Publish binary from main instead of discarding (#618 )

chore: improve findutils maintenance path (#687 )
fix: avoid panic on -fprintf with missing arguments (#698 )
2026-06-10 15:48:30 -07:00 · 2026-06-04 22:34:18 +02:00 · 2026-06-04 21:28:34 +02:00 · 2026-06-05 02:41:58 +08:00 · 2026-06-04 20:31:54 +02:00 · 2026-06-01 08:32:49 +02:00
32 changed files with 3586 additions and 2513 deletions
@@ -0,0 +1,15 @@
+name: Security audit
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - uses: rustsec/audit-check@v2
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
@@ -2,6 +2,9 @@ on: [push, pull_request]

 name: Basic CI

+env:
+  CARGO_INCREMENTAL: "0"
+
 jobs:
  check:
    name: cargo check
@@ -10,13 +13,7 @@ jobs:
      matrix:
        os: [ubuntu-latest, macOS-latest, windows-latest]
    steps:
-      - uses: actions/checkout@v4
-      - name: Install `rust` toolchain
-        run: |
-          ## Install `rust` toolchain
-          rustup toolchain install stable --no-self-update -c rustfmt --profile minimal
-          rustup default stable
-
+      - uses: actions/checkout@v6
      # For bindgen: https://github.com/rust-lang/rust-bindgen/issues/1797
      - uses: KyleMayes/install-llvm-action@v2
        if: matrix.os == 'windows-latest'
@@ -37,13 +34,7 @@ jobs:
      matrix:
        os: [ubuntu-latest, macOS-latest, windows-latest]
    steps:
-      - uses: actions/checkout@v4
-      - name: Install `rust` toolchain
-        run: |
-          ## Install `rust` toolchain
-          rustup toolchain install stable --no-self-update -c rustfmt --profile minimal
-          rustup default stable
-
+      - uses: actions/checkout@v6
      # For bindgen: https://github.com/rust-lang/rust-bindgen/issues/1797
      - uses: KyleMayes/install-llvm-action@v2
        if: matrix.os == 'windows-latest'
@@ -61,14 +52,7 @@ jobs:
    name: cargo fmt --all -- --check
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
-      - name: Install `rust` toolchain
-        run: |
-          ## Install `rust` toolchain
-          rustup toolchain install stable --no-self-update -c rustfmt --profile minimal
-          rustup default stable
-
-      - run: rustup component add rustfmt
+      - uses: actions/checkout@v6
      - name: cargo fmt
        run: |
          cargo fmt --all -- --check
@@ -77,15 +61,8 @@ jobs:
    name: cargo clippy -- -D warnings
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@v4
-      - name: Install `rust` toolchain
-        run: |
-          ## Install `rust` toolchain
-          rustup toolchain install stable --no-self-update -c rustfmt --profile minimal
-          rustup default stable
-      - run: rustup component add clippy
-      - name: cargo clippy
-        run: |
+      - uses: actions/checkout@v6
+      - run: |
          cargo clippy --all-targets -- -D warnings

  grcov:
@@ -95,32 +72,27 @@ jobs:
      matrix:
        os:
          - ubuntu-latest
-        toolchain:
-          - nightly
        cargo_flags:
          - "--all-features"
    steps:
      - name: Checkout source code
-        uses: actions/checkout@v4
-
-      - name: Install `rust` toolchain
-        run: |
-          rustup toolchain install nightly --no-self-update -c rustfmt --profile minimal
-          rustup default nightly
-
+        uses: actions/checkout@v6
      - name: Install cargo-llvm-cov
        uses: taiki-e/install-action@cargo-llvm-cov
      - name: Generate code coverage
-        run: cargo llvm-cov --all-features --lcov --branch --output-path lcov.info
+        env:
+          RUSTC_BOOTSTRAP: 1
+        run: |
+          cargo llvm-cov --all-features --lcov --branch --output-path lcov.info

      - name: Upload coverage as artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: lcov.info
          path: lcov.info

      - name: Upload coverage to codecov.io
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
        with:
          files: lcov.info
          fail_ci_if_error: true
@@ -18,7 +18,7 @@ jobs:

    steps:
      - name: List Annotations
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
        with:
          script: |
            let artifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -46,7 +46,7 @@ jobs:
      - run: unzip comment.zip

