acst

Tracks changes and corruption in files using xattr-based checksums.
git clone https://noxz.tech/git/acst.git
Log | Files | Tags | LICENSE 
commit: ec46d0b642c9e79627c94271b2ae1fd8a69d4465
parent: 
author: Chris Noxz <chris@noxz.tech>
date:   Fri, 24 Jun 2022 12:51:12 +0200

Initial commit
A.gitignore2+
ALICENSE674++++++++++++++++++++
AMakefile41++
Aacst.1215+++++++
Aacst.c374+++++++++++
Aacst.h298+++++++++
Aconfig.mk10+
Asha256.c209++++++
Asha256.h69++
Atest329++++++++++
10 files changed, 2221 insertions(+) 
diff --git a/.gitignore b/.gitignore
@@ -0,0 +1,2 @@
+acst
+*.o
diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,674 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 3, 29 June 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU General Public License is a free, copyleft license for
+software and other kinds of works.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+the GNU General Public License is intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.  We, the Free Software Foundation, use the
+GNU General Public License for most of our software; it applies also to
+any other work released this way by its authors.  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  To protect your rights, we need to prevent others from denying you
+these rights or asking you to surrender the rights.  Therefore, you have
+certain responsibilities if you distribute copies of the software, or if
+you modify it: responsibilities to respect the freedom of others.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must pass on to the recipients the same
+freedoms that you received.  You must make sure that they, too, receive
+or can get the source code.  And you must show them these terms so they
+know their rights.
+
+  Developers that use the GNU GPL protect your rights with two steps:
+(1) assert copyright on the software, and (2) offer you this License
+giving you legal permission to copy, distribute and/or modify it.
+
+  For the developers' and authors' protection, the GPL clearly explains
+that there is no warranty for this free software.  For both users' and
+authors' sake, the GPL requires that modified versions be marked as
+changed, so that their problems will not be attributed erroneously to
+authors of previous versions.
+
+  Some devices are designed to deny users access to install or run
+modified versions of the software inside them, although the manufacturer
+can do so.  This is fundamentally incompatible with the aim of
+protecting users' freedom to change the software.  The systematic
+pattern of such abuse occurs in the area of products for individuals to
+use, which is precisely where it is most unacceptable.  Therefore, we
+have designed this version of the GPL to prohibit the practice for those
+products.  If such problems arise substantially in other domains, we
+stand ready to extend this provision to those domains in future versions
+of the GPL, as needed to protect the freedom of users.
+
+  Finally, every program is threatened constantly by software patents.
+States should not allow patents to restrict development and use of
+software on general-purpose computers, but in those that do, we wish to
+avoid the special danger that patents applied to a free program could
+make it effectively proprietary.  To prevent this, the GPL assures that
+patents cannot be used to render the program non-free.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Use with the GNU Affero General Public License.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU Affero General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the special requirements of the GNU Affero General Public License,
+section 13, concerning interaction through a network will apply to the
+combination as such.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If the program does terminal interaction, make it output a short
+notice like this when it starts in an interactive mode:
+
+    <program>  Copyright (C) <year>  <name of author>
+    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, your program's commands
+might be different; for a GUI interface, you would use an "about box".
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU GPL, see
+<https://www.gnu.org/licenses/>.
+
+  The GNU General Public License does not permit incorporating your program
+into proprietary programs.  If your program is a subroutine library, you
+may consider it more useful to permit linking proprietary applications with
+the library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.  But first, please read
+<https://www.gnu.org/licenses/why-not-lgpl.html>.
diff --git a/Makefile b/Makefile
@@ -0,0 +1,41 @@
+.POSIX:
+
+include config.mk
+
+SRC = acst.c sha256.c
+OBJ = ${SRC:.c=.o}
+
+all: options acst
+
+options:
+	@echo st build options:
+	@echo "CFLAGS  = ${CFLAGS}"
+	@echo "CC      = ${CC}"
+
+.c.o:
+	${CC} ${CFLAGS} -c $<
+
+${OBJ}: config.mk
+
+acst: ${OBJ}
+	${CC} -o $@ ${OBJ}
+
+clean:
+	rm -f acst ${OBJ}
+
+install: all
+	mkdir -v -p ${DESTDIR}${PREFIX}/bin
+	cp -v acst ${DESTDIR}${PREFIX}/bin
+	chmod 755 ${DESTDIR}${PREFIX}/bin/acst
+	mkdir -v -p ${DESTDIR}${MANPREFIX}/man1
+	sed "s/VERSION/${VERSION}/g" < acst.1 > ${DESTDIR}${MANPREFIX}/man1/acst.1
+	chmod 644 ${DESTDIR}${MANPREFIX}/man1/acst.1
+
+uninstall:
+	rm -f ${DESTDIR}${PREFIX}/bin/acst
+	rm -f ${DESTDIR}${MANPREFIX}/man1/acst.1
+
+test: acst
+	@./test
+
+.PHONY: all install clean test
diff --git a/acst.1 b/acst.1
@@ -0,0 +1,215 @@
+.TH ACST 1 acst\-VERSION
+.SH NAME
+acst \- Actual C-implementation of a Simple shaTag
+.
+.SH SYNOPSIS
+.B acst
+.RB [ \-hmnqrvx ]
+.IR "" < FILE ...>
+.
+.SH DESCRIPTION
+.B acst
+is a minimal and simplified implementation in C of, or rather, inspired by,
+.B shatag
+and also inspired by
+.BR cshatag .
+.P
+.B acst
+as a tool is designed to detect silent data corruption by first writing the
+mtime and the SHA256 checksum of a file into its extended attributes and then,
+upon later execution, comparing and verifying changes against both the mtime
+and checksum. For this to work, the file system intended to be verified must
+first support extended user attributes, either by being mounted with user_xattr
+enabled or by other means. Depending on how these variables differ, various
+file statuses are being reported (see the
+.B "FILE STATUSES"
+section).
+.P
+.B acst
+won't follow symlinks due to the risks of creating reference loops or
+referencing data outside of the indented scope of subdirectories.
+.B acst
+also won't descend into directories on other file systems than the one
+specified using the
+.IR FILE
+argument. Keep in mind that if multiple files with different file systems are
+specified using the
+.IR FILE
+argument, they will get traversed indifferent of each other. For example, if
+you specify two different partitions mounted on two different directories, they
+would both be traversed.
+.P
+.B acst
+does not aim to be format-compatible with
+.B shatag
+and uses different names for the extended attributes but similar formats for
+the extended attributes (see the
+.B COMPATIBILITY
+section).
+.
+.SH OPTIONS
+.TP
+.BR -h
+Print brief usage information to standard output and exit.
+.TP
+.BR -m
+Summarize information at end of execution.
+.TP
+.BR -n
+Don't create or update any extended file attributes. File hashing and checking
+will be performed, but no extended file attributes will be created or updated.
+.TP
+.BR -q
+Quiet mode. If specified one time
+.B ok
+files are not being reported. If
+specified two times, only
+.BR corrupt ,
+.BR backdated ,
+and
+.BR malformed
+files and errors are being reported.
+.TP
+.BR -r
+Process directories and their contents recursively, not just files.
+.TP
+.BR -x
+Remove acts's extended attributes (xattrs) from
+.IR FILE .
