diff --git a/cmd/gomtree/main.go b/cmd/gomtree/main.go
index 2f00eae..acca098 100644
--- a/cmd/gomtree/main.go
+++ b/cmd/gomtree/main.go
@@ -269,14 +269,20 @@ func app() error {
 			if isTarSpec(specDh) || *flTar != "" {
 				res = filterMissingKeywords(res)
 			}
-			//if len(res) > 0 {
-			//return fmt.Errorf("unexpected missing keywords: %d", len(res))
-			//}
 
 			out := formatFunc(res)
 			if _, err := os.Stdout.Write([]byte(out)); err != nil {
 				return err
 			}
+
+			// TODO: This should be a flag. Allowing files to be added and
+			//       removed and still returning "it's all good" is simply
+			//       unsafe IMO.
+			for _, diff := range res {
+				if diff.Type() == mtree.Modified {
+					return fmt.Errorf("mainfest validation failed")
+				}
+			}
 		}
 	} else {
 		return fmt.Errorf("neither validating or creating a manifest. Please provide additional arguments")
@@ -289,13 +295,7 @@ var formats = map[string]func([]mtree.InodeDelta) string{
 	"bsd": func(d []mtree.InodeDelta) string {
 		var buffer bytes.Buffer
 		for _, delta := range d {
-			if delta.Type() == mtree.Modified {
-				fmt.Fprintln(&buffer, delta)
-			} else if delta.Type() == mtree.Missing {
-				fmt.Fprintln(&buffer, delta)
-			} else if delta.Type() == mtree.Extra {
-				fmt.Fprintln(&buffer, delta)
-			}
+			fmt.Fprintln(&buffer, delta)
 		}
 		return buffer.String()
 	},
diff --git a/keywords_linux.go b/keywords_linux.go
index 79cf46e..a14108e 100644
--- a/keywords_linux.go
+++ b/keywords_linux.go
@@ -62,7 +62,11 @@ var (
 			}
 			klist := []KeyVal{}
 			for k, v := range hdr.Xattrs {
-				klist = append(klist, KeyVal(fmt.Sprintf("xattr.%s=%s", k, base64.StdEncoding.EncodeToString([]byte(v)))))
+				encKey, err := Vis(k, DefaultVisFlags)
+				if err != nil {
+					return emptyKV, err
+				}
+				klist = append(klist, KeyVal(fmt.Sprintf("xattr.%s=%s", encKey, base64.StdEncoding.EncodeToString([]byte(v)))))
 			}
 			return KeyVal(strings.Join(KeyValToString(klist), " ")), nil
 		}
@@ -80,7 +84,11 @@ var (
 			if err != nil {
 				return emptyKV, err
 			}
-			klist[i] = KeyVal(fmt.Sprintf("xattr.%s=%s", xlist[i], base64.StdEncoding.EncodeToString(data)))
+			encKey, err := Vis(xlist[i], DefaultVisFlags)
+			if err != nil {
+				return emptyKV, err
+			}
+			klist[i] = KeyVal(fmt.Sprintf("xattr.%s=%s", encKey, base64.StdEncoding.EncodeToString(data)))
 		}
 		return KeyVal(strings.Join(KeyValToString(klist), " ")), nil
 	}
diff --git a/test/cli.go b/test/cli.go
index 286dd7f..df5a686 100644
--- a/test/cli.go
+++ b/test/cli.go
@@ -17,10 +17,11 @@ func main() {
 		cmd.Stdout = os.Stdout
 		if err := cmd.Run(); err != nil {
 			failed++
+			fmt.Fprintf(os.Stderr, "FAILED: %s\n", arg)
 		}
 	}
 	if failed > 0 {
-		fmt.Printf("%d FAILED tests\n", failed)
+		fmt.Fprintf(os.Stderr, "%d FAILED tests\n", failed)
 		os.Exit(1)
 	}
 }
diff --git a/test/cli/0003.sh b/test/cli/0003.sh
new file mode 100644
index 0000000..c9c5708
--- /dev/null
+++ b/test/cli/0003.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+set -e
+
+name=$(basename $0)
+root="$(dirname $(dirname $(dirname $0)))"
+gomtree=$(readlink -f ${root}/gomtree)
+t=$(mktemp -d /tmp/go-mtree.XXXXXX)
+
+setfattr -n user.has_xattrs -v "" "${t}" || exit 0
+
+echo "[${name}] Running in ${t}"
+
+mkdir "${t}/dir"
+touch "${t}/dir/file"
+
+setfattr -n user.mtree.testing -v "apples and=bananas" "${t}/dir/file"
+$gomtree -c -k "sha256digest,xattrs" -p ${t}/dir > ${t}/${name}.mtree
+
+setfattr -n user.mtree.testing -v "bananas and lemons" "${t}/dir/file"
+! $gomtree -p ${t}/dir -f ${t}/${name}.mtree
+
+setfattr -x user.mtree.testing "${t}/dir/file"
+! $gomtree -p ${t}/dir -f ${t}/${name}.mtree
+
+setfattr -n user.mtree.testing -v "apples and=bananas" "${t}/dir/file"
+setfattr -n user.mtree.another -v "another  a=b" "${t}/dir/file"
+! $gomtree -p ${t}/dir -f ${t}/${name}.mtree
+
+setfattr -n user.mtree.testing -v "apples and=bananas" "${t}/dir/file"
+setfattr -x user.mtree.another "${t}/dir/file"
+$gomtree -p ${t}/dir -f ${t}/${name}.mtree
+
+rm -fr ${t}