_split[1]}.tar.gz build/cloudsave$EXT
+        if [ $? -ne 0 ]; then
+          exit 1
+        fi
+
         rm build/cloudsave$EXT
+        if [ $? -ne 0 ]; then
+          exit 1
+        fi
     else
         CGO_ENABLED=0 GOOS=${platform_split[0]} GOARCH=${platform_split[1]} go build -o build/cloudsave_${platform_split[0]}_${platform_split[1]}$EXT -a ./cmd/cli
+        if [ $? -ne 0 ]; then
+          exit 1
+        fi
     fi
 done

cmd/cli/commands/sync/sync.go

@@ -7,11 +7,10 @@ import (
 	"cloudsave/pkg/remote"
 	"cloudsave/pkg/remote/client"
 	"cloudsave/pkg/repository"
+	"cloudsave/pkg/sync"
 	"context"
-	"errors"
 	"flag"
 	"fmt"
-	"log/slog"
 	"os"
 	"time"
 
@@ -38,239 +37,90 @@ func (p *SyncCmd) SetFlags(f *flag.FlagSet) {
 }
 
 func (p *SyncCmd) Execute(_ context.Context, f *flag.FlagSet, _ ...interface{}) subcommands.ExitStatus {
-	games, err := p.Service.AllGames()
+
+	remoteCred := make(map[string]map[string]string)
+	rs, err := remote.All()
 	if err != nil {
-		fmt.Fprintln(os.Stderr, "error: failed to load datastore:", err)
+		fmt.Fprintln(os.Stderr, "error: failed to connect to the remote:", err)
 		return subcommands.ExitFailure
 	}
 
-	remoteCred := make(map[string]map[string]string)
+	done := make(map[string]struct{})
-	for _, g := range games {
+	for _, r := range rs {
-		r, err := remote.One(g.ID)
+		if _, ok := done[r.URL]; ok {
-		if err != nil {
-			if errors.Is(err, remote.ErrNoRemote) {
-				fmt.Println("⬛", g.Name+": no remote configured")
 			continue
 		}
-			fmt.Fprintln(os.Stderr, "error: failed to load datastore:", err)
+
-			return subcommands.ExitFailure
-		}
 		cli, err := connect(remoteCred, r)
 		if err != nil {
 			fmt.Fprintln(os.Stderr, "error: failed to connect to the remote:", err)
 			return subcommands.ExitFailure
 		}
 
-		pg := progressbar.New(-1)
+		fmt.Println()
+
+		done[r.URL] = struct{}{}
+		syncer := sync.NewSyncer(cli, p.Service)
+
+		var pg *progressbar.ProgressBar
 		destroyPg := func() {
 			pg.Finish()
 			pg.Clear()
 			pg.Close()
 		}
 
-		pg.Describe(fmt.Sprintf("[%s] Checking status...", g.Name))
+		syncer.SetStateCallback(func(s sync.State, g repository.Metadata) {
-		exists, err := cli.Exists(r.GameID)
+			switch s {
-		if err != nil {
+			case sync.FetchingMetdata:
-			slog.Error(err.Error())
+				pg = progressbar.New(-1)
-			continue
+				pg.Describe(fmt.Sprintf("%s: fetching metadata from repository", g.Name))
-		}
+			case sync.Pushing:
-
+				pg.Describe(fmt.Sprintf("%s: pushing data to the server", g.Name))
-		if !exists {
+			case sync.Pulling:
-			pg.Describe(fmt.Sprintf("[%s] Pushing data...", g.Name))
+				pg.Describe(fmt.Sprintf("%s: pull data from the server", g.Name))
-			if err := p.push(g, cli); err != nil {
+			case sync.UpToDate:
 				destroyPg()
-				fmt.Fprintln(os.Stderr, "failed to push:", err)
-				return subcommands.ExitFailure
-			}
-			pg.Describe(fmt.Sprintf("[%s] Pushing backup...", g.Name))
-			if err := p.pushBackup(g, cli); err != nil {
-				destroyPg()
-				slog.Warn("failed to push backup files", "err", err)
-			}
-			destroyPg()
-			fmt.Println("⬆️", g.Name+": pushed")
-			continue
-		}
-
-		pg.Describe(fmt.Sprintf("[%s] Fetching metadata...", g.Name))
-
-		remoteMetadata, err := cli.Metadata(r.GameID)
-		if err != nil {
-			destroyPg()
-			fmt.Fprintln(os.Stderr, "error: failed to get the game metadata from the remote:", err)
-			continue
-		}
-
-		pg.Describe(fmt.Sprintf("[%s] Pulling backup...", g.Name))
-		if err := p.pullBackup(g, cli); err != nil {
-			slog.Warn("failed to pull backup files", "err", err)
-		}
-
-		pg.Describe(fmt.Sprintf("[%s] Pushing backup...", g.Name))
-		if err := p.pushBackup(g, cli); err != nil {
-			slog.Warn("failed to push backup files", "err", err)
-		}
-
-		if g.MD5 == remoteMetadata.MD5 {
-			destroyPg()
-			if g.Version != remoteMetadata.Version {
-				slog.Debug("version is not the same, but the hash is equal. Updating local database")
-				if err := p.Service.SetVersion(r.GameID, remoteMetadata.Version); err != nil {
-					fmt.Fprintln(os.Stderr, "error: failed to synchronize version number:", err)
-					continue
-				}
-			}
 				fmt.Println("🆗", g.Name+": already up-to-date")
-			continue
+			case sync.Pushed:
-		}
-
-		if g.Version > remoteMetadata.Version {
-			pg.Describe(fmt.Sprintf("[%s] Pushing data...", g.Name))
-			if err := p.push(g, cli); err != nil {
-				destroyPg()
-				fmt.Fprintln(os.Stderr, "failed to push:", err)
-				return subcommands.ExitFailure
-			}
 				destroyPg()
 				fmt.Println("⬆️", g.Name+": pushed")
-			continue
+			case sync.Pulled:
-		}
-
-		if g.Version < remoteMetadata.Version {
 				destroyPg()
-			if err := p.pull(g, cli); err != nil {
-				destroyPg()
-				fmt.Fprintln(os.Stderr, "failed to push:", err)
-				return subcommands.ExitFailure
-			}
-
-			g.Version = remoteMetadata.Version
-			g.Date = remoteMetadata.Date
-
-			if err := p.Service.UpdateMetadata(g.ID, g); err != nil {
-				destroyPg()
-				fmt.Fprintln(os.Stderr, "failed to push:", err)
-				return subcommands.ExitFailure
-			}
 				fmt.Println("⬇️", g.Name+": pulled")
-			continue
 			}
+		})
 
+		syncer.SetErrorCallback(func(err error, g repository.Metadata) {
 			destroyPg()
+			fmt.Println("❌", g.Name+": "+err.Error())
+		})
 