+.TP
+.BR -v
+prints version information to stderr, then exits.
+.
+.SH "RETURN VALUES"
+.TP
+.BR 0
+Success
+.TP
+.BR 1
+Wrong number of or invalid arguments.
+.TP
+.BR 2
+One or more files, including directories when executed with the recursive flag,
+could not be opened.
+.TP
+.BR 3
+One or more files is not a regular file and probably a symlink of sorts.
+.TP
+.BR 4
+Extended attributes could not be written to one or more files.
+.TP
+.BR 5
+At least one file was found to be corrupt, backdated or malformed.
+.TP
+.BR 6
+More than one type of error has occurred.
+.
+.SH "FILE STATUSES"
+During program execution and processing of each file various file statuses will
+appear on
+.BR stdout .
+Following are descriptions of these statuses.
+.TP
+.BR ok
+Checksum is correct and mtime is unchanged.
+.TP
+.BR "hash ok"
+Checksum is correct and mtime was changed.
+.TP
+.BR outdated
+Checksum is incorrect and mtime is newer than the one stored as an extended
+Attribute.
+.TP
+.BR backdated
+Checksum is incorrect and mtime is older than the one stored as an extended
+Attribute.
+.TP
+.BR malformed
+Extended attributes could not be read as otherwise intended.
+.TP
+.BR corrupt
+Checksum is incorrect but mtime stayed the same.
+.TP
+.BR disrupted
+File was modified during hash computation.
+.TP
+.BR new
+Extended attributes are missing and were added.
+.TP
+.BR "xattr removed"
+Extended attributes were removed.
+.
+.SH EXAMPLES
+.TP
+.BR "acst -r /home/user01 /mnt/memorystick > /root/acst.log"
+will recursively process files in both /home/user01 and /mnt/memorystick even
+if they belong to different file systems, as they are both specified using the
+.IR FILE
+argument, and then log the result to /root/acst.log.
+.TP
+.BR "acst -rm /home/user01 /mnt/memorystick > /root/acst.log"
+will perform the same operation as above with the addition of also summarizing
+the result of the execution to the log.
+.TP
+.BR "acst -rx /mnt/memorystick > /root/acst.log"
+will recursively process and remove extended attributes from files in
+/mnt/memorystick and log the result to /root/acst.log.
+.
+.SH COMPATIBILITY
+.B acst
+writes to
+.B user.acst.cs
+and
+.B user.acst.ts
+instead of the
+.B user.shatag.sha256
+and
+.B user.shatag.ts
+specified by
+.BR shatag .
+.br
+.B acst
+writes the
+.B user.acst.ts
+field with full integer nanosecond precision, while python-implemented
+.B shatag
+doesn't.
+.
+.SH AUTHOR
+Chris Noxz <chris@noxz.tech>
+.
+.SH COPYRIGHT
+Copyright \(co 2022 Chris Noxz.
+.P
+License: GPLv3+ (with GPL-compatible BSD-3-Clause, see sha256.c for exception)
+.P
+GNU GPL version 3 or later
+<https://www.gnu.org/licenses/licenses.html>.
+.P
+This is free software: you are free to change and redistribute it.
+There is NO WARRANTY, to the extent permitted by law.
+.
+.SH "SEE ALSO"
+.BR shatag (1),
+.BR cshatag (1),
+.BR sha256sum (1),
+.BR getfattr (1),
+.BR setfattr (1)
+.P
+The original
+.B shatag
+utility, written in python by Maxime Augier:
+.br
+https://bitbucket.org/maugier/shatag
+.br
+and
+.B cshatag
+utility, written in Go by Jakob Unterwurzacher:
+.br
+https://github.com/rfjakob/cshatag
+.
+.SH AVAILABILITY
+.P
+Up-to-date sources can be found at:
+.br
+https://noxz.tech/git/acst
diff --git a/acst.c b/acst.c
@@ -0,0 +1,374 @@
+/**
+ * Copyright (C) 2022 Chris Noxz
+ * Author(s): Chris Noxz <chris@noxz.tech>
+ *
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#include <dirent.h>            // for dirent, closedir, opendir, readdir, DIR
+#include <errno.h>             // for errno, ENODATA
+#include <fcntl.h>             // for open, O_NOFOLLOW, O_RDONLY
+#include <stdarg.h>            // for va_end, va_list, va_start
+#include <stdbool.h>           // for true, false, bool
+#include <stdio.h>             // for fprintf, stdout, snprintf, sprintf
+#include <stdlib.h>            // for free, EXIT_FAILURE, calloc, exit, malloc
+#include <string.h>            // for strlen, strcmp, memset, strerror
+#include <time.h>              // for timespec
+#include <unistd.h>            // for close, read
+#include <bits/getopt_core.h>  // for getopt, optind
+#include <sys/stat.h>          // for stat, fstat, lstat, S_ISDIR, S_ISREG
+#include <sys/xattr.h>         // for fgetxattr, fremovexattr, fsetxattr
+
+#include "sha256.h"            // for SHA256_final, SHA256_init, SHA256_update
+#include "acst.h"
+
+
+static void
+bin2hex(unsigned char *bin, size_t len, char *hex)
+{
+	unsigned int    i,                      // index counter of binary data
+	                j;                      // index counter of hex data
+	for (i = j = 0; i < len; i++) {
+		hex[j++] = hextab[bin[i] >> 4];
+		hex[j++] = hextab[bin[i] & 0x0F];
+	}
+	hex[j] = 0;
+}
+
+
+static void
+error(enum Error er, const char *fmt, ...)