      - name: Comment on PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
@@ -1,21 +1,23 @@
 on: [push, pull_request]

 name: External-testsuites
-
+env:
+  CARGO_INCREMENTAL: "0"
 jobs:
  gnu-tests:
    permissions:
      actions: read
+      contents: write # Publish binaries instead of discarding

    name: Run GNU findutils tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout findutils
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          path: findutils
      - name: Checkout GNU findutils
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: gnu-mirror-unofficial/findutils
          path: findutils.gnu
@@ -29,11 +31,6 @@ jobs:
          git config submodule.gnulib.url https://github.com/coreutils/gnulib.git
          git submodule update --init --recursive --depth 1
        working-directory: findutils.gnu
-      - name: Install `rust` toolchain
-        run: |
-          ## Install `rust` toolchain
-          rustup toolchain install stable --no-self-update -c rustfmt --profile minimal
-          rustup default stable
      - name: Install dependencies
        shell: bash
        run: |
@@ -46,12 +43,27 @@ jobs:
        run: |
          cd findutils
          bash util/build-gnu.sh ||:
+          install --strip -Dm755 target/release/{find,xargs} -t findutils-x86_64-unknown-linux-gnu
+          ZSTD_CLEVEL=19 tar --zstd -caf ../findutils-x86_64-unknown-linux-gnu.tar.zst findutils-x86_64-unknown-linux-gnu
+      - name: Publish latest commit
+        uses: softprops/action-gh-release@v2
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        with:
+          tag_name: latest-commit
+          body: |
+            commit: ${{ github.sha }}
+          draft: false
+          prerelease: true
+          files: |
+            findutils-x86_64-unknown-linux-gnu.tar.zst
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract testing info
        shell: bash
        run: |

      - name: Upload gnu-test-report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: gnu-test-report
          path: |
@@ -59,12 +71,12 @@ jobs:
            findutils.gnu/xargs/testsuite/*.log
            findutils.gnu/tests/**/*.log
      - name: Upload gnu-result
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: gnu-result
          path: gnu-result.json
      - name: Download artifacts (gnu-result and gnu-test-report)
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
        with:
          script: |
            let fs = require('fs');
@@ -117,20 +129,15 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout findutils
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          path: findutils
      - name: Checkout BFS
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
        with:
          repository: tavianator/bfs
          path: bfs
          ref: "4.0"
-      - name: Install `rust` toolchain
-        run: |
-          ## Install `rust` toolchain
-          rustup toolchain install stable --no-self-update -c rustfmt --profile minimal
-          rustup default stable
      - name: Install dependencies
        shell: bash
        run: |
@@ -142,19 +149,20 @@ jobs:
        shell: bash
        run: |
          cd findutils
+          export CARGO_INCREMENTAL=0
          bash util/build-bfs.sh ||:
      - name: Upload bfs-test-report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: bfs-test-report
          path: bfs/tests.log
      - name: Upload bfs-result
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: bfs-result
          path: bfs-result.json
      - name: Download artifacts (gnu-result and bfs-test-report)
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9
        with:
          script: |
            let fs = require('fs');
@@ -209,7 +217,7 @@ jobs:

    steps:
      - name: List Annotations
-        uses: actions/github-script@v7
+        uses: actions/github-script@v9

        with:
          script: |
@@ -247,7 +255,7 @@ jobs:
            fs.writeFileSync('${{ github.workspace }}/annotations.json', JSON.stringify(annotations));

      - name: Upload annotations
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: comment
          path: annotations.json
@@ -47,7 +47,7 @@ on:
 jobs:
  # Run 'dist plan' (or host) to determine what tasks we need to do
  plan:
-    runs-on: "ubuntu-20.04"
+    runs-on: "ubuntu-latest"
    outputs:
      val: ${{ steps.plan.outputs.manifest }}
      tag: ${{ !github.event.pull_request && github.ref_name || '' }}
@@ -56,7 +56,7 @@ jobs:
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          submodules: recursive
      - name: Install dist
@@ -65,7 +65,7 @@ jobs:
        shell: bash
        run: "curl --proto '=https' --tlsv1.2 -LsSf https://github.com/axodotdev/cargo-dist/releases/download/v0.28.0/cargo-dist-installer.sh | sh"
      - name: Cache dist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: cargo-dist-cache
          path: ~/.cargo/bin/dist
@@ -81,7 +81,7 @@ jobs:
          cat plan-dist-manifest.json
          echo "manifest=$(jq -c "." plan-dist-manifest.json)" >> "$GITHUB_OUTPUT"
      - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: artifacts-plan-dist-manifest
          path: plan-dist-manifest.json
@@ -115,7 +115,7 @@ jobs:
      - name: enable windows longpaths
        run: |
          git config --global core.longpaths true
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          submodules: recursive
      - name: Install Rust non-interactively if not already installed
@@ -129,7 +129,7 @@ jobs:
        run: ${{ matrix.install_dist.run }}
      # Get the dist-manifest
      - name: Fetch local artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          pattern: artifacts-*
          path: target/distrib/
@@ -156,7 +156,7 @@ jobs:

          cp dist-manifest.json "$BUILD_MANIFEST_NAME"
      - name: "Upload artifacts"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: artifacts-build-local-${{ join(matrix.targets, '_') }}
          path: |
@@ -168,23 +168,23 @@ jobs:
    needs:
      - plan
      - build-local-artifacts
-    runs-on: "ubuntu-20.04"
+    runs-on: "ubuntu-latest"
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      BUILD_MANIFEST_NAME: target/distrib/global-dist-manifest.json
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          submodules: recursive
      - name: Install cached dist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: cargo-dist-cache
          path: ~/.cargo/bin/
      - run: chmod +x ~/.cargo/bin/dist
      # Get all the local artifacts for the global tasks to use (for e.g. checksums)
      - name: Fetch local artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          pattern: artifacts-*
          path: target/distrib/
@@ -202,7 +202,7 @@ jobs:

          cp dist-manifest.json "$BUILD_MANIFEST_NAME"
      - name: "Upload artifacts"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          name: artifacts-build-global
          path: |
@@ -218,22 +218,22 @@ jobs:
    if: ${{ always() && needs.plan.outputs.publishing == 'true' && (needs.build-global-artifacts.result == 'skipped' || needs.build-global-artifacts.result == 'success') && (needs.build-local-artifacts.result == 'skipped' || needs.build-local-artifacts.result == 'success') }}
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    runs-on: "ubuntu-20.04"
+    runs-on: "ubuntu-latest"
    outputs:
      val: ${{ steps.host.outputs.manifest }}
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          submodules: recursive
      - name: Install cached dist
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          name: cargo-dist-cache
          path: ~/.cargo/bin/
      - run: chmod +x ~/.cargo/bin/dist
      # Fetch artifacts from scratch-storage
      - name: Fetch artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          pattern: artifacts-*
          path: target/distrib/
@@ -246,14 +246,14 @@ jobs:
          cat dist-manifest.json
          echo "manifest=$(jq -c "." dist-manifest.json)" >> "$GITHUB_OUTPUT"
      - name: "Upload dist-manifest.json"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
        with:
          # Overwrite the previous copy
          name: artifacts-dist-manifest
          path: dist-manifest.json
      # Create a GitHub Release while uploading all files to it
      - name: "Download GitHub Artifacts"
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
        with:
          pattern: artifacts-*
          path: artifacts
@@ -282,10 +282,10 @@ jobs:
    # still allowing individual publish jobs to skip themselves (for prereleases).
    # "host" however must run to completion, no skipping allowed!
    if: ${{ always() && needs.host.result == 'success' }}
-    runs-on: "ubuntu-20.04"
+    runs-on: "ubuntu-latest"
    env:
      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
        with:
          submodules: recursive
@@ -15,3 +15,5 @@ repos:
        pass_filenames: false
        types: [file, rust]
        language: system
+ci:
+  skip: [rust-linting, rust-clippy]
@@ -11,6 +11,8 @@ check out these documents:
 - Our community's [CODE_OF_CONDUCT.md](./CODE_OF_CONDUCT.md).
 - [DEVELOPMENT.md](./DEVELOPMENT.md) for setting up your development
  environment.
+- Our [Review Guidelines](https://uutils.github.io/reviews/) for what we expect
+  from a pull request and how reviews are done.

 Now follows a very important warning:

@@ -180,7 +182,7 @@ To ensure easy collaboration, we have guidelines for using Git and GitHub.
 ### Commit messages

 You can read this section in the Git book to learn how to write good commit
-messages: https://git-scm.com/book/ch5-2.html.
+messages: https://git-scm.com/book/en/v2/Distributed-Git-Contributing-to-a-Project.

 In addition, here are a few examples for a summary line when committing to
 uutils:
@@ -231,10 +233,6 @@ you contribute must at least compile without warnings for all platforms in the
 CI. However, you can use `#[cfg(...)]` attributes to create platform dependent
 features.

-**Tip:** For Windows, Microsoft provides some images (VMWare, Hyper-V,
-VirtualBox and Parallels) for development:
-<https://developer.microsoft.com/windows/downloads/virtual-machines/>
-
 ## Licensing

 uutils is distributed under the terms of the MIT License; see the `LICENSE` file
@@ -10,24 +10,22 @@ description = "Rust implementation of GNU findutils"
 authors = ["uutils developers"]

 [dependencies]
-chrono = "0.4.40"
-clap = "4.5"
+argmax = "0.4.0"
+chrono = "0.4.44"
+clap = "4.6"
 faccess = "0.2.4"
+nix = { version = "0.31", features = ["fs", "user"] }
+onig = { version = "6.5", default-features = false }
+regex = "1.12"
+uucore = { version = "0.9.0", features = ["entries", "fs", "fsext", "mode"] }
 walkdir = "2.5"
-regex = "1.11"
-onig = { version = "6.4", default-features = false }
-uucore = { version = "0.0.30", features = ["entries", "fs", "fsext", "mode"] }
-nix = { version = "0.29", features = ["fs", "user"] }
-argmax = "0.3.1"