-		if g.Version == remoteMetadata.Version {
+		syncer.SetConflictCallback(func(a, b repository.Metadata) sync.ConflictResolution {
-			if err := p.conflict(r.GameID, g, remoteMetadata, cli); err != nil {
-				fmt.Fprintln(os.Stderr, "error: failed to resolve conflict:", err)
-				continue
-			}
-			continue
-		}
-	}
-
-	fmt.Println("done.")
-	return subcommands.ExitSuccess
-}
-
-func (p *SyncCmd) conflict(gameID string, m, remoteMetadata repository.Metadata, cli *client.Client) error {
-	g, err := p.Service.One(gameID)
-	if err != nil {
-		slog.Warn("a conflict was found but the game is not found in the database")
-		slog.Debug("debug info", "gameID", gameID)
-		return nil
-	}
 			fmt.Println()
 			fmt.Println("--- ⚠️ CONFLICT ---")
-	fmt.Println(g.Name, "(", g.Path, ")")
+			fmt.Println(a.Name, "(", a.Path, ")")
 			fmt.Println("----")
-	fmt.Println("Your version:", g.Date.Format(time.RFC1123))
+			fmt.Println("Your version:", a.Date.Format(time.RFC1123))
-	fmt.Println("Their version:", remoteMetadata.Date.Format(time.RFC1123))
+			fmt.Println("Their version:", b.Date.Format(time.RFC1123))
 			fmt.Println()
 
 			res := prompt.Conflict()
 
 			switch res {
-	case prompt.My:
-		{
-			if err := p.push(m, cli); err != nil {
-				return fmt.Errorf("failed to push: %w", err)
-			}
-		}
-
 			case prompt.Their:
-		{
+				return sync.Their
-			if err := p.pull(g, cli); err != nil {
+			case prompt.My:
-				return fmt.Errorf("failed to push: %w", err)
+				return sync.Mine
-			}
-			g.Version = remoteMetadata.Version
-			g.Date = remoteMetadata.Date
-
-			if err := p.Service.UpdateMetadata(g.ID, g); err != nil {
-				return fmt.Errorf("failed to push: %w", err)
-			}
-		}
-	}
-	return nil
-}
-
-func (p *SyncCmd) push(m repository.Metadata, cli *client.Client) error {
-	return p.Service.PushArchive(m.ID, "", cli)
-}
-
-func (p *SyncCmd) pushBackup(m repository.Metadata, cli *client.Client) error {
-	bs, err := p.Service.AllBackups(m.ID)
-	if err != nil {
-		return err
 			}
 
-	for _, b := range bs {
+			return sync.None
-		binfo, err := cli.ArchiveInfo(m.ID, b.UUID)
+		})
-		if err != nil {
+
-			if !errors.Is(err, client.ErrNotFound) {
+		syncer.Sync()
-				return fmt.Errorf("failed to get remote information about the backup file: %w", err)
-			}
 	}
 
-		if binfo.MD5 != b.MD5 {
+	fmt.Println("done.")
-			if err := cli.PushBackup(b, m); err != nil {
+	return subcommands.ExitSuccess
-				return fmt.Errorf("failed to push backup: %w", err)
-			}
-		}
-
-	}
-	return nil
-}
-
-func (p *SyncCmd) pullBackup(m repository.Metadata, cli *client.Client) error {
-	bs, err := cli.ListArchives(m.ID)
-	if err != nil {
-		return err
-	}
-
-	for _, uuid := range bs {
-		rinfo, err := cli.ArchiveInfo(m.ID, uuid)
-		if err != nil {
-			return err
-		}
-
-		linfo, err := p.Service.Backup(m.ID, uuid)
-		if err != nil {
-			return err
-		}
-
-		if linfo.MD5 != rinfo.MD5 {
-			if err := p.Service.PullBackup(m.ID, uuid, cli); err != nil {
-				return err
-			}
-		}
-	}
-	return nil
-}
-
-func (p *SyncCmd) pull(g repository.Metadata, cli *client.Client) error {
-	if err := p.Service.PullArchive(g.ID, "", cli); err != nil {
-		return err
-	}
-	return p.Service.ApplyCurrent(g.ID)
 }
 
 func connect(remoteCred map[string]map[string]string, r remote.Remote) (*client.Client, error) {

cmd/cli/tools/prompt/credentials/credentials.go

@@ -35,6 +35,17 @@ func init() {
 	datastorePath = filepath.Join(roaming, "cloudsave")
 }
 
+func Get(server string) (string, string, error) {
+	var err error
+	store, err := load()
+	if err == nil {
+		if c, ok := store[server]; ok {
+			return c.Username, c.Password, nil
+		}
+	}
+	return "","",fmt.Errorf("not found")
+}
+
 func Read(server string) (string, string, error) {
 	var err error
 	store, err := load()
@@ -89,7 +100,7 @@ func save(store map[string]credential) error {
 		Store: store,
 	}
 
-	f, err := os.OpenFile(filepath.Join(datastorePath, "credential.json"), os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0740)
+	f, err := os.OpenFile(filepath.Clean(filepath.Join(datastorePath, "credential.json")), os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0740)
 	if err != nil {
 		return fmt.Errorf("failed to open datastore: %w", err)
 	}
@@ -104,7 +115,7 @@ func save(store map[string]credential) error {
 }
 
 func load() (map[string]credential, error) {
-	f, err := os.OpenFile(filepath.Join(datastorePath, "credential.json"), os.O_RDONLY, 0)
+	f, err := os.OpenFile(filepath.Clean(filepath.Join(datastorePath, "credential.json")), os.O_RDONLY, 0)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return make(map[string]credential), nil

cmd/server/api/api.go

@@ -76,6 +76,7 @@ func NewServer(documentRoot string, srv *data.Service, creds map[string]string,
 	s.Server = &http.Server{
 		Addr:              fmt.Sprintf(":%d", port),
 		Handler:           router,
+		ReadHeaderTimeout: 2 * time.Second,
 	}
 	return s
 }

cmd/server/runner.go

@@ -66,7 +66,9 @@ func run(updateChan <-chan struct{}) {
 		for {
 			<-updateChan
 			if r, ok := repo.(*repository.EagerRepository); ok {
-				r.Reload()
+				if err := r.Reload(); err != nil {
+					fatal("failed to reload data: "+err.Error(), 1)
+				}
 			}
 			h, err := htpasswd.Open(filepath.Join(documentRoot, ".htpasswd"))
 			if err != nil {

cmd/server/security/htpasswd/htpasswd.go

@@ -2,6 +2,7 @@ package htpasswd
 
 import (
 	"os"
+	"path/filepath"
 	"strings"
 )
 