+{
+	va_list         ap;                     // argument list holder
+
+	va_start(ap, fmt);
+	vfprintf(stderr, fmt, ap);
+	va_end(ap);
+
+	switch (er) {
+	case ER_NOT_REGULAR:                    cnt.errNotRegular++; break;
+	case ER_OPENING:                        cnt.errOpening++; break;
+	case ER_XATTR_OPERATION:                cnt.errWritingXattr++; break;
+	case ER_GENERIC:                        cnt.errGeneric++; break;
+	case ER_FATAL:                          exit(EXIT_FAILURE);
+	}
+	cnt.errs++;
+}
+
+
+static enum FileState
+file_state(int fd, xa_t *xa_s, xa_t *xa_a)
+{
+	if (arg.remove)
+		return xa_write(fd, NULL) ? FS_REMOVED : FS_REMOVED_ERROR;
+
+	if (!xa_compute(fd, xa_a))
+		return FS_ERROR;
+	else if (xa_a->cs[0] == 0)
+		return FS_DISRUPTED;
+
+	if (!xa_read(fd, xa_s))
+		return FS_MALFORMED;
+
+	if (xa_s->cs[0] == 0)
+		return FS_NEW;
+
+	/* compare stored and actual timestamp */
+	xa_a->tcmp = (
+		  (int)(xa_s->s - xa_a->s) > 0 || (int)(xa_s->ns - xa_a->ns) > 0 ? 1
+		: (int)(xa_s->s - xa_a->s) < 0 || (int)(xa_s->ns - xa_a->ns) < 0 ? -1
+		: 0
+	);
+
+	return (
+		  strcmp(xa_s->cs, xa_a->cs) == 0   // if hash is correct
+		? xa_a->tcmp == 0 ? FS_OK           // ...and ts are matching
+		: FS_TOUCHED                        // ...or if not
+		: xa_a->tcmp < 0 ? FS_OUTDATED      // else if ts is new
+		: xa_a->tcmp > 0 ? FS_BACKDATED     // else if ts is old
+		: FS_CORRUPT                        // else
+	);
+}
+
+
+static void
+process_argument(const char *fn)
+{
+	struct stat     st;                     // stat holder
+
+	if (lstat(fn, &st) != 0)
+		error(ER_OPENING, STR_ERR_OPNF, fn);
+	else if (S_ISREG(st.st_mode))
+		process_file(fn);
+	else if (S_ISDIR(st.st_mode))
+		process_directory(fn);
+	/* make sure to only process regular files or directory walking */
+	else
+		error(ER_NOT_REGULAR, STR_ERR_REGF, fn);
+}
+
+
+static void
+process_directory(const char *fn)
+{
+	DIR             *d;                     // directory pointer
+	struct dirent   *dp;                    // directory entry pointer
+	struct stat     dst,                    // stat holder for directory
+	                st;                     // stat holder for children
+	char            *rp;                    // relative path holder
+
+	if (!arg.recursive)
+		return error(ER_NOT_REGULAR, STR_ERR_RECU, fn);
+
+	/* open directory and get stats */
+	if (!((d = opendir(fn)) && lstat(fn, &dst) == 0))
+		return error(ER_OPENING, STR_ERR_OPND, fn);
+
+	/* loop through directory (including hidden files), making sure to process
+	 * the relative path of each file */
+	while ((dp = readdir(d)) != NULL) {
+		if (strcmp(dp->d_name, ".") == 0 || strcmp(dp->d_name, "..") == 0)
+			continue;
+		if ((rp = malloc(strlen(fn) + strlen(dp->d_name) + 2))) {
+			sprintf(rp, "%s/%s", fn, dp->d_name);
+			/* make sure not to descend directories on other filesystems */
+			if (!(lstat(rp, &st) == 0 && dst.st_dev == st.st_dev))
+				error(ER_OPENING, STR_ERR_DDEV, rp, fn);
+			else
+				process_argument(rp);
+			free(rp);
+		}
+	}
+	closedir(d);
+}
+
+
+static void
+process_file(const char *fn)
+{
+	int             fd;                     // file holder
+	xa_t            xa_s,                   // stored attribute
+	                xa_a;                   // actual attribute
+	enum FileState  st;                     // file state
+
+	if (!(fd = open(fn, O_RDONLY | O_NOFOLLOW)))
+		return error(ER_OPENING, STR_ERR_OPNF, fn);
+
+	if ((st = file_state(fd, &xa_s, &xa_a)) == FS_ERROR)
+		error(ER_GENERIC, STR_ERR_HASH, fn);
+	else if (st == FS_REMOVED_ERROR)
+		error(ER_XATTR_OPERATION, STR_ERR_XARM, fn, strerror(errno));
+	else {
+		report(fn, st);
+		if (!arg.quiet && !(st == FS_OK || st == FS_REMOVED || st == FS_DISRUPTED || st == FS_MALFORMED))
+			fprintf(stdout, STR_CMP_FRMT
+				, strlen(xa_s.cs) > 0 ? xa_s.cs : zSHA256
+				, xa_s.s
+				, xa_s.ns
+				, strlen(xa_a.cs) > 0 ? xa_a.cs : zSHA256
+				, xa_a.s
+				, xa_a.ns
+			);
+		if (!(st == FS_OK || st == FS_REMOVED || st == FS_DISRUPTED || st == FS_CORRUPT || st == FS_BACKDATED || st == FS_MALFORMED) && !xa_write(fd, &xa_a))
+			error(ER_XATTR_OPERATION, STR_ERR_XAWR, fn);
+	}
+
+	close(fd);
+}
+
+
+static void
+report(const char *fn, enum FileState st)
+{
+	switch (st) {
+	case FS_OK:
+	case FS_REMOVED:                        cnt.ok++; break;
+	case FS_DISRUPTED:                      cnt.disrupted++; break;
+	case FS_CORRUPT:                        cnt.corrupt++; break;
+	case FS_TOUCHED:                        cnt.touched++; break;
+	case FS_NEW:                            cnt.new++; break;
+	case FS_OUTDATED:                       cnt.outdated++; break;
+	case FS_BACKDATED:                      cnt.backdated++; break;
+	case FS_MALFORMED:                      cnt.malformed++; break;
+	/* don't report errors here (this is only to avoid compiler warnings) */
+	case FS_REMOVED_ERROR:
+	case FS_ERROR:                          return;
+	}
+	cnt.total++;
+
+	if (st == FS_CORRUPT || st == FS_BACKDATED || st == FS_MALFORMED) {
+		fprintf(stderr, STR_ERR_ABNO, fn);
+		fprintf(stdout, STR_OUT_STAT
+			, st == FS_CORRUPT ? STR_OUT_CORR
+			: st == FS_BACKDATED ? STR_OUT_BACK
+			: STR_OUT_MALF, fn);
+	}
+
+	if (arg.quiet < 2 && (st == FS_DISRUPTED || st == FS_TOUCHED || st == FS_NEW || st == FS_OUTDATED))
+		fprintf(stdout, STR_OUT_STAT
+			, st == FS_DISRUPTED ? STR_OUT_DISR
+			: st == FS_TOUCHED ? STR_OUT_TOUC
+			: st == FS_NEW ? STR_OUT_NEW
+			: STR_OUT_OUTD, fn);
+
+	if (arg.quiet < 1 && (st == FS_OK || st == FS_REMOVED))
+		fprintf(stdout, STR_OUT_STAT
+			, st == FS_OK ? STR_OUT_OK
+			: STR_OUT_REMO, fn);
+}
+
+
+static bool
+xa_compute(int fd, xa_t *xa)
+{
+	struct stat     st;                     // file stat holder
+
+	if ((fstat(fd, &st) != 0))
+		return false;
+
+	/* retrieve date modified and compute hash of file */
+	xa->s = st.st_mtim.tv_sec;
+	xa->ns = st.st_mtim.tv_nsec;
+	xa_hash(fd, xa->cs);
+
+	/* get file stats after hash computation as the file could have been
+	 * changed or deleted during the computation */
+	if ((fstat(fd, &st) != 0))
+		return false;
+
+	/* check if the file was modified while the hash was computed, and of so
+	 * indicate with an empty hash */
+	if (!((long unsigned int)st.st_mtim.tv_sec == xa->s && (long unsigned int)st.st_mtim.tv_nsec == xa->ns))
+		xa->cs[0] = 0;
+
+	return true;
+}
+
+
+static void
+xa_hash(int fd, char *cs)
+{
+	SHA256_ctx      ctx;                    // SHA256 context
+	unsigned char   *hash,                  // hash buffer
+	                buf[BUFSZ];             // file content read buffer
+	size_t          len;                    // holder for read buffer length
+
+	SHA256_init(&ctx);
+	while ((len = read(fd, buf, BUFSZ)))
+		SHA256_update(&ctx, buf, len);
+
+	if (!(hash = calloc(1, SHA256_BYTES)))
+		error(ER_FATAL, STR_ERR_OOM);
+
+	SHA256_final(&ctx, hash);
+
+	bin2hex(hash, SHA256_BYTES, cs);
+	free(hash);
+}
+
+
+static bool
+xa_read(int fd, xa_t *xa)
+{
+	char            *c;                     // character pointer used in loop
+
+	/* initialize metadata holders to zero, and create a blank xa */
+	memset(xa, 0, sizeof(*xa));
+	memset(ts, 0, sizeof(*ts));
+
+	/* read checksum, on error indicate as new if missing else fail */
+	if (fgetxattr(fd, XATTR_CS, xa->cs, sizeof(xa->cs)) < 0)
+		return errno == ENODATA ? true : false;
+	else if (strlen(xa->cs) != CSSZ)
+		return false;
+
+	/* make sure digits are hex (else fail) and in lower case (else adjust) */
+	for (c = xa->cs; *c; c++)
+		if (*c >= 0x41 && *c <= 0x46)
+			*c += 0x20;