 [dev-dependencies]
-assert_cmd = "2"
+ctor = "1.0"
 filetime = "0.2"
-nix = { version = "0.29", features = ["fs"] }
-predicates = "3"
-serial_test = "3.2"
+nix = { version = "0.31", features = ["fs"] }
 tempfile = "3"
-pretty_assertions = "1.4.1"
+uutests = "0.9.0"

 [[bin]]
 name = "find"
@@ -41,11 +39,13 @@ path = "src/xargs/main.rs"
 name = "testing-commandline"
 path = "src/testing/commandline/main.rs"

-# The profile that 'cargo dist' will build with
-[profile.dist]
-inherits = "release"
+[profile.release]
 lto = "thin"
+codegen-units = 1

+[profile.release-fast]
+inherits = "release"
+panic = "abort"

 [lints.clippy]
 multiple_crate_versions = "allow"
@@ -20,8 +20,8 @@ bash util/build-gnu.sh tests/misc/help-version.sh

 ## Comparing with GNU

-![Evolution over time - GNU testsuite](https://github.com/uutils/findutils-tracking/blob/main/gnu-results.png?raw=true)
-![Evolution over time - BFS testsuite](https://github.com/uutils/findutils-tracking/blob/main/bfs-results.png?raw=true)
+![Evolution over time - GNU testsuite](https://github.com/uutils/findutils-tracking/blob/main/gnu-results.svg?raw=true)
+![Evolution over time - BFS testsuite](https://github.com/uutils/findutils-tracking/blob/main/bfs-results.svg?raw=true)

 ## Build/run with BFS

@@ -0,0 +1,44 @@
+# Security Policy
+
+## Supported Versions
+
+We provide security updates only for the latest released version of `uutils/findutils`.
+Older versions may not receive patches.
+If you are using a version packaged by your Linux distribution, please check with your distribution maintainers for their update policy.
+
+---
+
+## Reporting a Vulnerability
+
+**Do not open public GitHub issues for security vulnerabilities.**
+This prevents accidental disclosure before a fix is available.
+
+Instead, please use the following method:
+
+- **Email:** [sylvestre@debian.org](mailto:Sylvestre@debian.org)
+- **Encryption (optional):** You may encrypt your report using our PGP key:
+Fingerprint: B60D B599 4D39 BEC4 D1A9 5CCF 7E65 28DA 752F 1BE1
+---
+
+### What to Include in Your Report
+
+To help us investigate and resolve the issue quickly, please include as much detail as possible:
+
+- **Type of issue:** e.g. privilege escalation, information disclosure.
+- **Location in the source:** file path, commit hash, branch, or tag.
+- **Steps to reproduce:** exact commands, test cases, or scripts.
+- **Special configuration:** any flags, environment variables, or system setup required.
+- **Affected systems:** OS/distribution and version(s) where the issue occurs.
+- **Impact:** your assessment of the potential severity (DoS, RCE, data leak, etc.).
+
+---
+
+## Disclosure Policy
+
+We follow a **Coordinated Vulnerability Disclosure (CVD)** process:
+
+1. We will acknowledge receipt of your report within **10 days**.
+2. We will investigate, reproduce, and assess the issue.
+3. We will provide a timeline for developing and releasing a fix.
+4. Once a fix is available, we will publish a GitHub Security Advisory.
+5. You will be credited in the advisory unless you request anonymity.
@@ -17,3 +17,8 @@ pr-run-mode = "plan"
 install-path = "CARGO_HOME"
 # Whether to install an updater program
 install-updater = false
+# Ignore out-of-date contents
+allow-dirty = ["ci"]
+
+[dist.github-custom-runners]
+x86_64-unknown-linux-gnu = "ubuntu-latest"
@@ -62,6 +62,8 @@ mod tests {
    use super::*;
    use crate::find::matchers::tests::get_dir_entry_for;
    use crate::find::tests::FakeDependencies;
+    #[cfg(unix)]
+    use std::os::unix::fs::PermissionsExt;

