vole
Clone
Read only, no credentials:
https://rodent.software/git/vole.git
Write over SSH with a registered key:
git clone ssh://git@0.0.0.0:2222/vole.git
A free and open-source forge that lives in your Git repo.
Delete the instance signing key
5d6db0240d02ffd70acff6ee98b3a1d521353e85 · Keenan Nemetz · 16d ago · parent 22528ac3
Delete the instance signing key The key existed to sign run records, and runner signing made it pointless — but deleting it is not tidying. An instance-signed anything can only be checked by trusting the instance, so a mirror or a third party cannot verify it: trust would sit on the box. With users, runners and approvers each holding a key, trust sits on the parties, and the server is a relay that can withhold service but cannot forge a result. That is a property worth having, and the key was the one thing contradicting it. So: `internal/signing` is gone, `Config.InstanceKey()` is gone, the server no longer loads a key at boot, and `/healthz` reports only the user count instead of a fingerprint nothing verifies. The host key is now the only secret the instance holds, which is what the backup section of the README says. `go mod tidy` changes nothing: the package only used the standard library. Verified: scripts/ci.sh green (gofmt, vet, build, markdown links, go test -race ./..., including TestHealthzReportsUsers against the new body and the full end-to-end suite that starts the server from a fresh data directory).
README.md +6−1
| @@ -587,7 +587,7 @@ Three things, and all are small: | |||
| 587 | 587 | ||
| 588 | 588 | ```sh | |
| 589 | 589 | ./vole user backup backup/users.db # accounts and their keys | |
| 590 | cp data/instance.key data/ssh_host_ed25519_key backup/ # the only two secrets | ||
| 590 | cp data/ssh_host_ed25519_key backup/ # the only secret on the box | ||
| 591 | 591 | cp data/audit.log backup/ 2>/dev/null # who added what, when | |
| 592 | 592 | ``` | |
| 593 | 593 | ||
| @@ -596,6 +596,11 @@ the instance is running; copying `users.db` by hand can miss rows the database h | |||
| 596 | 596 | not checkpointed yet. Losing the roster means re-adding keys, not losing | |
| 597 | 597 | repositories — nothing in it is secret, so a copied file leaks nothing. | |
| 598 | 598 | ||
| 599 | The host key is the only secret the instance holds. There is no instance signing key: | ||
| 600 | nothing an instance writes is signed by the instance, because a signature that can only | ||
| 601 | be checked by trusting the machine that made it is not evidence. Results are signed by | ||
| 602 | the runner that ran them, and they verify against keys people hold. | ||
| 603 | |||
| 599 | 604 | Run everything before pushing: | |
| 600 | 605 | ||
| 601 | 606 | ```sh | |