vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Accounts with stable ids; the roster moves into the system repository

31df8baea9c9e8acf74b71bdda26d27907b30f2a · Keenan Nemetz · 17d ago · parent 36293228

Accounts with stable ids; the roster moves into the system repository

Names were the primary key everywhere — the keys file name, the ACL entry, the
approval file — so renaming someone broke their access, orphaned their approvals,
and left a retired name able to hand a newcomer the old holder's rights. This
splits identity into an account (stable id, anchored by its SSH keys) and a name
(mutable, never reissued).

  data/system.git  refs/heads/main
    users/<ulid>/meta.json   name, status, keys, former_names

Everything that grants authority now holds the id: ACL entries, approval files,
and the identity resolved at the SSH handshake (VOLE_ACTOR_ID). A rename is a
one-file change that disturbs nothing else, and both the old and new names stay
reserved forever.

The roster moved from a trusted-keys directory back into git, which reverses an
earlier simplification — deliberately, and in a smaller shape (one file per
account, one writer, no CAS plumbing for unused fields). Git buys what a directory
could not: `git log` answers who renamed whom and when a key appeared, and the
roster is now readable by anyone who can clone, since it is served read-only at
ssh://host/system.git. `vole request new` and `approve` use exactly that to turn a
name typed on the command line into the account id they store.

Two latent bugs surfaced, both caught by tests added here:

- gitx inherited git's repository-scoped environment. pre-receive runs with
  GIT_OBJECT_DIRECTORY and GIT_QUARANTINE_PATH pointing at the pushed repository's
  quarantine, so every git call a hook made for a *different* repository silently
  read the pushed one: the hook saw an empty roster. gitx now scrubs those
  variables and the hook restores them for the pushed repository only.
- The hook built the repository name with filepath.Base on receive-pack's path,
  which carries a trailing separator, so refusals read "does not have write access
  to .". Cleaned first.

Verified end to end on a live instance: two accounts file, approve and land a
change; `vole user rename wilbur robert` keeps the same key's write access and the
approval still reads as current, now credited to robert; the roster history shows
"user: rename wilbur to robert"; retiring an account rejects its key within five
seconds and refuses to reissue the name.

internal/gitx/env_test.go +42

@@ -0,0 +1,42 @@
	1	package gitx
	2
	3	import (
	4	"os/exec"
	5	"path/filepath"
	6	"testing"
	7	)
	8
	9	// TestEnvironmentIsNotInherited guards the bug that made a hook read the wrong
	10	// repository: pre-receive runs with GIT_OBJECT_DIRECTORY and friends pointing at
	11	// the pushed repository's quarantine, and a hook that shells out to git for a
	12	// different repository must not inherit them.
	13	func TestEnvironmentIsNotInherited(t *testing.T) {
	14	dir := filepath.Join(t.TempDir(), "r.git")
	15	if out, err := exec.Command("git", "init", "--bare", "-q", dir).CombinedOutput(); err != nil {
	16	t.Fatalf("init: %v: %s", err, out)
	17	}
	18	g := Open(dir)
	19	if _, err := CommitFiles(g, "refs/heads/main", func(files map[string][]byte) error {
	20	files["a.txt"] = []byte("hi\n")
	21	return nil
	22	}, "init", "test"); err != nil {
	23	t.Fatal(err)
	24	}
	25
	26	// Point the inherited variables somewhere useless, as receive-pack would.
	27	t.Setenv("GIT_OBJECT_DIRECTORY", filepath.Join(t.TempDir(), "no-objects-here"))
	28	t.Setenv("GIT_QUARANTINE_PATH", filepath.Join(t.TempDir(), "no-quarantine-here"))
	29	t.Setenv("GIT_DIR", filepath.Join(t.TempDir(), "some-other.git"))
	30
	31	sha, err := g.RevParse("refs/heads/main")
	32	if err != nil \|\| sha == "" {
	33	t.Fatalf("RevParse = %q, %v", sha, err)
	34	}
	35	files, err := g.FlatTree(sha)
	36	if err != nil {
	37	t.Fatalf("FlatTree: %v", err)
	38	}
	39	if got := string(files["a.txt"]); got != "hi\n" {
	40	t.Fatalf("a.txt = %q; the inherited environment redirected git elsewhere", got)
	41	}
	42	}