v0.8.0

The wire protocol is untouched. Everything here is source level, so a peer
built from this tree still talks to one built from 0.7.0. The minor version
moves because the source API does.

Added

• docs/coding-style.md, the project's written C conventions, linked from the
  README. It is written to drop into another project unchanged.
• make lint, which checks the tree against that document: tabs, trailing
  whitespace, non-ASCII, missing final newline, #pragma once, per-file
  licence lines in C and in scripts, extern on a function declaration, bare
  -1 returns, lines over 100 columns, a definition with its body on the
  signature line, a missing tag line, and declarations below the first
  statement of a block. It runs as its own CI job, so the conventions hold
  without a manual sweep.
• make analyze, a gcc -fanalyzer build that fails on a warning in the
  project's own code. The analyzer walks execution paths rather than matching
  patterns, so it catches what a review misses: it found a descriptor leaked
  down a failure branch in the secure-link test and a bind on an unchecked
  socket result in the UDP test, both fixed here.
• The manual is a multi-page site rather than one assembled HTML page:
  introduction, architecture, protocol overview, four tutorials, message
  encoding, protocol reference, testing and analysis, and the API reference.
  The prose was converted, not rewritten. The API reference is still generated
  from src/netchan.h, and check-symbols.sh still fails the build when prose
  names a function the header no longer declares, now across every page.
• Every documentation page carries the version it was built from. At a release
  tag that is the bare version; away from one it is the version, the commit
  count, and the abbreviated sha, so a page from an untagged build says which
  commit produced it.
• A fuzz harness for netchan_feed, the core's entire untrusted surface, with
  a checked-in corpus. make run-tests replays the corpus on every platform,
  which turns any input the fuzzer once crashed on into a regression test, and
  a CI job fuzzes for two minutes on top of that to explore new ground. Half a
  million executions found no crash.

Changed

• Every layer now names its success and failure returns instead of returning a
  bare 0 and -1: NETCHAN_OK/NETCHAN_ERR, and the same pair under the
  MC_, NC_UDP_, NC_CRYPTO_, NC_AUTH_, KS_ and MEML_ prefixes. They
  are #define, so the return type stays a plain int and a caller that tests
  < 0 without including the header is still correct. The values are
  unchanged. netchan.h and microchan.h kept their error causes as an enum,
  starting at -2.
• nc_ws and microser name only a failure value, NC_WS_ERR and MS_ERR.
  Their calls return a position or a length, where 0 is a real answer rather
  than success.
• Functions that answer a question return bool: nc_crypto_ready,
  nc_crypto_failed, ks_authorized_key, ks_check_password,
  ks_user_exists, ks_keyfile_encrypted, mc_ipx_available,
  secure_link_up and auth_link_up.
• No file carries a licence line any more, C or shell or awk. The root
  LICENSE is the one place the terms live, so relicensing is one edit rather
  than a sweep. The IDL compiler stopped emitting one into generated code too,
  so a regenerated codec matches.
• Declarations sit at the top of the block that uses them. Where the value
  came from a call whose order matters, or from a read a guard clause proves
  is in bounds, the type moved up and the assignment stayed put.
• Doc comments in the public headers open with /**, so an API description is
  distinguishable from the prose that explains a file.

Breaking

• The nc_auth conversation states are renamed to NC_AUTH_STATE_PENDING,
  NC_AUTH_STATE_OK and NC_AUTH_STATE_DENIED. NC_AUTH_OK now means a call
  succeeded, which is what it means in every other layer. Code that compared
  nc_auth_state() against the old names has to follow, and it will not fail
  quietly: the old spellings no longer exist.
• The nc_auth_server_cb callbacks check_key and check_password return
  bool rather than int. An existing implementation keeps working once its
  own signature changes; the compiler flags the mismatch.
• auth/keystore.h guards with KS_KEYSTORE_H and examples/common/sockutil.h
  with SU_SOCKUTIL_H, so a vendored copy cannot collide with a host project's
  own KEYSTORE_H or SOCKUTIL_H.
• microchan/tests/mc_memlink.{c,h} is renamed to memlink.{c,h}, matching
  the meml_ symbols it exports, and its guard is MEML_MEMLINK_H. The build
  library is memlink. This is test-only and ships to nobody, but a project
  that vendored microchan's tests has a file to rename.

Vendoring

curl -fsSL https://raw.githubusercontent.com/OrangeTide/netchan/v0.8.0/tools/vendor.sh | sh -s -- --version v0.8.0

The source snapshot below is what that fetches. See
VENDORING.md.