@@ -12,7 +13,7 @@ type (
 )
 
 func Open(path string) (File, error) {
-	c, err := os.ReadFile(path)
+	c, err := os.ReadFile(filepath.Clean(path))
 	if err != nil {
 		return File{}, err
 	}

cmd/web/server/config/config.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"os"
+	"path/filepath"
 )
 
 type (
@@ -22,7 +23,7 @@ type (
 )
 
 func Load(path string) (Configuration, error) {
-	f, err := os.OpenFile(path, os.O_RDONLY, 0)
+	f, err := os.OpenFile(filepath.Clean(path), os.O_RDONLY, 0)
 	if err != nil {
 		return Configuration{}, fmt.Errorf("failed to open configuration file: %w", err)
 	}

cmd/web/server/server.go

@@ -13,6 +13,7 @@ import (
 	"runtime"
 	"slices"
 	"sync"
+	"time"
 
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
@@ -74,13 +75,19 @@ var (
 // NewServer start the http server
 func NewServer(c config.Configuration) *HTTPServer {
 	dashboardTemplate := template.New("dashboard")
-	dashboardTemplate.Parse(DashboardHTMLPage)
+	if _, err := dashboardTemplate.Parse(DashboardHTMLPage); err != nil {
+		panic("failed to load template 'dashboard': " + err.Error())
+	}
 
 	detailledTemplate := template.New("detailled")
-	detailledTemplate.Parse(DetailledHTMLPage)
+	if _, err := detailledTemplate.Parse(DetailledHTMLPage); err != nil {
+		panic("failed to load template 'detailled': " + err.Error())
+	}
 
 	systemTemplate := template.New("system")
-	systemTemplate.Parse(SystemHTMLPage)
+	if _, err := systemTemplate.Parse(SystemHTMLPage); err != nil {
+		panic("failed to load template 'system': " + err.Error())
+	}
 
 	s := &HTTPServer{
 		Config: c,
@@ -101,6 +108,7 @@ func NewServer(c config.Configuration) *HTTPServer {
 	s.Server = &http.Server{
 		Addr:              fmt.Sprintf(":%d", c.Server.Port),
 		Handler:           router,
+		ReadHeaderTimeout: 2 * time.Second,
 	}
 	return s
 }

go.mod

@@ -3,6 +3,7 @@ module cloudsave
 go 1.24
 
 require (
+	fyne.io/fyne/v2 v2.6.3
 	github.com/getlantern/systray v1.2.2
 	github.com/go-chi/chi/v5 v5.2.1
 	github.com/google/subcommands v1.2.0
@@ -13,15 +14,46 @@ require (
 )
 
