# Build artefacts
*.o
*.so
*.so.*
*.a
*.dylib
*.dll
*.exe

# Test binaries
# Compiled test / fuzz binaries and their signing artifacts. Sources keep
# their extension; the built binaries have none, so ignore the extensionless
# form and re-include the sources explicitly. The previous list named each
# binary individually, which meant every new test silently got committed --
# tests/test_integrity and its .sha256 were added that way (#125). A signed
# binary in a repo that advertises reproducible builds is a supply-chain
# smell: it bloats clones, can be run by accident, and nobody can tell what
# it was built from. `make` regenerates all of them.
tests/test_*
!tests/test_*.c
!tests/test_*.h
!tests/test_*.sh
!tests/test_*.py
tests/mlkem_e2e
tests/mldsa_e2e
tests/slhdsa_e2e
tests/fuzz/
fuzz/fuzz_*
!fuzz/fuzz_*.c
!fuzz/fuzz_*.h

# libFuzzer harness binaries (built by fuzz/Makefile.fuzz, never committed)
fuzz/fuzz_ecdsa_raw
fuzz/fuzz_pq_params
fuzz/fuzz_attr_template
fuzz/fuzz_create_attrs
fuzz/crash-*
fuzz/leak-*
fuzz/oom-*
fuzz/timeout-*
fuzz/artifacts/

# Stale backups (rename/refactor leftovers)
*.bak

# Coverage
*.gcno
*.gcda
*.gcov
coverage.info
lcov-report/

# Tools
tools/freehsm-audit

# Reproducible-build outputs
dist/
*.tar.xz
*.tar.xz.asc
*.tar.xz.sha256

# Distributed artefacts (signed at release time)
libfreehsm-fips.so.sha256

# Editor / IDE
.vscode/
.idea/
*.swp
*~

# OS
.DS_Store
Thumbs.db

# Operator-side data (must NEVER be in git)
/var/lib/freehsm/
/etc/freehsm/freehsm.conf
*.tok
*.tok.tpm
audit.log

# GPG / secrets
*.asc.tmp
.gnupg/
secrets/

# Generated by make integrity
.fhsm_digest.bin

# Local test scaffolding
/tmp/freehsm-*

# Local secrets (NEVER commit)
CODEBERG_SSH_KEY
GITLAB_SSH_KEY
RELEASE_GPG_PASSPHRASE
RELEASE_GPG_KEY
*.gpg.key
deploy-key*
build.log
tests/test_smoke.sha256
tests/test_smoke.tampered

# sign_module.sh test artifacts
tests/test_smoke.sha256
tests/test_smoke.tampered

# test binaries (#110)
tests/test_token_capacity
tests/test_decrypt_null_args

# pkcs11-check runtime artifacts (#125)
reports/
.pkcs11-check-isolation-*.json
.pkcs11-check-isolation-*.report-records/
..pkcs11-check-isolation-*.report-records/
tests/test_mech_advertise
tests/test_legacy_digest
tests/test_legacy_cipher
tests/test_legacy_rsa
src/gen/.profile.stamp