    #[test]
    fn empty_files() {
@@ -96,4 +98,73 @@ mod tests {
        let file_info = get_dir_entry_for(&temp_dir_path, subdir_name);
        assert!(!matcher.matches(&file_info, &mut deps.new_matcher_io()));
    }
+
+    #[test]
+    fn empty_file_vs_empty_directory() {
+        let empty_file_info = get_dir_entry_for("test_data/simple", "abbbc");
+
+        let temp_dir = Builder::new()
+            .prefix("empty_file_vs_empty_directory")
+            .tempdir()
+            .unwrap();
+        let temp_dir_path = temp_dir.path().to_string_lossy();
+        let subdir_name = "empty_subdir";
+        std::fs::create_dir(temp_dir.path().join(subdir_name)).unwrap();
+
+        let matcher = EmptyMatcher::new();
+        let deps = FakeDependencies::new();
+
+        // Both an empty file and an empty directory should match.
+        assert!(
+            matcher.matches(&empty_file_info, &mut deps.new_matcher_io()),
+            "empty file should match"
+        );
+        let empty_dir_info = get_dir_entry_for(&temp_dir_path, subdir_name);
+        assert!(
+            matcher.matches(&empty_dir_info, &mut deps.new_matcher_io()),
+            "empty directory should match"
+        );
+    }
+
+    #[test]
+    #[cfg(unix)]
+    fn non_readable_directory() {
+        let temp_dir = Builder::new()
+            .prefix("non_readable_directory")
+            .tempdir()
+            .unwrap();
+        let temp_dir_path = temp_dir.path().to_string_lossy();
+        let subdir_name = "unreadable";
+        std::fs::create_dir(temp_dir.path().join(subdir_name)).unwrap();
+
+        let mut perms = std::fs::metadata(temp_dir.path().join(subdir_name))
+            .unwrap()
+            .permissions();
+        perms.set_mode(0o000);
+        std::fs::set_permissions(temp_dir.path().join(subdir_name), perms).unwrap();
+
+        // If we can still read the directory, we're likely running as root.
+        if std::fs::read_dir(temp_dir.path().join(subdir_name)).is_ok() {
+            // Restore permissions before skipping.
+            let mut perms = std::fs::metadata(temp_dir.path().join(subdir_name))
+                .unwrap()
+                .permissions();
+            perms.set_mode(0o755);
+            std::fs::set_permissions(temp_dir.path().join(subdir_name), perms).unwrap();
+            return;
+        }
+
+        let matcher = EmptyMatcher::new();
+        let deps = FakeDependencies::new();
+
+        let file_info = get_dir_entry_for(&temp_dir_path, subdir_name);
+        assert!(!matcher.matches(&file_info, &mut deps.new_matcher_io()));
+
+        // Restore permissions so tempdir can be cleaned up.
+        let mut perms = std::fs::metadata(temp_dir.path().join(subdir_name))
+            .unwrap()
+            .permissions();
+        perms.set_mode(0o755);
+        std::fs::set_permissions(temp_dir.path().join(subdir_name), perms).unwrap();
+    }
 }
@@ -24,7 +24,7 @@ enum Entry {
 }

 /// File types.
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Hash)]
 pub enum FileType {
    Unknown,
    Fifo,
@@ -22,6 +22,7 @@ pub struct SingleExecMatcher {
    executable: String,
    args: Vec<Arg>,
    exec_in_parent_dir: bool,
+    interactive: bool,
 }

 impl SingleExecMatcher {
@@ -29,6 +30,23 @@ impl SingleExecMatcher {
        executable: &str,
        args: &[&str],
        exec_in_parent_dir: bool,
+    ) -> Result<Self, Box<dyn Error>> {
+        Self::new_impl(executable, args, exec_in_parent_dir, false)
+    }
+
+    pub fn new_interactive(
+        executable: &str,
+        args: &[&str],
+        exec_in_parent_dir: bool,
+    ) -> Result<Self, Box<dyn Error>> {
+        Self::new_impl(executable, args, exec_in_parent_dir, true)
+    }
+
+    fn new_impl(
+        executable: &str,
+        args: &[&str],
+        exec_in_parent_dir: bool,
+        interactive: bool,
    ) -> Result<Self, Box<dyn Error>> {
        let transformed_args = args
            .iter()
@@ -47,13 +65,13 @@ impl SingleExecMatcher {
            executable: executable.to_string(),
            args: transformed_args,
            exec_in_parent_dir,
+            interactive,
        })
    }
 }

 impl Matcher for SingleExecMatcher {
-    fn matches(&self, file_info: &WalkEntry, _: &mut MatcherIO) -> bool {
-        let mut command = Command::new(&self.executable);
+    fn matches(&self, file_info: &WalkEntry, matcher_io: &mut MatcherIO) -> bool {
        let path_to_file = if self.exec_in_parent_dir {
            if let Some(f) = file_info.path().file_name() {
                Path::new(".").join(f)
@@ -64,6 +82,28 @@ impl Matcher for SingleExecMatcher {
            file_info.path().to_path_buf()
        };