 require (
+	fyne.io/systray v1.11.0 // indirect
+	github.com/BurntSushi/toml v1.4.0 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/fredbi/uri v1.1.0 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fyne-io/gl-js v0.2.0 // indirect
+	github.com/fyne-io/glfw-js v0.3.0 // indirect
+	github.com/fyne-io/image v0.1.1 // indirect
+	github.com/fyne-io/oksvg v0.1.0 // indirect
 	github.com/getlantern/context v0.0.0-20190109183933-c447772a6520 // indirect
 	github.com/getlantern/errors v0.0.0-20190325191628-abdb3e3e36f7 // indirect
 	github.com/getlantern/golog v0.0.0-20190830074920-4ef2e798c2d7 // indirect
 	github.com/getlantern/hex v0.0.0-20190417191902-c6586a6fe0b7 // indirect
 	github.com/getlantern/hidden v0.0.0-20190325191715-f02dbb02be55 // indirect
 	github.com/getlantern/ops v0.0.0-20190325191751-d70cb0d6f85f // indirect
+	github.com/go-gl/gl v0.0.0-20231021071112-07e5d0ea2e71 // indirect
+	github.com/go-gl/glfw/v3.3/glfw v0.0.0-20240506104042-037f3cc74f2a // indirect
 	github.com/go-stack/stack v1.8.0 // indirect
+	github.com/go-text/render v0.2.0 // indirect
+	github.com/go-text/typesetting v0.2.1 // indirect
+	github.com/godbus/dbus/v5 v5.1.0 // indirect
+	github.com/hack-pad/go-indexeddb v0.3.2 // indirect
+	github.com/hack-pad/safejs v0.1.0 // indirect
+	github.com/jeandeaual/go-locale v0.0.0-20250612000132-0ef82f21eade // indirect
+	github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25 // indirect
+	github.com/kr/text v0.2.0 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
+	github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 // indirect
+	github.com/nicksnyder/go-i18n/v2 v2.5.1 // indirect
 	github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/rymdport/portal v0.4.1 // indirect
+	github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c // indirect
+	github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef // indirect
+	github.com/stretchr/testify v1.10.0 // indirect
+	github.com/yuin/goldmark v1.7.8 // indirect
+	golang.org/x/image v0.24.0 // indirect
+	golang.org/x/net v0.35.0 // indirect
 	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/text v0.25.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -1,8 +1,29 @@
+fyne.io/fyne/v2 v2.6.3 h1:cvtM2KHeRuH+WhtHiA63z5wJVBkQ9+Ay0UMl9PxFHyA=
+fyne.io/fyne/v2 v2.6.3/go.mod h1:NGSurpRElVoI1G3h+ab2df3O5KLGh1CGbsMMcX0bPIs=
+fyne.io/systray v1.11.0 h1:D9HISlxSkx+jHSniMBR6fCFOUjk1x/OOOJLa9lJYAKg=
+fyne.io/systray v1.11.0/go.mod h1:RVwqP9nYMo7h5zViCBHri2FgjXF7H2cub7MAq4NSoLs=
+github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
+github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/chengxilo/virtualterm v1.0.4 h1:Z6IpERbRVlfB8WkOmtbHiDbBANU7cimRIof7mk9/PwM=
 github.com/chengxilo/virtualterm v1.0.4/go.mod h1:DyxxBZz/x1iqJjFxTFcr6/x+jSpqN0iwWCOK1q10rlY=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/felixge/fgprof v0.9.3 h1:VvyZxILNuCiUCSXtPtYmmtGvb65nqXh2QFWc0Wpf2/g=
+github.com/felixge/fgprof v0.9.3/go.mod h1:RdbpDgzqYVh/T9fPELJyV7EYJuHB55UTEULNun8eiPw=
+github.com/fredbi/uri v1.1.0 h1:OqLpTXtyRg9ABReqvDGdJPqZUxs8cyBDOMXBbskCaB8=
+github.com/fredbi/uri v1.1.0/go.mod h1:aYTUoAXBOq7BLfVJ8GnKmfcuURosB1xyHDIfWeC/iW4=
+github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
+github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
+github.com/fyne-io/gl-js v0.2.0 h1:+EXMLVEa18EfkXBVKhifYB6OGs3HwKO3lUElA0LlAjs=
+github.com/fyne-io/gl-js v0.2.0/go.mod h1:ZcepK8vmOYLu96JoxbCKJy2ybr+g1pTnaBDdl7c3ajI=
+github.com/fyne-io/glfw-js v0.3.0 h1:d8k2+Y7l+zy2pc7wlGRyPfTgZoqDf3AI4G+2zOWhWUk=
+github.com/fyne-io/glfw-js v0.3.0/go.mod h1:Ri6te7rdZtBgBpxLW19uBpp3Dl6K9K/bRaYdJ22G8Jk=
+github.com/fyne-io/image v0.1.1 h1:WH0z4H7qfvNUw5l4p3bC1q70sa5+YWVt6HCj7y4VNyA=
+github.com/fyne-io/image v0.1.1/go.mod h1:xrfYBh6yspc+KjkgdZU/ifUC9sPA5Iv7WYUBzQKK7JM=
+github.com/fyne-io/oksvg v0.1.0 h1:7EUKk3HV3Y2E+qypp3nWqMXD7mum0hCw2KEGhI1fnBw=
+github.com/fyne-io/oksvg v0.1.0/go.mod h1:dJ9oEkPiWhnTFNCmRgEze+YNprJF7YRbpjgpWS4kzoI=
 github.com/getlantern/context v0.0.0-20190109183933-c447772a6520 h1:NRUJuo3v3WGC/g5YiyF790gut6oQr5f3FBI88Wv0dx4=
 github.com/getlantern/context v0.0.0-20190109183933-c447772a6520/go.mod h1:L+mq6/vvYHKjCX2oez0CgEAJmbq1fbb/oNJIWQkBybY=
 github.com/getlantern/errors v0.0.0-20190325191628-abdb3e3e36f7 h1:6uJ+sZ/e03gkbqZ0kUG6mfKoqDb4XMAzMIwlajq19So=
@@ -19,39 +40,88 @@ github.com/getlantern/systray v1.2.2 h1:dCEHtfmvkJG7HZ8lS/sLklTH4RKUcIsKrAD9sTho
 github.com/getlantern/systray v1.2.2/go.mod h1:pXFOI1wwqwYXEhLPm9ZGjS2u/vVELeIgNMY5HvhHhcE=
 github.com/go-chi/chi/v5 v5.2.1 h1:KOIHODQj58PmL80G2Eak4WdvUzjSJSm0vG72crDCqb8=
 github.com/go-chi/chi/v5 v5.2.1/go.mod h1:L2yAIGWB3H+phAw1NxKwWM+7eUH/lU8pOMm5hHcoops=
+github.com/go-gl/gl v0.0.0-20231021071112-07e5d0ea2e71 h1:5BVwOaUSBTlVZowGO6VZGw2H/zl9nrd3eCZfYV+NfQA=
+github.com/go-gl/gl v0.0.0-20231021071112-07e5d0ea2e71/go.mod h1:9YTyiznxEY1fVinfM7RvRcjRHbw2xLBJ3AAGIT0I4Nw=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20240506104042-037f3cc74f2a h1:vxnBhFDDT+xzxf1jTJKMKZw3H0swfWk9RpWbBbDK5+0=
+github.com/go-gl/glfw/v3.3/glfw v0.0.0-20240506104042-037f3cc74f2a/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-text/render v0.2.0 h1:LBYoTmp5jYiJ4NPqDc2pz17MLmA3wHw1dZSVGcOdeAc=
+github.com/go-text/render v0.2.0/go.mod h1:CkiqfukRGKJA5vZZISkjSYrcdtgKQWRa2HIzvwNN5SU=
+github.com/go-text/typesetting v0.2.1 h1:x0jMOGyO3d1qFAPI0j4GSsh7M0Q3Ypjzr4+CEVg82V8=
+github.com/go-text/typesetting v0.2.1/go.mod h1:mTOxEwasOFpAMBjEQDhdWRckoLLeI/+qrQeBCTGEt6M=
+github.com/go-text/typesetting-utils v0.0.0-20241103174707-87a29e9e6066 h1:qCuYC+94v2xrb1PoS4NIDe7DGYtLnU2wWiQe9a1B1c0=
+github.com/go-text/typesetting-utils v0.0.0-20241103174707-87a29e9e6066/go.mod h1:DDxDdQEnB70R8owOx3LVpEFvpMK9eeH1o2r0yZhFI9o=
+github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
+github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/google/pprof v0.0.0-20211214055906-6f57359322fd h1:1FjCyPC+syAzJ5/2S8fqdZK1R22vvA0J7JZKcuOIQ7Y=
+github.com/google/pprof v0.0.0-20211214055906-6f57359322fd/go.mod h1:KgnwoLYCZ8IQu3XUZ8Nc/bM9CCZFOyjUNOSygVozoDg=
 github.com/google/subcommands v1.2.0 h1:vWQspBTo2nEqTUFita5/KeEWlUL8kQObDFbub/EN9oE=
 github.com/google/subcommands v1.2.0/go.mod h1:ZjhPrFU+Olkh9WazFPsl27BQ4UPiG37m3yTrtFlrHVk=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hack-pad/go-indexeddb v0.3.2 h1:DTqeJJYc1usa45Q5r52t01KhvlSN02+Oq+tQbSBI91A=
+github.com/hack-pad/go-indexeddb v0.3.2/go.mod h1:QvfTevpDVlkfomY498LhstjwbPW6QC4VC/lxYb0Kom0=
+github.com/hack-pad/safejs v0.1.0 h1:qPS6vjreAqh2amUqj4WNG1zIw7qlRQJ9K10eDKMCnE8=
+github.com/hack-pad/safejs v0.1.0/go.mod h1:HdS+bKF1NrE72VoXZeWzxFOVQVUSqZJAG0xNCnb+Tio=
+github.com/jeandeaual/go-locale v0.0.0-20250612000132-0ef82f21eade h1:FmusiCI1wHw+XQbvL9M+1r/C3SPqKrmBaIOYwVfQoDE=
+github.com/jeandeaual/go-locale v0.0.0-20250612000132-0ef82f21eade/go.mod h1:ZDXo8KHryOWSIqnsb/CiDq7hQUYryCgdVnxbj8tDG7o=
+github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25 h1:YLvr1eE6cdCqjOe972w/cYF+FjW34v27+9Vo5106B4M=
+github.com/jsummers/gobmp v0.0.0-20230614200233-a9de23ed2e25/go.mod h1:kLgvv7o6UM+0QSf0QjAse3wReFDsb9qbZJdfexWlrQw=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/lxn/walk v0.0.0-20210112085537-c389da54e794/go.mod h1:E23UucZGqpuUANJooIbHWCufXvOcT6E7Stq81gU+CSQ=
 github.com/lxn/win v0.0.0-20210218163916-a377121e959e/go.mod h1:KxxjdtRkfNoYDCUP5ryK7XJJNTnpC8atvtmTheChOtk=
 github.com/mattn/go-runewidth v0.0.16 h1:E5ScNMtiwvlvB5paMFdw9p4kSQzbXFikJ5SQO6TULQc=
 github.com/mattn/go-runewidth v0.0.16/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db h1:62I3jR2EmQ4l5rM/4FEfDWcRD+abF5XlKShorW5LRoQ=
 github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db/go.mod h1:l0dey0ia/Uv7NcFFVbCLtqEBQbrT4OCwCSKTEv6enCw=
+github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646 h1:zYyBkD/k9seD2A7fsi6Oo2LfFZAehjjQMERAvZLEDnQ=
+github.com/nfnt/resize v0.0.0-20180221191011-83c6a9932646/go.mod h1:jpp1/29i3P1S/RLdc7JQKbRpFeM1dOBd8T9ki5s+AY8=
+github.com/nicksnyder/go-i18n/v2 v2.5.1 h1:IxtPxYsR9Gp60cGXjfuR/llTqV8aYMsC472zD0D1vHk=
+github.com/nicksnyder/go-i18n/v2 v2.5.1/go.mod h1:DrhgsSDZxoAfvVrBVLXoxZn/pN5TXqaDbq7ju94viiQ=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c h1:rp5dCmg/yLR3mgFuSOe4oEnDDmGLROTvMragMUXpTQw=
 github.com/oxtoacart/bpool v0.0.0-20190530202638-03653db5a59c/go.mod h1:X07ZCGwUbLaax7L0S3Tw4hpejzu63ZrrQiUe6W0hcy0=
+github.com/pkg/profile v1.7.0 h1:hnbDkaNWPCLMO9wGLdBFTIZvzDrDfBM2072E1S9gJkA=
+github.com/pkg/profile v1.7.0/go.mod h1:8Uer0jas47ZQMJ7VD+OHknK4YDY07LPUC6dEvqDjvNo=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
 github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/rymdport/portal v0.4.1 h1:2dnZhjf5uEaeDjeF/yBIeeRo6pNI2QAKm7kq1w/kbnA=
+github.com/rymdport/portal v0.4.1/go.mod h1:kFF4jslnJ8pD5uCi17brj/ODlfIidOxlgUDTO5ncnC4=
 github.com/schollz/progressbar/v3 v3.18.0 h1:uXdoHABRFmNIjUfte/Ex7WtuyVslrw2wVPQmCN62HpA=
 github.com/schollz/progressbar/v3 v3.18.0/go.mod h1:IsO3lpbaGuzh8zIMzgY3+J8l4C8GjO0Y9S69eFvNsec=
 github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966/go.mod h1:sUM3LWHvSMaG192sy56D9F7CNvL7jUJVXoqM1QKLnog=
+github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c h1:km8GpoQut05eY3GiYWEedbTT0qnSxrCjsVbb7yKY1KE=
+github.com/srwiley/oksvg v0.0.0-20221011165216-be6e8873101c/go.mod h1:cNQ3dwVJtS5Hmnjxy6AgTPd0Inb3pW05ftPSX7NZO7Q=
+github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef h1:Ch6Q+AZUxDBCVqdkI8FSpFyZDtCVBc2VmejdNrm5rRQ=
+github.com/srwiley/rasterx v0.0.0-20220730225603-2ab79fcdd4ef/go.mod h1:nXTWP6+gD5+LUJ8krVhhoeHjvHTutPxMYl5SvkcnJNE=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/yuin/goldmark v1.7.8 h1:iERMLn0/QJeHFhxSt3p6PeN9mGnvIKSpG9YYorDMnic=
+github.com/yuin/goldmark v1.7.8/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
 golang.org/x/crypto v0.38.0 h1:jt+WWG8IZlBnVbomuhg2Mdq0+BBQaHbtqHEFEigjUV8=
 golang.org/x/crypto v0.38.0/go.mod h1:MvrbAqul58NNYPKnOra203SB9vpuZW0e+RRZV+Ggqjw=
+golang.org/x/image v0.24.0 h1:AN7zRgVsbvmTfNyqIbbOraYL8mSwcKncEj8ofjgzcMQ=
+golang.org/x/image v0.24.0/go.mod h1:4b/ITuLfqYq1hqZcjofwctIhi7sZh2WaCjvsBNjjya8=
+golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
+golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
 golang.org/x/sys v0.0.0-20201018230417-eeed37f84f13/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
 golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
 golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
+golang.org/x/text v0.25.0 h1:qVyWApTSYLk/drJRO5mDlNYskwQznZmkpV2c8q9zls4=
+golang.org/x/text v0.25.0/go.mod h1:WEdwpYrmk1qmdHvhkSTNPm3app7v4rsT8F2UD6+VHIA=
 gopkg.in/Knetic/govaluate.v3 v3.0.0/go.mod h1:csKLBORsPbafmSCGTEh3U7Ozmsuq8ZSIlKk1bcqph0E=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