+		else if ((*c < 0x30 || *c > 0x39) && (*c < 0x61 || *c > 0x66))
+			return false;
+
+	/* read timestamp, on error (ENODATA included) fail */
+	if (fgetxattr(fd, XATTR_TS, ts, sizeof(ts) - 1) < 0)
+		return false;
+	else if (sscanf(ts, FRMT_TS, &xa->s, &xa->ns) < 1)
+		return false;
+
+	return true;
+}
+
+
+static bool
+xa_write(int fd, const xa_t *xa)
+{
+	if (arg.dryrun)
+		return true;
+
+	/* remove extended attributes from file if xa is null */
+	if (xa == NULL)
+		return (
+			fremovexattr(fd, XATTR_TS) |
+			fremovexattr(fd, XATTR_CS)
+		) == 0;
+
+	/* prepare and write extended attributes to file */
+	snprintf(ts, sizeof(ts), FRMT_TS, xa->s, xa->ns);
+	return (
+		fsetxattr(fd, XATTR_TS, ts, strlen(ts), 0) |
+		fsetxattr(fd, XATTR_CS, &xa->cs, CSSZ, 0)
+	) == 0;
+}
+
+
+int
+main(int argc, char *argv[])
+{
+	int             opt;                    // argument option holder
+
+	arg.prg = argv[0];
+	while ((opt = getopt(argc, argv, "hmnqrvx")) != -1) {
+		switch (opt) {
+		case 'h':                           USAGE(EXIT_SUCCESS); break;
+		case 'm':                           arg.summarize = true; break;
+		case 'n':                           arg.dryrun = true; break;
+		case 'q':                           arg.quiet++; break;
+		case 'r':                           arg.recursive = true; break;
+		case 'v':                           VER(); break;
+		case 'x':                           arg.remove = true; break;
+		default:                            USAGE(EXIT_FAILURE);
+		}
+	}
+
+	if (optind >= argc)
+		USAGE(EXIT_FAILURE);
+
+	for (int i = optind; i < argc; i++)
+		process_argument(argv[i]);
+
+	if (arg.summarize)
+		SUMMERIZE();
+
+	if ((cnt.corrupt + cnt.malformed + cnt.backdated) > 0)
+		return 5;
+	if (cnt.errs == 0 && (cnt.ok + cnt.outdated + cnt.touched + cnt.new) == cnt.total)
+		return EXIT_SUCCESS;
+	if (cnt.errOpening == cnt.errs)
+		return 2;
+	if (cnt.errNotRegular == cnt.errs)
+		return 3;
+	if (cnt.errWritingXattr == cnt.errs)
+		return 4;
+	return 6;
+}
diff --git a/acst.h b/acst.h
@@ -0,0 +1,298 @@
+/**
+ * Copyright (C) 2022 Chris Noxz
+ * Author(s): Chris Noxz <chris@noxz.tech>
+ *
+ * This program is free software: you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation, either version 3 of the License, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+
+#ifndef ACST_H
+#define ACST_H
+
+#include <stdbool.h>        // for bool
+#include <stdio.h>          // for printf
+#include <stdlib.h>         // for exit, EXIT_SUCCESS, size_t
+
+#define BUFSZ               8192    /* buffer size to use in hash computation */
+#define SHA256_BYTES        32      /* byte size of SHA256 hash */
+#define CSSZ                64      /* size of SHA256 hash stored as hex */
+#define TSSZ                32      /* allocation size for timespan holder */
+#define XATTR_CS            "user.acst.cs"  /* name of checksum xattr */
+#define XATTR_TS            "user.acst.ts"  /* name of timestamp xattr */
+#define FRMT_TS             "%010llu.%09lu" /* format of timestamp xattr */
+
+/* string values used in program, could be changes for language compliance */
+#define STR_CMP_FRMT        " stored: %s "FRMT_TS"\n"                       \
+                            " actual: %s "FRMT_TS"\n"
+#define STR_ERR_OOM         "Error: out of memory\n"
+#define STR_ERR_ABNO        "Error: abnormal changes detected \"%s\"\n"
+#define STR_ERR_OPNF        "Error: could not open file \"%s\"\n"
+#define STR_ERR_OPND        "Error: could not open directory \"%s\"\n"
+#define STR_ERR_DDEV        "Error: \"%s\" belong to a different devices than \"%s\"\n"
+#define STR_ERR_REGF        "Error: not a regular file \"%s\"\n"
+#define STR_ERR_HASH        "Error: could not compute hash \"%s\"\n"
+#define STR_ERR_XARM        "Error: could not remove extended attributes from file \"%s\": %s\n"
+#define STR_ERR_XAWR        "Error: could not write extended attributes to file \"\%s\"\n"
+#define STR_ERR_RECU        "Error: path is a directory, did you mean to use the -r option? \"%s\"\n"
+#define STR_OUT_STAT        "<%s> %s\n"
+#define STR_OUT_NEW         "new"
+#define STR_OUT_OK          "ok"
+#define STR_OUT_TOUC        "hash ok"
+#define STR_OUT_OUTD        "outdated"
+#define STR_OUT_BACK        "backdated"
+#define STR_OUT_CORR        "corrupt"
+#define STR_OUT_MALF        "malformed"
+#define STR_OUT_DISR        "disrupted"
+#define STR_OUT_REMO        "xattr removed"
+
+#define USAGE(code)                                                         \
+        {                                                                   \
+          printf("Usage: %s [OPTION]... <FILE>...\n", arg.prg);             \
+          if ((code) == EXIT_SUCCESS)                                       \
+            printf(                                                         \
+    "\n"                                                                    \
+    "Tracks changes and corruption in files using xattr-based checksums.\n" \
+    "\n"                                                                    \
+    "Positional arguments:\n"                                               \
+    "  FILE                  file(s) to track\n"                            \
+    "\n"                                                                    \
+    "Optional arguments:\n"                                                 \
+    "  -h                    show this help message and exit\n"             \
+    "  -m                    summarize information at end of execution\n"   \
+    "  -n                    don't create or update any file attributes\n"  \
+    "  -q                    quiet mode, lowers verbosity\n"                \
+    "  -r                    process files and directories recursively\n"   \
+    "  -V                    output version information and exit\n"         \
+    "  -x                    remove extended attributes from file(s)\n"     \
+    "\n"                                                                    \
+    "Full documentation <https://noxz.tech/software/acst>\n"                \
+            );                                                              \
+          exit(code);                                                       \
+        }
+#define VER()                                                               \
+        {                                                                   \
+          printf("%s " VERSION "\n", arg.prg);                              \
+          exit(EXIT_SUCCESS);                                               \
+        }
+#define SUMMERIZE()                                                         \
+        {                                                                   \
+          if (arg.remove)                                                   \
+            printf(         "\n"                                            \
+                            "Total files processed      : %d\n"             \
+                            "  Xattr removed            : %d\n"             \
+                            "Total errors               : %d\n"             \
+                            "  Opening files            : %d\n"             \
+                            "  Non-regular files        : %d\n"             \
+                            "  Xattr operations         : %d\n"             \
+                            "  Generic                  : %d\n"             \
+              , cnt.total, cnt.ok                                           \
+              , cnt.errs, cnt.errOpening, cnt.errNotRegular                 \