+        if self.interactive {
+            let rendered_args: Vec<String> = self
+                .args
+                .iter()
+                .map(|arg| match arg {
+                    Arg::LiteralArg(a) => a.to_string_lossy().into_owned(),
+                    Arg::FileArg(parts) => parts
+                        .join(path_to_file.as_os_str())
+                        .to_string_lossy()
+                        .into_owned(),
+                })
+                .collect();
+            let mut prompt_parts = vec![self.executable.clone()];
+            prompt_parts.extend(rendered_args);
+            let prompt = format!("< {} >? ", prompt_parts.join(" "));
+
+            if !matcher_io.confirm(&prompt) {
+                return false;
+            }
+        }
+
+        let mut command = Command::new(&self.executable);
        for arg in &self.args {
            match *arg {
                Arg::LiteralArg(ref a) => command.arg(a.as_os_str()),
@@ -53,7 +53,7 @@ pub fn get_file_system_type(path: &Path, cache: &RefCell<Option<Cache>>) -> URes
    let fs_list = uucore::fsext::read_fs_list()?;
    let result = fs_list
        .into_iter()
-        .find(|fs| fs.dev_id == dev_id)
+        .rfind(|fs| fs.dev_id == dev_id)
        .map_or_else(String::new, |fs| fs.fs_type);

    // cache the latest query if not a match before
@@ -187,6 +187,14 @@ impl MatcherIO<'_> {
    pub fn now(&self) -> SystemTime {
        self.deps.now()
    }
+
+    /// Prompt the user and return whether they confirmed.  Delegates to
+    /// `Dependencies::confirm` so that matchers stay testable without a real
+    /// terminal — unit tests inject preset responses via `FakeDependencies`.
+    #[must_use]
+    pub fn confirm(&self, prompt: &str) -> bool {
+        self.deps.confirm(prompt)
+    }
 }

 /// A basic interface that can be used to determine whether a directory entry
@@ -469,7 +477,7 @@ fn build_matcher_tree(
                Some(Printer::new(PrintDelimiter::Newline, Some(file)).into_box())
            }
            "-fprintf" => {
-                if i >= args.len() - 2 {
+                if i + 2 >= args.len() {
                    return Err(From::from(format!("missing argument to {}", args[i])));
                }

@@ -668,6 +676,31 @@ fn build_matcher_tree(
                    _ => unreachable!("Encountered unexpected value {}", args[arg_index]),
                }
            }
+            "-ok" | "-okdir" => {
+                // -ok is like -exec ... ; but prompts before each invocation.
+                // Only ';' is accepted: POSIX does not define -ok ... + and
+                // GNU find rejects it (batch mode makes no sense with prompts).
+                let mut arg_index = i + 1;
+                while arg_index < args.len() && args[arg_index] != ";" {
+                    arg_index += 1;
+                }
+                if arg_index < i + 2 || arg_index == args.len() {
+                    // Need at least the executable and the terminating ';'.
+                    return Err(From::from(format!("missing argument to {}", args[i])));
+                }
+                let expression = args[i];
+                let executable = args[i + 1];
+                let exec_args = &args[i + 2..arg_index];
+                i = arg_index;
+                Some(
+                    SingleExecMatcher::new_interactive(
+                        executable,
+                        exec_args,
+                        expression == "-okdir",
+                    )?
+                    .into_box(),
+                )
+            }
            #[cfg(unix)]
            "-inum" => {
                if i >= args.len() - 1 {
@@ -720,7 +753,9 @@ fn build_matcher_tree(
                i += 1;
                let matcher = UserMatcher::from_user_name(user)
                    .or_else(|| Some(UserMatcher::from_uid(user.parse::<u32>().ok()?)))
-                    .ok_or_else(|| format!("{user} is not the name of a known user"))?;
+                    .ok_or_else(|| {
+                        format!("invalid user name or UID argument to -user: '{user}'")
+                    })?;
                Some(matcher.into_box())
            }
            "-nouser" => Some(NoUserMatcher {}.into_box()),
@@ -749,7 +784,9 @@ fn build_matcher_tree(
                i += 1;
                let matcher = GroupMatcher::from_group_name(group)
                    .or_else(|| Some(GroupMatcher::from_gid(group.parse::<u32>().ok()?)))
-                    .ok_or_else(|| format!("{group} is not the name of an existing group"))?;
+                    .ok_or_else(|| {
+                        format!("invalid group name or GID argument to -group: '{group}'")
+                    })?;
                Some(matcher.into_box())
            }
            "-nogroup" => Some(NoGroupMatcher {}.into_box()),
@@ -1616,6 +1653,67 @@ mod tests {
            .expect("only {} + should be considered a multi-exec");
    }