jenkinsfile

@@ -6,7 +6,10 @@ pipeline {
             steps {
                 sh '''
                 go install github.com/securego/gosec/v2/cmd/gosec@v2.22.8
-                /var/lib/jenkins/go/bin/gosec ./...
+                go install honnef.co/go/tools/cmd/staticcheck@v0.6.1
+
+                /var/lib/jenkins/go/bin/staticcheck ./...
+                /var/lib/jenkins/go/bin/gosec -exclude="G401,G501,G103" ./...
                 '''
             }
         }

pkg/constants/constants.go

@@ -1,5 +1,5 @@
 package constants
 
-const Version = "0.0.4d"
+const Version = "0.0.5"
 
 const ApiVersion = 1

pkg/data/data.go

@@ -400,7 +400,7 @@ func (l Service) apply(src, dst string) error {
 		return fmt.Errorf("failed to remove old save: %w", err)
 	}
 
-	f, err := os.OpenFile(src, os.O_RDONLY, 0)
+	f, err := os.OpenFile(filepath.Clean(src), os.O_RDONLY, 0)
 	if err != nil {
 		return fmt.Errorf("failed to open archive: %w", err)
 	}

pkg/remote/client/client.go

@@ -9,10 +9,12 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"log/slog"
 	"mime/multipart"
 	"net/http"
 	"net/url"
 	"os"
+	"path/filepath"
 	"strconv"
 	"time"
 
@@ -220,12 +222,12 @@ func (c *Client) Pull(gameID, archivePath string) error {
 
 	req.SetBasicAuth(c.username, c.password)
 
-	f, err := os.OpenFile(archivePath+".part", os.O_CREATE|os.O_WRONLY, 0740)
+	f, err := os.OpenFile(filepath.Clean(archivePath+".part"), os.O_CREATE|os.O_WRONLY, 0740)
 	if err != nil {
 		return fmt.Errorf("failed to open file: %w", err)
 	}
 	defer func() {
-		if err := os.Rename(archivePath+".part", archivePath); err != nil {
+		if err := os.Rename(filepath.Clean(archivePath+".part"), archivePath); err != nil {
 			panic(err)
 		}
 	}()
@@ -275,20 +277,24 @@ func (c *Client) PullBackup(gameID, uuid, archivePath string) error {
 
 	req.SetBasicAuth(c.username, c.password)
 