+              , cnt.errWritingXattr, cnt.errGeneric);                       \
+          else                                                              \
+            printf(         "\n"                                            \
+                            "Total files processed      : %d\n"             \
+                            "  New                      : %d\n"             \
+                            "  Ok                       : %d\n"             \
+                            "  Hash ok                  : %d\n"             \
+                            "  Outdated                 : %d\n"             \
+                            "  Backdated                : %d\n"             \
+                            "  Corrupt                  : %d\n"             \
+                            "  Malformed                : %d\n"             \
+                            "  Disrupted                : %d\n"             \
+                            "Total errors               : %d\n"             \
+                            "  Opening files            : %d\n"             \
+                            "  Non-regular files        : %d\n"             \
+                            "  Xattr operations         : %d\n"             \
+                            "  Generic                  : %d\n"             \
+              , cnt.total, cnt.new, cnt.ok, cnt.touched                     \
+              , cnt.outdated, cnt.backdated, cnt.corrupt                    \
+              , cnt.malformed, cnt.disrupted                                \
+              , cnt.errs, cnt.errOpening, cnt.errNotRegular                 \
+              , cnt.errWritingXattr, cnt.errGeneric);                       \
+        }
+
+/* helper variables used by various functions */
+static char ts[TSSZ];                               /* timestamp holder */
+static const char hextab[]  = "0123456789abcdef";   /* hex digit table */
+static const char zSHA256[] = "0000000000000000"    /* zeroed out SHA256 */
+                              "0000000000000000"    /* why 4 lines?... */
+                              "0000000000000000"
+                              "0000000000000000";   /* ...it looks better! */
+
+enum Error {
+	ER_NOT_REGULAR,         /* not a regular file error */
+	ER_OPENING,             /* error opening file or directory */
+	ER_XATTR_OPERATION,     /* error when performing xattr operations */
+	ER_GENERIC,             /* generic error */
+	ER_FATAL                /* fatal error, should result in program ending */
+};
+
+enum FileState {
+	FS_OK,                  /* checksum and mtime both match */
+	FS_DISRUPTED,           /* file was changed during hash computation */
+	FS_CORRUPT,             /* checksum differs while mtime matches */
+	FS_MALFORMED,           /* xattrs cannot be read in its intended format */
+	FS_TOUCHED,             /* checksum matches but mtime doesn't */
+	FS_NEW,                 /* file has no prior checksum or mtime stored */
+	FS_OUTDATED,            /* checksum differs and mtime is newer */
+	FS_BACKDATED,           /* checksum differs and mtime is older */
+	FS_REMOVED,             /* xattrs have been removed from file */
+	FS_REMOVED_ERROR,       /* removal of xattrs failed */
+	FS_ERROR                /* general error */
+};
+
+/* extended attribute/metadata structure */
+typedef struct {
+	unsigned long long s;   /* seconds */
+	unsigned long ns;       /* nanoseconds */
+	char cs[CSSZ + 1];      /* checksum */
+	int tcmp;               /* timespan comparison holder */
+} xa_t;
+
+/* arguments collected from command line */
+struct Arguments {
+	const char *prg;        /* program name */
+	bool dryrun;            /* make a dry run */
+	int quiet;              /* level of quietness */
+	bool recursive;         /* indicate to open and walk directories */
+	bool remove;            /* remove xattrs */
+	bool summarize;         /* show summery at end of program */
+} arg;
+
+/* counters */
+struct Counters {
+	int errs;               /* all errors */
+	int errNotRegular;      /* not a regular file errors  */
+	int errOpening;         /* errors opening file or directory */
+	int errWritingXattr;    /* errors when performing xattr operations */
+	int errGeneric;         /* generic errors */
+
+	int total;              /* all non error counters */
+	int ok;                 /* checksum and mtime both match */
+	int disrupted;          /* file was changed during hash computation */
+	int corrupt;            /* checksum differs while mtime matches */
+	int malformed;          /* xattrs cannot be read in its intended format */
+	int outdated;           /* checksum differs and mtime is newer */
+	int backdated;          /* checksum differs and mtime is older */
+	int touched;            /* checksum matches but mtime doesn't */
+	int new;                /* file has no prior checksum or mtime stored */
+} cnt;
+
+/**
+ * Converts binary data into hex format.
+ *
+ * @param bin               The binary data
+ * @param len               The size of the data
+ * @param hex               The result of the converted data
+ */
+static void bin2hex(unsigned char *bin, size_t len, char *hex);
+
+/**
+ * Retrieves and reports error types and messages. If error type is of fatal
+ * nature, the program will exit with EXIT_FAILURE.
+ *
+ * @param er                The type of error (see enum Error above)
+ * @param fmt               The output format of the error message
+ * @param ...               Various arguments to output in the message
+ */
+static void error(enum Error er, const char *fmt, ...);
+
+/**
+ * Final stage of processing a file which returns the state of the file being
+ * processed meanwhile metadata holders are being populated.
+ *
+ * @param fd                File descriptor of the file
+ * @param xa_s              Metadata holder of (stored) extended attributes
+ * @param xa_a              Metadata holder of (actual) extended attributes
+ *
+ * @returns                 The file state of the file being processed
+ */
+static enum FileState file_state(int fd, xa_t *xa_s, xa_t *xa_a);
+
+/**
+ * Processes arguments (file names) either from command line or from directory
+ * output.
+ *
+ * @param fn                File name of the file
+ */
+static void process_argument(const char *fn);
+
+/**
+ * Processes directories if stated to do so (see arg.recursive) by looping
+ * through their content (children).
+ *
+ * @param fn                File name of the directory
+ */
+static void process_directory(const char *fn);
+
+/**
+ * Processes files and returns either error messages or other output if stated
+ * to do so (see arg.quiet) based on their file state (see enum FileState
+ * above).
+ *
+ * @param fn                File name of the file
+ */
+static void process_file(const char *fn);
+
+/**
+ * Reports on files and their file state.
+ *
+ * @param fn                File name of the file
+ * @param st                The state of the file
+ */
+static void report(const char *fn, enum FileState st);
+
+/**
+ * Compute and retrieve metadata for the checksum based on file content
+ * together with the date modified.
+ *
+ * @param fd                File descriptor of the file
+ * @param xa                Metadata holder of extended attributes
+ *
+ * @returns                 True if no error occurred
+ * @returns                 False if an error occurred
+ */
+static bool xa_compute(int fd, xa_t *xa);
+
+/**
+ * Computes the hash checksum of a file based on the SHA256 hashing algorithm.