+    #[test]
+    fn build_top_level_ok_not_enough_args() {
+        // -ok follows the same validation rules as -exec for missing arguments.
+        let mut config = Config::default();
+        if let Err(e) = build_top_level_matcher(&["-ok"], &mut config) {
+            assert!(e.to_string().contains("missing argument"));
+        } else {
+            panic!("parsing -ok with no executable or semicolon should fail");
+        }
+
+        if let Err(e) = build_top_level_matcher(&["-ok", ";"], &mut config) {
+            assert!(e.to_string().contains("missing argument"));
+        } else {
+            panic!("parsing -ok with no executable should fail");
+        }
+
+        if let Err(e) = build_top_level_matcher(&["-ok", "foo"], &mut config) {
+            assert!(e.to_string().contains("missing argument"));
+        } else {
+            panic!("parsing -ok without terminating ';' should fail");
+        }
+    }
+
+    #[test]
+    fn build_top_level_ok_missing_semicolon() {
+        let mut config = Config::default();
+        build_top_level_matcher(&["-ok", "echo", "{}"], &mut config)
+            .err()
+            .expect("parsing -ok without ';' should fail");
+    }
+
+    #[test]
+    fn build_top_level_ok_parses_correctly() {
+        let mut config = Config::default();
+        build_top_level_matcher(&["-ok", "echo", "{}", ";"], &mut config)
+            .expect("-ok with executable, {} and ';' should succeed");
+    }
+
+    #[test]
+    #[cfg(unix)]
+    fn build_top_level_ok_matches_with_confirmation() {
+        // When the user confirms, -ok should match (run the command and return
+        // its exit status).  When the user declines, -ok is false and the
+        // command is not run.
+        let abbbc = get_dir_entry_for("./test_data/simple", "abbbc");
+        let mut config = Config::default();
+
+        // Confirmed: -ok behaves like -exec (prints nothing; has_side_effects
+        // suppresses the default print, same as -exec).
+        let matcher = build_top_level_matcher(&["-ok", "true", ";"], &mut config).unwrap();
+        let deps = FakeDependencies::new();
+        deps.push_confirm_response(true);
+        assert!(matcher.matches(&abbbc, &mut deps.new_matcher_io()));
+
+        // Declined: -ok is false, so the default print fires.
+        let matcher = build_top_level_matcher(&["-ok", "true", ";"], &mut config).unwrap();
+        let deps = FakeDependencies::new();
+        deps.push_confirm_response(false);
+        assert!(!matcher.matches(&abbbc, &mut deps.new_matcher_io()));
+    }
+
    #[test]
    fn build_top_level_multi_exec_too_many_holders() {
        let mut config = Config::default();
@@ -390,23 +390,18 @@ fn format_directive<'entry>(

        FormatDirective::Blocks { large_blocks } => {
            #[cfg(unix)]
-            let blocks = meta()?.blocks();
+            let len = meta()?.blocks() * STANDARD_BLOCK_SIZE;
            #[cfg(not(unix))]
-            // Estimate using a ceiling division by the block size.
-            let blocks = (meta()?.len() + STANDARD_BLOCK_SIZE - 1) / STANDARD_BLOCK_SIZE;
+            let len = meta()?.len();

            // GNU find says it returns the number of 512-byte blocks for %b,
            // but in reality it just returns the number of blocks, *regardless
            // of their size on the filesystem*. That behavior is copied here,
            // even though it's arguably not 100% correct.
-            if *large_blocks {
-                // Ceiling divide in half.
-                blocks.div_ceil(2)
-            } else {
-                blocks
-            }
-            .to_string()
-            .into()
+            let bs = if *large_blocks { 1024 } else { 512 };
+            let blocks = len.div_ceil(bs);
+
+            blocks.to_string().into()
        }

        #[cfg(not(unix))]
@@ -451,7 +446,7 @@ fn format_directive<'entry>(
                uucore::fsext::read_fs_list().expect("Could not find the filesystem info");
            fs_list
                .into_iter()
-                .find(|fs| fs.dev_id == dev_id)
+                .rfind(|fs| fs.dev_id == dev_id)
                .map_or_else(String::new, |fs| fs.fs_type)
                .into()
        }
@@ -30,8 +30,9 @@ impl fmt::Display for ParseRegexTypeError {
    }
 }

-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
 pub enum RegexType {
+    #[default]
    Emacs,
    Grep,
    PosixBasic,
@@ -74,12 +75,6 @@ impl FromStr for RegexType {
    }
 }