-	f, err := os.OpenFile(archivePath+".part", os.O_CREATE|os.O_WRONLY, 0740)
+	f, err := os.OpenFile(filepath.Clean(archivePath+".part"), os.O_CREATE|os.O_WRONLY, 0740)
 	if err != nil {
 		return fmt.Errorf("failed to open file: %w", err)
 	}
 
 	res, err := cli.Do(req)
 	if err != nil {
-		f.Close()
+		if err := f.Close(); err != nil {
+			slog.Error("failed to close file", "err", err)
+		}
 		return fmt.Errorf("cannot connect to remote: %w", err)
 	}
 	defer res.Body.Close()
 
 	if res.StatusCode != http.StatusOK {
-		f.Close()
+		if err := f.Close(); err != nil {
+			slog.Error("failed to close file", "err", err)
+		}
 		return fmt.Errorf("cannot connect to remote: server return code: %s", res.Status)
 	}
 
@@ -299,10 +305,14 @@ func (c *Client) PullBackup(gameID, uuid, archivePath string) error {
 	defer bar.Close()
 
 	if _, err := io.Copy(io.MultiWriter(f, bar), res.Body); err != nil {
-		f.Close()
+		if err := f.Close(); err != nil {
+			slog.Error("failed to close file", "err", err)
+		}
 		return fmt.Errorf("an error occured while copying the file from the remote: %w", err)
 	}
-	f.Close()
+	if err := f.Close(); err != nil {
+		slog.Error("failed to close file", "err", err)
+	}
 
 	if err := os.Rename(archivePath+".part", archivePath); err != nil {
 		return fmt.Errorf("failed to move temporary data: %w", err)
@@ -374,6 +384,10 @@ func (c *Client) All() ([]repository.Metadata, error) {
 	return nil, errors.New("invalid payload sent by the server")
 }
 
+func (c *Client) BaseURL() string {
+	return c.baseURL
+}
+
 func (c *Client) get(url string) (obj.HTTPObject, error) {
 	cli := http.Client{}
 
@@ -413,7 +427,7 @@ func (c *Client) get(url string) (obj.HTTPObject, error) {
 }
 
 func (c *Client) push(u, archivePath string, m repository.Metadata) error {
-	f, err := os.OpenFile(archivePath, os.O_RDONLY, 0)
+	f, err := os.OpenFile(filepath.Clean(archivePath), os.O_RDONLY, 0)
 	if err != nil {
 		return fmt.Errorf("failed to open file: %w", err)
 	}
@@ -431,9 +445,15 @@ func (c *Client) push(u, archivePath string, m repository.Metadata) error {
 		return fmt.Errorf("failed to copy data: %w", err)
 	}
 
-	writer.WriteField("name", m.Name)
+	if err := writer.WriteField("name", m.Name); err != nil {
-	writer.WriteField("version", strconv.Itoa(m.Version))
+		return err
-	writer.WriteField("date", m.Date.Format(time.RFC3339))
+	}
+	if err := writer.WriteField("version", strconv.Itoa(m.Version)); err != nil {
+		return err
+	}
+	if err := writer.WriteField("date", m.Date.Format(time.RFC3339)); err != nil {
+		return err
+	}
 
 	if err := writer.Close(); err != nil {
 		return err

pkg/remote/remote.go

@@ -39,7 +39,7 @@ func init() {
 }
 
 func One(gameID string) (Remote, error) {
-	content, err := os.ReadFile(filepath.Join(datastorepath, gameID, "remote.json"))
+	content, err := os.ReadFile(filepath.Clean(filepath.Join(datastorepath, gameID, "remote.json")))
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return Remote{}, ErrNoRemote
@@ -57,12 +57,34 @@ func One(gameID string) (Remote, error) {
 	return r, nil
 }
 
+func All() ([]Remote, error) {
+	d, err := os.ReadDir(filepath.Clean(datastorepath))
+	if err != nil {
+		return nil, fmt.Errorf("failed to load datastore: %w", err)
+	}
+
+	var res []Remote
+	for _, g := range d {
+		r, err := One(g.Name())
+		if err != nil {
+			if errors.Is(err, ErrNoRemote) {
+				continue
+			}
+			return nil, fmt.Errorf("failed to load remote: %w", err)
+		}
+
+		res = append(res, r)
+	}
+
+	return res, nil
+}
+
 func Set(gameID, url string) error {
 	r := Remote{
 		URL: url,
 	}
 
-	f, err := os.OpenFile(filepath.Join(datastorepath, gameID, "remote.json"), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0740)
+	f, err := os.OpenFile(filepath.Join(filepath.Join(datastorepath, gameID, "remote.json")), os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0740)
 	if err != nil {
 		return err
 	}

pkg/repository/repository.go

@@ -117,7 +117,7 @@ func (bi BackupIdentifier) Key() string {
 func NewLazyRepository(dataRootPath string) (*LazyRepository, error) {
 	if m, err := os.Stat(dataRootPath); err != nil {
 		if errors.Is(err, os.ErrNotExist) {
-			if err := os.MkdirAll(dataRootPath, 0740); err != nil {
+			if err := os.MkdirAll(dataRootPath, 0750); err != nil {
 				return nil, fmt.Errorf("failed to make the directory: %w", err)
 			}
 		} else {
@@ -137,8 +137,8 @@ func NewLazyRepository(dataRootPath string) (*LazyRepository, error) {
 func (l *LazyRepository) Mkdir(id Identifier) error {
 	path := l.DataPath(id)
 	if _, err := os.Stat(path); errors.Is(err, os.ErrNotExist) {
-		slog.Debug("making directory", "path", path, "id", id, "perm", "0740")
+		slog.Debug("making directory", "path", path, "id", id, "perm", "0750")
-		return os.MkdirAll(path, 0740)
+		return os.MkdirAll(path, 0750)
 	}
 	return nil
 }
@@ -182,7 +182,7 @@ func (l *LazyRepository) WriteBlob(ID Identifier) (io.Writer, error) {
 	path := l.DataPath(ID)
 
 	slog.Debug("loading write buffer...", "id", ID)
-	dst, err := os.OpenFile(filepath.Join(path, "data.tar.gz"), os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0740)
+	dst, err := os.OpenFile(filepath.Clean(filepath.Join(path, "data.tar.gz")), os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0740)
 	if err != nil {
 		return nil, fmt.Errorf("failed to open destination file: %w", err)
 	}
@@ -195,7 +195,7 @@ func (l *LazyRepository) WriteMetadata(id GameIdentifier, m Metadata) error {
 	path := l.DataPath(id)
 