+ *
+ * @param fd                File descriptor of the file
+ * @param cs                Pointer for the checksum
+ */
+static void xa_hash(int fd, char *cs);
+
+/**
+ * Reads and retrieves extended attributes as metadata from a file.
+ *
+ * @param fd                File descriptor of the file
+ * @param xa                Metadata holder of extended attributes
+ *
+ * @returns                 True if no error occurred
+ * @returns                 False if an error occurred (malformed data)
+ */
+static bool xa_read(int fd, xa_t *xa);
+
+/**
+ *  Writes, or removes if stated (see arg.remove), extended attributes as
+ *  metadata to a file.
+ *
+ * @param fd               File descriptor of the file
+ * @param xa                Metadata holder of extended attributes
+ *
+ * @returns                 True if no error occurred
+ * @returns                 False if an error occurred (write error)
+ */
+static bool xa_write(int fd, const xa_t *xa);
+
+#endif /* !ACST_H */
diff --git a/config.mk b/config.mk
@@ -0,0 +1,10 @@
+# acst version
+VERSION     = 0.1.1
+
+# paths
+PREFIX      = /usr/local
+MANPREFIX   = ${PREFIX}/share/man
+
+# flags
+CPPFLAGS    = -DVERSION=\"${VERSION}\" -D_DEFAULT_SOURCE
+CFLAGS      = -std=c99 -Wall -Wextra ${CPPFLAGS}
diff --git a/sha256.c b/sha256.c
@@ -0,0 +1,209 @@
+/*
+ * FIPS 180-2 SHA-224/256/384/512 implementation
+ * Last update: 02/02/2007
+ * Issue date:  04/30/2005
+ *
+ * Copyright (C) 2013, Con Kolivas <kernel@kolivas.org>
+ * Copyright (C) 2005, 2007 Olivier Gay <olivier.gay@a3.epfl.ch>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <string.h>
+#include <stdint.h>
+
+#include "sha256.h"
+
+#define UNPACK32(x, str)                      \
+{                                             \
+    *((str) + 3) = (uint8_t) ((x)      );       \
+    *((str) + 2) = (uint8_t) ((x) >>  8);       \
+    *((str) + 1) = (uint8_t) ((x) >> 16);       \
+    *((str) + 0) = (uint8_t) ((x) >> 24);       \
+}
+
+#define PACK32(str, x)                        \
+{                                             \
+    *(x) =   ((uint32_t) *((str) + 3)      )    \
+           | ((uint32_t) *((str) + 2) <<  8)    \
+           | ((uint32_t) *((str) + 1) << 16)    \
+           | ((uint32_t) *((str) + 0) << 24);   \
+}
+
+#define SHA256_SCR(i)                         \
+{                                             \
+    w[i] =  SHA256_F4(w[i -  2]) + w[i -  7]  \
+          + SHA256_F3(w[i - 15]) + w[i - 16]; \
+}
+
+uint32_t SHA256_h0[8] =
+            {0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a,
+             0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19};
+
+uint32_t SHA256_k[64] =
+            {0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
+             0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+             0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
+             0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+             0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
+             0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+             0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
+             0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+             0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
+             0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+             0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
+             0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+             0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
+             0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+             0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
+             0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2};
+
+/* SHA-256 functions */
+
+void SHA256_transf(SHA256_ctx *ctx, const unsigned char *message,
+                   unsigned int block_nb)
+{
+    uint32_t w[64];
+    uint32_t wv[8];
+    uint32_t t1, t2;
+    const unsigned char *sub_block;
+    int i;
+
+    int j;
+
+    for (i = 0; i < (int) block_nb; i++) {
+        sub_block = message + (i << 6);
+
+        for (j = 0; j < 16; j++) {
+            PACK32(&sub_block[j << 2], &w[j]);
+        }
+
+        for (j = 16; j < 64; j++) {
+            SHA256_SCR(j);
+        }
+
+        for (j = 0; j < 8; j++) {
+            wv[j] = ctx->h[j];
+        }
+
+        for (j = 0; j < 64; j++) {
+            t1 = wv[7] + SHA256_F2(wv[4]) + CH(wv[4], wv[5], wv[6])
+                + SHA256_k[j] + w[j];
+            t2 = SHA256_F1(wv[0]) + MAJ(wv[0], wv[1], wv[2]);
+            wv[7] = wv[6];
+            wv[6] = wv[5];
+            wv[5] = wv[4];
+            wv[4] = wv[3] + t1;
+            wv[3] = wv[2];
+            wv[2] = wv[1];
+            wv[1] = wv[0];
+            wv[0] = t1 + t2;
+        }
+
+        for (j = 0; j < 8; j++) {
+            ctx->h[j] += wv[j];
+        }
+    }
+}
+
+void SHA256(const unsigned char *message, unsigned int len, unsigned char *digest)
+{
+    SHA256_ctx ctx;
+
+    SHA256_init(&ctx);
+    SHA256_update(&ctx, message, len);
+    SHA256_final(&ctx, digest);
+}
+
+void SHA256_init(SHA256_ctx *ctx)
+{
+    int i;
+    for (i = 0; i < 8; i++) {
+        ctx->h[i] = SHA256_h0[i];
+    }
+
+    ctx->len = 0;
+    ctx->tot_len = 0;
+}
+
+void SHA256_update(SHA256_ctx *ctx, const unsigned char *message,
+                   unsigned int len)
+{
+    unsigned int block_nb;
+    unsigned int new_len, rem_len, tmp_len;
+    const unsigned char *shifted_message;
+
+    tmp_len = SHA256_BLOCK_SIZE - ctx->len;
+    rem_len = len < tmp_len ? len : tmp_len;
+
+    memcpy(&ctx->block[ctx->len], message, rem_len);
+
+    if (ctx->len + len < SHA256_BLOCK_SIZE) {
+        ctx->len += len;
+        return;
+    }
+
+    new_len = len - rem_len;
+    block_nb = new_len / SHA256_BLOCK_SIZE;
+
+    shifted_message = message + rem_len;
+
+    SHA256_transf(ctx, ctx->block, 1);
+    SHA256_transf(ctx, shifted_message, block_nb);
+
+    rem_len = new_len % SHA256_BLOCK_SIZE;
+
+    memcpy(ctx->block, &shifted_message[block_nb << 6],
+           rem_len);
+
+    ctx->len = rem_len;
+    ctx->tot_len += (block_nb + 1) << 6;
+}
+
+void SHA256_final(SHA256_ctx *ctx, unsigned char *digest)
+{
+    unsigned int block_nb;
+    unsigned int pm_len;
+    unsigned int len_b;
+
+    int i;
+
+    block_nb = (1 + ((SHA256_BLOCK_SIZE - 9)
+                     < (ctx->len % SHA256_BLOCK_SIZE)));
+
+    len_b = (ctx->tot_len + ctx->len) << 3;
+    pm_len = block_nb << 6;
+
+    memset(ctx->block + ctx->len, 0, pm_len - ctx->len);
+    ctx->block[ctx->len] = 0x80;
