v0.2.0

Fixes to the writer, both readers and the configuration loader. The on-disc
format is untouched: a set written by 0.1.0 or 0.1.1 reads identically here, one
written here reads on either of them, and the two readers remain interchangeable
disc for disc.

Upgrade for this one

A resume no longer produces a set that cannot be restored. A source path that
had become a directory since the interrupted run was never recognised as already
written, so the run finished, reported a complete set, and produced one that
unsquashfs abandons part way through restoring, recovering a fraction of the
archive. Such a resume is now refused, naming the paths and what they have
become.

Reading a hostile or damaged disc

• ingest no longer follows symbolic links off a disc into staging. A disc whose
  data/ pointed elsewhere had that directory's files staged as images, and a
  MANIFEST.txt pointing at a device streamed until the filesystem filled. Both
  readers refuse the same discs now, and say the link is why.
• brb.sh no longer truncates whatever a symlinked staging lock points at. A
  shell redirection has no O_NOFOLLOW; the name is tested first, as the Go
  build's open has always done.
• A manifest's disc count is read as a decimal number rather than a shell
  expression. discs : 010 was octal eight, so eight staged images satisfied a
  ten-disc set and a partial set was announced complete.
• A public archive's identity.txt cannot slip past its size gate as a device
  node, and the disc numbers a reader is handed are bounded before they reach
  arithmetic that wraps silently.

Configuration

Values that 0.1.1 accepted are refused here, which is why this is the minor and
not the patch. A configuration carrying any of them must be corrected before
anything runs:

• KEEP_IMAGES and ASSUME_YES take the eight boolean spellings and nothing
  else. A 2, an 007 or a padded " 1" was read as true by the Go build and
  killed brb.sh outright on the same file.
• $'...', $"...", $- and $[...] are refused anywhere in a value. The
  shell expands them and the Go parser kept them as literal text, so one file
  named two different directories — STAGING among them.
• ARCHIVE_NAME is bounded at the 128 bytes a disc's publisher field holds.
  Longer names built the whole set and then failed every burn and iso.
• PACK_RATIO_MARGIN and JOBS have upper bounds, and BLOCK_SIZE is used as
  it was validated rather than with whitespace the check had trimmed.

ASSUME_YES in the environment now beats the configuration file in brb.sh, as
it already did in the Go build. It answers the confirmation in front of a restore
that overwrites its destination, and the two readers had it in opposite orders.

Also

A resume says so when a new hard link duplicates data an earlier disc already
holds, doctor reports the budget the packer will actually use, and the
recovery-block count is the one par2 writes rather than a truncated estimate.

Known limitation

Staging can still run out mid-image when an adaptive pack ratio has pushed the
raw budget well above the image budget: preflight sizes its refusal from the
image budget, which is a floor and not a bound on the plaintext mksquashfs
writes. Unchanged from 0.1.1, and now warned about before each disc rather than
fixed. Finished discs survive it and a resume completes once space exists.

Verifying this download

gpg --verify SHA256SUMS.asc SHA256SUMS
sha256sum -c SHA256SUMS

The signature is PGP key 249738C8641C3359. SHA256SUMS covers all four
artifacts; there is no second hash file, since an unsigned one beside a signed
one is a downgrade path.