Keep release clippy gate clean

Makefile

@@ -36,7 +36,9 @@ persistence-check:
 package-check:
 	$(MAKE) package-release-linux
 	$(MAKE) package-release-windows
-	sh scripts/verify-release-artifacts.sh
+	sh scripts/verify-release-artifacts.sh \
+		target/dosh-release/dosh-linux-x86_64.tar.gz \
+		target/dosh-release/dosh-windows-x86_64.zip
 
 install:
 	sh install.sh --from-current

scripts/verify-release-artifacts.sh

@@ -22,11 +22,14 @@ artifact_version() {
   esac
 }
 
+if [ "$#" -gt 0 ]; then
+  artifacts="$*"
+else
+  artifacts="$out_dir/dosh-linux-x86_64.tar.gz $out_dir/dosh-macos-aarch64.tar.gz $out_dir/dosh-windows-x86_64.zip"
+fi
+
 failed=0
-for artifact in \
-  "$out_dir/dosh-linux-x86_64.tar.gz" \
-  "$out_dir/dosh-macos-aarch64.tar.gz" \
-  "$out_dir/dosh-windows-x86_64.zip"; do
+for artifact in $artifacts; do
   if [ ! -f "$artifact" ]; then
     echo "missing release artifact: $artifact" >&2
     failed=1

src/bin/dosh-client.rs

@@ -2501,7 +2501,6 @@ fn download_file(
     let mut file = if offset > 0 {
         let file = fs::OpenOptions::new()
             .read(true)
-            .write(true)
             .append(true)
             .open(local)
             .with_context(|| format!("open {}", local.display()))?;

src/bin/dosh-server.rs

@@ -1743,10 +1743,10 @@ async fn handle_detach(state: &Arc<Mutex<ServerState>>, packet: &protocol::Packe
     let (key, _) = find_client_decrypt_key(state, &packet.header)?;
     let _ = protocol::decrypt_body(packet, &key, CLIENT_TO_SERVER)?;
     let mut locked = state.lock().expect("server state poisoned");
-    if let Some(client) = locked.client_mut(&packet.header.conn_id) {
-        if !client.replay.accept(packet.header.seq) {
-            return Ok(());
-        }
+    if let Some(client) = locked.client_mut(&packet.header.conn_id)
+        && !client.replay.accept(packet.header.seq)
+    {
+        return Ok(());
     }
     locked.remove_client_everywhere(&packet.header.conn_id);
     Ok(())
@@ -2681,7 +2681,6 @@ async fn handle_file_request(
             let (file, temp_path, written, atomic) = if resume && final_path.exists() {
                 let mut file = fs::OpenOptions::new()
                     .read(true)
-                    .write(true)
                     .append(true)
                     .open(&final_path)
                     .with_context(|| format!("open {}", final_path.display()))?;

tests/release_scripts.rs

@@ -19,6 +19,29 @@ fn release_scripts_skip_stale_artifacts_when_auto_discovering() {
     assert!(publish.contains("actual=\"$(artifact_version \"$artifact\" || true)\""));
 }
 
+#[test]
+fn package_check_verifies_only_artifacts_it_builds() {
+    let makefile = include_str!("../Makefile");
+    let verify = include_str!("../scripts/verify-release-artifacts.sh");
+    assert!(
+        verify.contains("if [ \"$#\" -gt 0 ]; then"),
+        "release verifier must accept an explicit artifact list"
+    );
+    let package_check = makefile
+        .split("package-check:")
+        .nth(1)
+        .and_then(|tail| tail.split("\ninstall:").next())
+        .expect("package-check target");
+    assert!(package_check.contains("package-release-linux"));
+    assert!(package_check.contains("package-release-windows"));
+    assert!(package_check.contains("dosh-linux-x86_64.tar.gz"));
+    assert!(package_check.contains("dosh-windows-x86_64.zip"));
+    assert!(
+        !package_check.contains("dosh-macos-aarch64.tar.gz"),
+        "Linux package-check does not build macOS artifacts, so it must not depend on one"
+    );
+}
+
 #[test]
 fn systemd_service_does_not_sandbox_remote_shells() {
     let service = include_str!("../packaging/systemd/dosh-server.service");