+    UNPACK32(len_b, ctx->block + pm_len - 4);
+
+    SHA256_transf(ctx, ctx->block, block_nb);
+
+    for (i = 0 ; i < 8; i++) {
+        UNPACK32(ctx->h[i], &digest[i << 2]);
+    }
+}
diff --git a/sha256.h b/sha256.h
@@ -0,0 +1,69 @@
+/*
+ * FIPS 180-2 SHA-224/256/384/512 implementation
+ * Last update: 02/02/2007
+ * Issue date:  04/30/2005
+ *
+ * Copyright (C) 2013, Con Kolivas <kernel@kolivas.org>
+ * Copyright (C) 2005, 2007 Olivier Gay <olivier.gay@a3.epfl.ch>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <stdint.h>
+
+#ifndef SHA2_H
+#define SHA2_H
+
+#define SHA256_DIGEST_SIZE ( 256 / 8)
+#define SHA256_BLOCK_SIZE  ( 512 / 8)
+
+#define SHFR(x, n)    (x >> n)
+#define ROTR(x, n)   ((x >> n) | (x << ((sizeof(x) << 3) - n)))
+#define CH(x, y, z)  ((x & y) ^ (~x & z))
+#define MAJ(x, y, z) ((x & y) ^ (x & z) ^ (y & z))
+
+#define SHA256_F1(x) (ROTR(x,  2) ^ ROTR(x, 13) ^ ROTR(x, 22))
+#define SHA256_F2(x) (ROTR(x,  6) ^ ROTR(x, 11) ^ ROTR(x, 25))
+#define SHA256_F3(x) (ROTR(x,  7) ^ ROTR(x, 18) ^ SHFR(x,  3))
+#define SHA256_F4(x) (ROTR(x, 17) ^ ROTR(x, 19) ^ SHFR(x, 10))
+
+typedef struct {
+    unsigned int tot_len;
+    unsigned int len;
+    unsigned char block[2 * SHA256_BLOCK_SIZE];
+    uint32_t h[8];
+} SHA256_ctx;
+
+extern uint32_t SHA256_k[64];
+
+void SHA256_init(SHA256_ctx * ctx);
+void SHA256_update(SHA256_ctx *ctx, const unsigned char *message,
+                   unsigned int len);
+void SHA256_final(SHA256_ctx *ctx, unsigned char *digest);
+void SHA256(const unsigned char *message, unsigned int len,
+            unsigned char *digest);
+
+#endif /* !SHA2_H */
diff --git a/test b/test
@@ -0,0 +1,329 @@
+#!/bin/sh
+
+set -eu
+
+PRG="acst"
+
+cleanup() {
+	_RES=$?
+	[ $_RES -ne 0 ] && echo "\033[5;31m*** FAILED WITH CODE $_RES ***\033[0m"
+
+	cd ..
+	rm -rf "$TMPFILE"
+}
+
+fattr() {
+	if [ "$1" = "set" ] && command -v getfattr > /dev/null 2>&1; then
+		setfattr -n "$2" -v "$3" "$4"
+	elif [ "$1" = "get" ] && command -v getfattr > /dev/null 2>&1; then
+		getfattr -n "$2" "$3" -e hex
+	else
+		exit 1
+	fi
+}
+
+get_cs() {
+	fattr "get" "user.acst.cs" "$1"
+}
+
+set_cs() {
+	fattr "set" "user.acst.cs" "0x$1" "$2"
+}
+
+set_ts() {
+	fattr "set" "user.acst.ts" "$1" "$2"
+}
+
+TESTCNT=0
+header() {
+	printf 'test %02d: %s\n' "$((TESTCNT+=1))" "$1"
+}
+
+cd "$(dirname "$0")"
+TMPFILE="$(mktemp -d XXXXXXXXXX)" && {
+	cd "$TMPFILE"
+	trap cleanup EXIT
+
+	#########################################################################
+	header 'new empty file'
+	cat > expected <<- EOF
+	<new> object
+	 stored: 0000000000000000000000000000000000000000000000000000000000000000 0000000000.000000000
+	 actual: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 1592776800.000000000
+	EOF
+	TZ=CET touch -t 202006220000 object
+	../"${PRG}" object > output
+	diff -u expected output
+
+	echo "<ok> object" > expected
+	../"${PRG}" object > output
+	diff -u expected output
+
+	#########################################################################
+	header 'outdated file'
+	cat > expected <<- EOF
+	<outdated> object
+	 stored: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 1592776800.000000000
+	 actual: 7f8b1dfc466b6249f06cbe55c9174df2578e7754da793fded244ef5cba2a38f1 1655848800.000000000
+	EOF
+	echo changed > object
+	TZ=CET touch -t 202206220000 object
+	../"${PRG}" object > output
+	diff -u expected output
+
+	#########################################################################
+	header 'touched file'
+	cat > expected <<- EOF
+	<hash ok> object
+	 stored: 7c34ee8c3de68a60833ad48675da46483dc2c7b1cb42333fd6a528a93a39f652 1592776800.000000000
+	 actual: 7c34ee8c3de68a60833ad48675da46483dc2c7b1cb42333fd6a528a93a39f652 1655848800.000000000
+	EOF
+	rm -f object
+	echo touched > object
+	TZ=CET touch -t 202006220000 object
+	../"${PRG}" object > /dev/null
+	TZ=CET touch -t 202206220000 object
+	../"${PRG}" object > output
+	diff -u expected output
+
+	#########################################################################
+	header 'modified empty file'
+	echo > object
+	../"${PRG}" object > /dev/null
+	../"${PRG}" object > /dev/null
+
+	#########################################################################
+	header 'new 100 zero file'
+	cat > expected <<- EOF
+	<new> object
+	 stored: 0000000000000000000000000000000000000000000000000000000000000000 0000000000.000000000
+	 actual: 134e6543ddc35b40abb4f2f8aaaa2d0513a27e267beaf9081e29d84eba94017d 1655848800.000000000
+	EOF
+	rm -f object
+	printf '%0.s0' $(seq 1 100) > object
+	TZ=CET touch -t 202206220000 object
+	../"${PRG}" object > output
+	diff -u expected output
+
+	echo "<ok> object" > expected
+	../"${PRG}" object > output
+	diff -u expected output
+
+	#########################################################################
+	header 'attribute with appended NULL byte'
+	rm -f object
+	TZ=CET touch -t 202206220000 object
+	set_ts "1655848800.000000000" "object"
+	set_cs "6533623063343432393866633163313439616662663463383939366662393234323761653431653436343962393334636134393539393162373835326238353500" "object"
+	echo "<ok> object" > expected
+	../"${PRG}" object > output
+	diff -u expected output
+
+	#########################################################################
+	header 'attribute without appended NULL byte'
+	rm -f object
+	TZ=CET touch -t 202206220000 object
+	set_ts "1655848800.000000000" "object"
+	set_cs "65336230633434323938666331633134396166626634633839393666623932343237616534316534363439623933346361343935393931623738353262383535" "object"
+	echo "<ok> object" > expected
+	../"${PRG}" object > output
+	diff -u expected output
+
+	#########################################################################
+	header 'backdated file should persistently be flagged'
+	cat > expected <<- EOF
+	<backdated> object
+	 stored: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 1655848800.000000000
+	 actual: d201858e7b45213e25f68d54255aa9337e77ab082fe023af25d49d4199db004f 1561154400.000000000
+	EOF
+	echo "backdated" > object
+	TZ=CET touch -t 201906220000 object
+	for i in $(seq 2); do
+		set +e
+		../"${PRG}" object 2>/dev/null > output
+		if [ $? -eq 0 ]; then
+			echo "should have returned an error code, but returned 0"
+			exit 1
+		fi
+		set -e
+		diff -u expected output
+	done
+
+	#########################################################################
+	header 'corrupt file should persistently be flagged'
+	cat > expected <<- EOF
+	<corrupt> object
+	 stored: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 1655848800.000000000
+	 actual: 06d0083ba740ff26c91cb17f10d15d398eea1affd3112599b429f30452b59db4 1655848800.000000000