-impl Default for RegexType {
-    fn default() -> Self {
-        Self::Emacs
-    }
-}
-
 pub struct RegexMatcher {
    regex: Regex,
 }
@@ -170,4 +170,78 @@ mod tests {
            "512-byte file should match size of 1 block"
        );
    }
+
+    #[test]
+    fn size_matcher_zero_byte_file() {
+        let file_info = get_dir_entry_for("./test_data/simple", "abbbc");
+        let deps = FakeDependencies::new();
+
+        let equal_to_0 = SizeMatcher::new(ComparableValue::EqualTo(0), "c").unwrap();
+        assert!(
+            equal_to_0.matches(&file_info, &mut deps.new_matcher_io()),
+            "zero-byte file should match size of 0 bytes"
+        );
+
+        let more_than_0 = SizeMatcher::new(ComparableValue::MoreThan(0), "c").unwrap();
+        assert!(
+            !more_than_0.matches(&file_info, &mut deps.new_matcher_io()),
+            "zero-byte file should not match size of >0 bytes"
+        );
+
+        let less_than_1 = SizeMatcher::new(ComparableValue::LessThan(1), "c").unwrap();
+        assert!(
+            less_than_1.matches(&file_info, &mut deps.new_matcher_io()),
+            "zero-byte file should match size of <1 byte"
+        );
+    }
+
+    #[test]
+    fn size_matcher_boundary_values() {
+        let file_info = get_dir_entry_for("./test_data/size", "512bytes");
+        let deps = FakeDependencies::new();
+
+        // bytes (c): 512 bytes = 512
+        let eq_512_c = SizeMatcher::new(ComparableValue::EqualTo(512), "c").unwrap();
+        assert!(eq_512_c.matches(&file_info, &mut deps.new_matcher_io()));
+        let gt_511_c = SizeMatcher::new(ComparableValue::MoreThan(511), "c").unwrap();
+        assert!(gt_511_c.matches(&file_info, &mut deps.new_matcher_io()));
+        let lt_513_c = SizeMatcher::new(ComparableValue::LessThan(513), "c").unwrap();
+        assert!(lt_513_c.matches(&file_info, &mut deps.new_matcher_io()));
+
+        // words (w): 512 bytes = 256 two-byte words
+        let eq_256_w = SizeMatcher::new(ComparableValue::EqualTo(256), "w").unwrap();
+        assert!(eq_256_w.matches(&file_info, &mut deps.new_matcher_io()));
+        let gt_255_w = SizeMatcher::new(ComparableValue::MoreThan(255), "w").unwrap();
+        assert!(gt_255_w.matches(&file_info, &mut deps.new_matcher_io()));
+
+        // blocks (b): 512 bytes = 1 block
+        let eq_1_b = SizeMatcher::new(ComparableValue::EqualTo(1), "b").unwrap();
+        assert!(eq_1_b.matches(&file_info, &mut deps.new_matcher_io()));
+        let gt_1_b = SizeMatcher::new(ComparableValue::MoreThan(1), "b").unwrap();
+        assert!(!gt_1_b.matches(&file_info, &mut deps.new_matcher_io()));
+        let lt_1_b = SizeMatcher::new(ComparableValue::LessThan(1), "b").unwrap();
+        assert!(!lt_1_b.matches(&file_info, &mut deps.new_matcher_io()));
+        let gt_0_b = SizeMatcher::new(ComparableValue::MoreThan(0), "b").unwrap();
+        assert!(gt_0_b.matches(&file_info, &mut deps.new_matcher_io()));
+
+        // kibibytes (k): 512 bytes = 1k (rounded up)
+        let eq_1_k = SizeMatcher::new(ComparableValue::EqualTo(1), "k").unwrap();
+        assert!(eq_1_k.matches(&file_info, &mut deps.new_matcher_io()));
+        let gt_1_k = SizeMatcher::new(ComparableValue::MoreThan(1), "k").unwrap();
+        assert!(!gt_1_k.matches(&file_info, &mut deps.new_matcher_io()));
+        let lt_2_k = SizeMatcher::new(ComparableValue::LessThan(2), "k").unwrap();
+        assert!(lt_2_k.matches(&file_info, &mut deps.new_matcher_io()));
+
+        // mebibytes (M): 512 bytes = 1M (rounded up)
+        let eq_1_m = SizeMatcher::new(ComparableValue::EqualTo(1), "M").unwrap();
+        assert!(eq_1_m.matches(&file_info, &mut deps.new_matcher_io()));
+        let gt_1_m = SizeMatcher::new(ComparableValue::MoreThan(1), "M").unwrap();
+        assert!(!gt_1_m.matches(&file_info, &mut deps.new_matcher_io()));
+
+        // gibibytes (G): 512 bytes = 1G (rounded up)
+        let eq_1_g = SizeMatcher::new(ComparableValue::EqualTo(1), "G").unwrap();
+        assert!(eq_1_g.matches(&file_info, &mut deps.new_matcher_io()));
+        let gt_1_g = SizeMatcher::new(ComparableValue::MoreThan(1), "G").unwrap();
+        assert!(!gt_1_g.matches(&file_info, &mut deps.new_matcher_io()));
+    }
 }
--- a/Show More
+++ b/Show More