 	slog.Debug("writing metadata", "id", id, "metadata", m)
-	dst, err := os.OpenFile(filepath.Join(path, "metadata.json"), os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0740)
+	dst, err := os.OpenFile(filepath.Clean(filepath.Join(path, "metadata.json")), os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0740)
 	if err != nil {
 		return fmt.Errorf("failed to open destination file: %w", err)
 	}
@@ -213,7 +213,7 @@ func (l *LazyRepository) Metadata(id GameIdentifier) (Metadata, error) {
 	path := l.DataPath(id)
 
 	slog.Debug("loading metadata", "id", id)
-	src, err := os.OpenFile(filepath.Join(path, "metadata.json"), os.O_RDONLY, 0)
+	src, err := os.OpenFile(filepath.Clean(filepath.Join(path, "metadata.json")), os.O_RDONLY, 0)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return Metadata{}, ErrNotFound
@@ -272,7 +272,7 @@ func (l *LazyRepository) Backup(id BackupIdentifier) (Backup, error) {
 func (l *LazyRepository) LastScan(id GameIdentifier) (time.Time, error) {
 	path := l.DataPath(id)
 
-	data, err := os.ReadFile(filepath.Join(path, ".last_run"))
+	data, err := os.ReadFile(filepath.Clean(filepath.Join(path, ".last_run")))
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return time.Time{}, nil
@@ -292,7 +292,7 @@ func (l *LazyRepository) ResetLastScan(id GameIdentifier) error {
 	path := l.DataPath(id)
 
 	slog.Debug("resetting last scan datetime for", "id", id)
-	f, err := os.OpenFile(filepath.Join(path, ".last_run"), os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0740)
+	f, err := os.OpenFile(filepath.Clean(filepath.Join(path, ".last_run")), os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0740)
 	if err != nil {
 		return fmt.Errorf("failed to open file: %w", err)
 	}
@@ -311,7 +311,7 @@ func (l *LazyRepository) ReadBlob(id Identifier) (io.ReadSeekCloser, error) {
 	path := l.DataPath(id)
 
 	slog.Debug("loading read buffer...", "id", id)
-	dst, err := os.OpenFile(filepath.Join(path, "data.tar.gz"), os.O_RDONLY, 0)
+	dst, err := os.OpenFile(filepath.Clean(filepath.Join(path, "data.tar.gz")), os.O_RDONLY, 0)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return nil, fmt.Errorf("failed to open blob: %w", ErrNotFound)
@@ -325,7 +325,7 @@ func (l *LazyRepository) ReadBlob(id Identifier) (io.ReadSeekCloser, error) {
 func (l *LazyRepository) SetRemote(id GameIdentifier, url string) error {
 	path := l.DataPath(id)
 
-	src, err := os.OpenFile(filepath.Join(path, "remote.json"), os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0740)
+	src, err := os.OpenFile(filepath.Clean(filepath.Join(path, "remote.json")), os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0740)
 	if err != nil {
 		return fmt.Errorf("failed to open remote description: %w", err)
 	}
@@ -345,7 +345,7 @@ func (l *LazyRepository) SetRemote(id GameIdentifier, url string) error {
 func (l *LazyRepository) Remote(id GameIdentifier) (*Remote, error) {
 	path := l.DataPath(id)
 
-	src, err := os.OpenFile(filepath.Join(path, "remote.json"), os.O_RDONLY, 0)
+	src, err := os.OpenFile(filepath.Clean(filepath.Join(path, "remote.json")), os.O_RDONLY, 0)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return nil, nil

pkg/sync/sync.go

@@ -0,0 +1,237 @@
+package sync
+
+import (
+	"cloudsave/pkg/data"
+	"cloudsave/pkg/remote"
+	"cloudsave/pkg/remote/client"
+	"cloudsave/pkg/repository"
+	"errors"
+	"fmt"
+)
+
+type (
+	ConflictResolution int
+	State              int
+	decision           int
+
+	Syncer struct {
+		cli     *client.Client
+		service *data.Service
+
+		stateCallback    func(s State, g repository.Metadata)
+		errorCallback    func(err error, g repository.Metadata)
+		conflictCallback func(a, b repository.Metadata) ConflictResolution
+	}
+)
+
+const (
+	Their ConflictResolution = iota
+	Mine
+	None
+)
+
+const (
+	ignore decision = iota
+	push
+	pull
+)
+
+const (
+	FetchingMetdata State = iota
+	Pushing
+	Pulling
+	Pushed
+	Pulled
+	UpToDate
+	Done
+)
+
+var (
+	ErrFetching  error = errors.New("failed to fetch the metadata")
+	ErrPushing   error = errors.New("failed to push data")
+	ErrPulling   error = errors.New("failed to pull data")
+	ErrDatastore error = errors.New("failed to get data from local datastore")
+)
+
+func NewSyncer(cli *client.Client, service *data.Service) *Syncer {
+	return &Syncer{
+		cli:     cli,
+		service: service,
+	}
+}
+
+func (s *Syncer) SetStateCallback(fn func(s State, g repository.Metadata)) {
+	s.stateCallback = fn
+}
+
+func (s *Syncer) SetErrorCallback(fn func(err error, g repository.Metadata)) {
+	s.errorCallback = fn
+}
+
+func (s *Syncer) SetConflictCallback(fn func(a, b repository.Metadata) ConflictResolution) {
+	s.conflictCallback = fn
+}
+
+func (s *Syncer) Sync() {
+	games, err := s.service.AllGames()
+	if err != nil {
+		s.errorCallback(fmt.Errorf("failed to get all games: %w", err), repository.Metadata{})
+		return
+	}
+
+	for _, g := range games {
+		r, err := remote.One(g.ID)
+		if err != nil {
+			continue
+		}
+		if r.URL != s.cli.BaseURL() {
+			continue
+		}
+		if err := s.sync(g); err != nil {
+			s.errorCallback(err, g)
+		}
+	}
+	s.stateCallback(Done, repository.Metadata{})
+}
+
+func (s *Syncer) sync(g repository.Metadata) error {
+	s.stateCallback(FetchingMetdata, g)
+
+	remoteMetadata, err := s.cli.Metadata(g.ID)
+	if err != nil {
+		if errors.Is(err, client.ErrNotFound) {
+			s.stateCallback(Pushing, g)
+			if err := s.push(g); err != nil {
+				return fmt.Errorf("%w: %s", ErrPushing, err)
+			}
+			s.stateCallback(Pushed, g)
+			return nil
+		}
+		return fmt.Errorf("%w: %s", ErrFetching, err)
+	}
+
+	if g.MD5 == remoteMetadata.MD5 {
+		s.stateCallback(UpToDate, g)
+		return nil
+	}
+
+	d := ignore
+
+	if g.Version > remoteMetadata.Version {
+		d = push
+	}
+
+	if g.Version < remoteMetadata.Version {
+		d = pull
+	}
+
+	if g.Version == remoteMetadata.Version {
+		r := s.conflictCallback(g, remoteMetadata)
+		switch r {
+		case Mine:
+			{
+				d = push
+			}
+		case Their:
+			{
+				d = pull
+			}
+		}
+		return nil
+	}
+
+	switch d {
+	case push:
+		{
+			s.stateCallback(Pushing, g)
+			if err := s.push(g); err != nil {
+				return fmt.Errorf("%w: %s", ErrPushing, err)
+			}
+			s.stateCallback(Pushed, g)
+			return nil
+		}
+	case pull:
+		{
+			s.stateCallback(Pulling, g)
+			if err := s.pull(g, remoteMetadata); err != nil {
+				return fmt.Errorf("%w: %s", ErrPulling, err)
+			}
+			s.stateCallback(Pulled, g)
+			return nil
+		}
+	}
+
+	return nil
+}
+
+func (s *Syncer) push(g repository.Metadata) error {
+	if err := s.service.PushArchive(g.ID, "", s.cli); err != nil {
+		return err
+	}
+
+	// manage backup
+	bs, err := s.service.AllBackups(g.ID)
+	if err != nil {
+		return err
+	}
+
+	for _, b := range bs {
+		binfo, err := s.cli.ArchiveInfo(g.ID, b.UUID)
+		if err != nil {
+			if !errors.Is(err, client.ErrNotFound) {
+				return fmt.Errorf("failed to get remote information about the backup file: %w", err)
+			}
+		}
+
+		if binfo.MD5 != b.MD5 {
+			if err := s.cli.PushBackup(b, g); err != nil {
+				return fmt.Errorf("failed to push backup: %w", err)
+			}
+		}
+
+	}
+	return nil
+}
+
+func (s *Syncer) pull(g, r repository.Metadata) error {
+	g.Version = r.Version
+	g.Date = r.Date
+
+	if err := s.service.UpdateMetadata(g.ID, g); err != nil {
+		return err
+	}
+
+	if err := s.service.PullArchive(g.ID, "", s.cli); err != nil {
+		return err
+	}
+
+	if err := s.service.ApplyCurrent(g.ID); err != nil {
+		return err
+	}
+
+	// manage backup
+	bs, err := s.cli.ListArchives(g.ID)
+	if err != nil {
+		return err
+	}
+
+	for _, uuid := range bs {
+		rinfo, err := s.cli.ArchiveInfo(g.ID, uuid)
+		if err != nil {
+			return err
+		}
+
+		linfo, err := s.service.Backup(g.ID, uuid)
+		if err != nil {
+			return err
+		}
+
+		if linfo.MD5 != rinfo.MD5 {
+			if err := s.service.PullBackup(g.ID, uuid, s.cli); err != nil {
+				return err
+			}
+		}
+	}
+
+	return nil
+}

