J_Darnley: 2 bugs with this.
"local.getdefaultlocale()" might return "(None, None)", you do not handle this case causing an error when you try to use sysLang.
The "verify" command cannot work on a read-only filesystem. It tried to do a mkdir and that failed. I don't know why it wants to do that but verifying shouldn't be writing anything.
I'l look into that first one. (ETA - checked and fixed locally. Thanks for bringing this to my attenion. )
Verify with clean on fail turned on needs to create an !orphaned directory (I'll make it fail more gracefully if that fails though)* and it of course always requires write access to the folder it's in (to update the verification status in the manifest and possibly for logging if that isn't turned off).
*A quick look suggests that delete on fail also fails gracelessly on non-writeable file systems.
I think the most graceful thing to do is to abort when the situation is detected as someone probably doesn't mean to be using clean / delete on a ro file system.
Edit:
Also nearly all functions will sometimes require write access. GOG sometimes changes their internal names for stuff, and gogrepo will change the local stuff to match, to avoid unnecessary downloads. Update can't do that itself (because it doesn't take the storage directory as an argument), but clean / download / verify may all correct the structure before running to avoid inconsistency. Though I should probably handle that gracefully.