The repo had no README, Makefile, CI, linter config or version string.
- README.md: requirements (ffmpeg/ffprobe, plus yt-dlp for SoundCloud), build,
the per-source credentials table, usage, the quality scale and the download
database's migration behaviour. Every claim was checked against the code
rather than written from memory, which is how the quality-range bug below was
found. It also records the two deferred refactors (no shared HTTP layer, and
metadata as map[string]any) so they are documented rather than lore, and
notes that there is no LICENSE file.
- Makefile: build, install, test, race, cover, fmt, fmt-check, vet, lint,
check, clean, help. `make build` stamps version/commit/date via -ldflags.
- .github/workflows/ci.yml: gofmt, vet, build, test and test -race, plus a
lint job. The linter is intentionally unpinned, with a comment: a
golangci-lint built against an older Go cannot analyse a go1.25 module, which
is the same reason a locally installed staticcheck built with go1.24 cannot
run here.
- .golangci.yml: standard set plus bodyclose, errorlint, nilerr and
govet/copylocks. copylocks matters now that config.Config carries a mutex;
bodyclose and errorlint target defects this codebase actually has.
- `rip --version` / `-V`, documented in the help output, falling back to the
VCS revision the toolchain embeds for `go install` builds.
Fixes a bug introduced in the previous commit: Validate capped deezer quality
at 2 and soundcloud at 1, but config.toml.example documents deezer as 2/3/4 and
the global -q flag accepts 0-4, so a documented config would have failed to
load. deezer's buildFormatPriority treats anything >= 2 as FLAC and soundcloud
ignores the value entirely, so the real ceiling is 4 everywhere; only the Qobuz
and Beatport floor of 1 is a genuine constraint. Pinned with a test that walks
the whole documented range.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The provider apps' own identifiers and protocol keys were scattered as
constants across six packages. They are not user secrets and stay baked in so
the tool still works out of the box, but they are now mirrored into the config
so that when a provider rotates one, a user can fix their install with a config
edit instead of waiting for a release.
Moved, each with the current value as the default in internal/config:
qobuz mobile_app_id, mobile_app_secret
tidal app_client_id, app_client_secret
deezer api_key, gateway_key, blowfish_secret
yandex sign_key, legacy_mp3_sign_salt
beatport app_client_id
applyVendorDefaults backfills any empty value, so configs written before these
keys existed keep working and the clients never have to nil-check them. Each
client reads through a small accessor; the package-level signing helpers
(mobileSignRequest, yandexDownloadSign, legacyDirectURL, deriveGatewayAuthToken
and friends, deriveDeezerBlowfishKey) now take the key as a parameter instead
of closing over a constant. The blowfish secret reaches internal/download
through a field on Downloader set by app.New.
The blowfish key derivation XORs 16 bytes of the secret, so a mistyped override
would have panicked; a wrong-length value is now rejected with a warning and
the built-in value is used. Tests pin the length and that the qobuz mobile
secret is valid hex, since the HKDF step requires it.
Also drops soundcloud.client_id and soundcloud.app_version: soundcloud goes
through yt-dlp, which supplies its own, so nothing read them.
config.toml.example documents each new key as "leave empty unless the vendor
rotates theirs".
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Dead code
Removed, each verified to have no non-test caller: promptSearchSelection
(77 lines, superseded by promptSearchSelectionMenu), AddPlaylistByTrackIDs,
download.NewWithVerifySSL, qobuz.Client.GetTrackMetadata,
tidal.Client.trackSupportsAtmos (test-only, and the comment above
GetDownloadable already documented its removal from the live path) and its
now-orphaned test, yandex.canonicalTrackRequestID (a no-op returning its
trimmed input; the call site uses strings.TrimSpace directly) and the unused
defaultEstimatedKbps constant.
Config keys that did nothing
qobuz.download_booklets and misc.check_for_updates were declared, defaulted
and documented in config.toml.example but read by no code. The whole
[youtube] block went too: there is no YouTube provider. go-toml ignores
unknown keys, verified, so existing user configs still load.
Duplicated helpers
tidal.stringify and yandex.firstNonEmpty were byte-identical copies of
jsonutil.StringFromAny and jsonutil.FirstNonEmpty. displayArtistNames
existed three times, byte-identical, in internal/app, provider/yandex and
provider/beatport; it now lives in jsonutil. The CLI's normalizeCodec
delegates to config.NormalizeCodec so the flag and the config file are
checked by the same rules.
Tests for packages that had none
internal/jsonutil (0% -> 100%) and internal/netutil (0% -> 78%), the latter
covering redactURL, which is a security control, and the zero-timeout
contract that internal/download and the qobuz body copy depend on.
internal/config rose to 82% with coverage of the new Validate(), the
0600 permissions, CloneConfigData not sharing slices, and a concurrent
UpdateTokens test that exercises the mutex under -race.
Test suite is ~85x faster
Provider tests built clients with the default 60 requests/minute, so the
rate limiter slept 1s per HTTP call: deezer took 31s, tidal 11s, qobuz 8s.
Each provider test package now builds its config through a testConfigData
helper that disables throttling. Whole suite: ~60s -> 0.7s, and 2.8s
under -race.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Completes the correctness pass.
Download database migration no longer destroys dedupe state
The pre-source-column migration carried every legacy row over with
source='' and then dropped downloads_legacy, while IsDownloaded matched
source exactly. The result was that every previously recorded download
looked new, the user silently re-downloaded their whole library, and the
original rows were gone. Now the file is copied to <path>.bak-<unixtime>
first, downloads_legacy is kept, and IsDownloaded falls back to the
sourceless rows (over-matching across sources costs a skipped re-download,
which is the cheaper error). Schema state is tracked in PRAGMA user_version
so later migrations can be ordered explicitly. Databases already migrated by
the old code are detected on open.
Also enables WAL and a 10s busy_timeout and caps the pool at one connection,
so a concurrent reader no longer gets SQLITE_BUSY with no retry, and builds
the DSN through url.URL so a path containing '?' is not parsed as query
parameters.
--quality now applies to every source
applyGlobalConfigOverrides set only qobuz, tidal, deezer and soundcloud, so
`rip -q 4 url <beatport-url>` was a silent no-op even though
qualityForSource reads Yandex and Beatport. All six are set, with the
per-source floor applied and reported rather than silently ignored.
config: validation and a fixed reset
Load checked nothing but misc.version, so a negative max_connections or a
bogus conversion codec was accepted and only surfaced mid-rip. Adds
Validate() covering per-source quality ranges, max_connections,
requests_per_minute and truncate_to, and normalizes the conversion codec
from the file through the same path as --codec. `config reset` assigned one
value to both Config.File and Config.Session, so their Secrets slices shared
a backing array; it now takes separate copies.
Tests cover the shipped defaults and config.toml.example, which is how the
over-strict artwork max-width bound in the first draft was caught: -1 is the
documented "do not downscale" sentinel.
soundcloud: use the shared HTTP client
It was the only provider constructing its own http.Client, so it silently
ignored downloads.verify_ssl and max_connections and bypassed the transport
that redacts credentials from -vv logs. It also had no rate limiter at all.
qobuz: mobile fallback could not download a long track
http.Client.Timeout bounds the whole request including the body read, so the
30s API client aborted any track that took longer than 30s to stream. The
body copy now uses a no-timeout client, as internal/download already does.
qobuz: HKDF no longer fails silently
hexDecodeOrNil discarded its error, so a non-hex app secret keyed HKDF on
nil, derived a wrong KEK and produced silently corrupt audio instead of an
error.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
JorenandClaude Opus 5