pkg/tools/archive/archive.go

@@ -5,10 +5,17 @@ import (
 	"compress/gzip"
 	"fmt"
 	"io"
+	"log/slog"
 	"os"
 	"path/filepath"
 )
 
+const (
+	// Tune these to your app’s needs
+	maxCompressedUpload   = 500 << 20  // 500 MiB compressed
+	maxUncompressedOutput = 1000 << 20 // 100 MiB after inflate
+)
+
 func Untar(file io.Reader, path string) error {
 	gzr, err := gzip.NewReader(file)
 	if err != nil {
@@ -37,7 +44,7 @@ func Untar(file io.Reader, path string) error {
 		}
 
 		// the target location where the dir/file should be created
-		target := filepath.Join(path, header.Name)
+		target := filepath.Clean(filepath.Join(path, filepath.Clean(header.Name)))
 
 		// the following switch could also be done using fi.Mode(), not sure if there
 		// a benefit of using one vs. the other.
@@ -49,26 +56,35 @@ func Untar(file io.Reader, path string) error {
 		// if its a dir and it doesn't exist create it
 		case tar.TypeDir:
 			if _, err := os.Stat(target); err != nil {
-				if err := os.MkdirAll(target, 0755); err != nil {
+				if err := os.MkdirAll(target, 0740); err != nil {
 					return err
 				}
 			}
 
 		// if it's a file create it
 		case tar.TypeReg:
-			f, err := os.OpenFile(target, os.O_CREATE|os.O_RDWR, os.FileMode(header.Mode))
+			f, err := os.OpenFile(target, os.O_CREATE|os.O_RDWR, header.FileInfo().Mode())
 			if err != nil {
 				return err
 			}
 
+			limited := &io.LimitedReader{R: gzr, N: maxUncompressedOutput}
+
 			// copy over contents
-			if _, err := io.Copy(f, tr); err != nil {
+			if _, err := io.Copy(f, limited); err != nil {
 				return err
 			}
 
 			// manually close here after each file operation; defering would cause each file close
 			// to wait until all operations have completed.
-			f.Close()
+			if err := f.Close(); err != nil {
+				slog.Error("failed to close file", "err", err)
+			}
+
+			if limited.N == 0 {
+				// Limit exhausted → likely bomb
+				return fmt.Errorf("payload too large after decompression")
+			}
 		}
 	}
 }
@@ -106,7 +122,7 @@ func Tar(file io.Writer, root string) error {
 			return nil
 		}
 
-		file, err := os.Open(path)
+		file, err := os.Open(filepath.Clean(path))
 		if err != nil {
 			return fmt.Errorf("failed to open file: %w", err)
 		}

pkg/tools/hash/hash.go

@@ -5,10 +5,11 @@ import (
 	"encoding/hex"
 	"io"
 	"os"
+	"path/filepath"
 )
 
 func FileMD5(fp string) (string, error) {
-	f, err := os.OpenFile(fp, os.O_RDONLY, 0)
+	f, err := os.OpenFile(filepath.Clean(fp), os.O_RDONLY, 0)
 	if err != nil {
 		return "", err
 	}

pkg/tools/iterator/iterator.go

@@ -0,0 +1,40 @@
+package iterator
+
+type (
+	Iterator[T any] struct {
+		index  int
+		values []T
+	}
+)
+
+func New[T any](values []T) *Iterator[T] {
+	return &Iterator[T]{
+		values: values,
+	}
+}
+
+func (it *Iterator[T]) Next() bool {
+	if len(it.values) == it.index {
+		return false
+	}
+	it.index += 1
+	return true
+}
+
+func (it *Iterator[T]) Value() T {
+	if len(it.values) == 0 {
+		var zero T
+		return zero
+	}
+
+	if len(it.values) == it.index {
+		var zero T
+		return zero
+	}
+
+	return it.values[it.index]
+}
+
+func (it *Iterator[T]) IsEmpty() bool {
+	return len(it.values) == 0
+}