+	EOF
+	echo "corrupt" > object
+	TZ=CET touch -t 202206220000 object
+	for i in $(seq 2); do
+		set +e
+		../"${PRG}" object 2>/dev/null > output
+		if [ $? -eq 0 ]; then
+			echo "should have returned an error code, but returned 0"
+			exit 1
+		fi
+		set -e
+		diff -u expected output
+	done
+
+	#########################################################################
+	header 'file with malformed attributes should persistently be flagged'
+	echo "<malformed> object" > expected
+	echo "malformed" > object
+	set_cs "37323331375834333239653339623737323834366566373335386565666565386438353639626161383962316630366461363632373638336536323136353364" object
+	for i in $(seq 2); do
+		set +e
+		../"${PRG}" object 2>/dev/null > output
+		if [ $? -eq 0 ]; then
+			echo "should have returned an error code, but returned 0"
+			exit 1
+		fi
+		set -e
+		diff -u expected output
+	done
+
+	#########################################################################
+	header 'uppercase checksum should be changed to lowercase'
+	cat > expected <<- EOF
+	<outdated> object
+	 stored: 72317e4329e39b772846ef7358eefee8d8569baa89b1f06da6627683e621653d 1624320000.000000000
+	 actual: a6657f91652abf6d193fc9944c3e999d9aebfe5b33ebf3f733be673576f7af03 1655848800.000000000
+	EOF
+	echo "uppercase" > object
+	TZ=CET touch -t 202206220000 object
+	set_ts "1624320000.000000000" "object"
+	set_cs "37323331374534333239453339423737323834364546373335384545464545384438353639424141383942314630364441363632373638334536323136353344" object
+	../"${PRG}" object > output
+	diff -u expected output
+
+	#########################################################################
+	header 'removal of extended attributes'
+	cat > expected <<- EOF
+	<new> object
+	 stored: 0000000000000000000000000000000000000000000000000000000000000000 0000000000.000000000
+	 actual: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 1655848800.000000000
+	EOF
+	rm -f object
+	TZ=CET touch -t 202206220000 object
+	../"${PRG}" object > output
+	diff -u expected output
+	echo "<xattr removed> object" > expected
+	../"${PRG}" -x object > output
+	diff -u expected output
+	echo "Error: could not remove extended attributes from file \"object\": No data available" > expected
+	set +e
+	../"${PRG}" -x object > output 2>&1
+	if [ $? -eq 0 ]; then
+		echo "should have returned an error code, but returned 0"
+		exit 1
+	fi
+	set -e
+	diff -u expected output
+
+	#########################################################################
+	header 'nonexisting file'
+	set +e
+	echo "Error: could not open file \"nonexisting\"" > expected
+	../"${PRG}" nonexisting > output 2>&1
+	if [ $? -ne 2 ]; then
+		echo "should have returned an error code 2, but returned 0"
+		exit 1
+	fi
+	set -e
+	diff -u expected output
+
+	#########################################################################
+	header 'symlink'
+	ln -s object symlink
+	set +e
+	echo "Error: not a regular file \"symlink\"" > expected
+	../"${PRG}" symlink > output 2>&1
+	if [ $? -ne 3 ]; then
+		echo "should have returned an error code 3, but returned 0"
+		exit 1
+	fi
+	set -e
+	diff -u expected output
+	rm -f symlink
+
+	#########################################################################
+	header 'recursion'
+	rm -f object
+	mkdir -p object/level-1/level-2/level-3
+	TZ=CET touch -t 202206220001 object/level-1/file-1
+	TZ=CET touch -t 202206220002 object/level-1/level-2/file-2
+	TZ=CET touch -t 202206220003 object/level-1/level-2/level-3/file-3
+	set +e
+	echo "Error: path is a directory, did you mean to use the -r option? \"object\"" > expected
+	../"${PRG}" object > output 2>&1
+	if [ $? -ne 3 ]; then
+		echo "should have returned error code 3, but returned 0"
+		exit 1
+	fi
+	set -e
+	diff -u expected output
+	cat > expected <<- EOF
+	<new> object/level-1/file-1
+	 stored: 0000000000000000000000000000000000000000000000000000000000000000 0000000000.000000000
+	 actual: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 1655848860.000000000
+	<new> object/level-1/level-2/file-2
+	 stored: 0000000000000000000000000000000000000000000000000000000000000000 0000000000.000000000
+	 actual: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 1655848920.000000000
+	<new> object/level-1/level-2/level-3/file-3
+	 stored: 0000000000000000000000000000000000000000000000000000000000000000 0000000000.000000000
+	 actual: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 1655848980.000000000
+	EOF
+	../"${PRG}" -r object > output
+	diff -u expected output
+	rm -rf object
+
+	#########################################################################
+	header 'multiple files'
+	cat > expected <<- EOF
+	<new> object/level-1/file-1
+	 stored: 0000000000000000000000000000000000000000000000000000000000000000 0000000000.000000000
+	 actual: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 1655848860.000000000
+	<new> object/level-1/level-2/file-2
+	 stored: 0000000000000000000000000000000000000000000000000000000000000000 0000000000.000000000
+	 actual: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 1655848920.000000000
+	<new> object/level-1/level-2/level-3/file-3
+	 stored: 0000000000000000000000000000000000000000000000000000000000000000 0000000000.000000000
+	 actual: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 1655848980.000000000
+	EOF
+	rm -f object
+	mkdir -p object/level-1/level-2/level-3
+	TZ=CET touch -t 202206220001 object/level-1/file-1
+	TZ=CET touch -t 202206220002 object/level-1/level-2/file-2
+	TZ=CET touch -t 202206220003 object/level-1/level-2/level-3/file-3
+	find object -xdev -type f -print0 | xargs -r0 ../"${PRG}" > output
+	diff -u expected output
+	rm -rf object
+
+	#########################################################################
+	header 'dry run'
+	cat > expected <<- EOF
+	<new> object
+	 stored: 0000000000000000000000000000000000000000000000000000000000000000 0000000000.000000000
+	 actual: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 1655848800.000000000
+	EOF
+	TZ=CET touch -t 202206220000 object
+	../"${PRG}" -n object > output
+	diff -u expected output
+	../"${PRG}" object > output
+	diff -u expected output
+
+	#########################################################################
+	header 'dry run removal'
+	echo "<xattr removed> object" > expected
+	../"${PRG}" -xn object > output
+	diff -u expected output
+	../"${PRG}" -x object > output
+	diff -u expected output
+
+
+	#########################################################################
+	echo "\033[5;32m*** ALL TESTS WERE PASSED SUCCESSFULLY ***\033[0m"
+}