vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Phase 4: the runner publishes its result as a signed commit

90fdaf397a1120677a1246201369e6dcc82b0aed · Keenan Nemetz · 17d ago · parent 96cbb6fa

Phase 4: the runner publishes its result as a signed commit

A finished run's result existed only in data/runs.db and the object store, so a
clone carried the commits and the workflow but not the fact that CI passed, who
said so, or the log it said it with. And the previous cut of this change had the
server commit the record — which is the box vouching for a party, the same
mistake as the instance signing key that was deleted.

The runner now publishes it. When an attempt ends the runner commits
runs/<run id>/<attempt>/ — record.md (repo, ref, sha, workflow blob, job, steps
digest, exit, finish time, signer, key) plus an LFS pointer for the log and one
per artifact — together with any release pointers the build published, and
pushes that once. One push per run: the result and the artifacts it produced are
one fact, so a release cannot carry bytes whose build has no record.

The commit is signed with the runner's SSH key, and that signature is the whole
attestation: it covers the tree, the parents and the message, so the separate
claim and signature file are gone, and there is no second statement to keep in
step with the files it describes. pre-receive checks it against an
allowed-signers file built from the pushing account's keys, so identity comes
from the key and not from a name typed into a commit.

Who may report is the repository's runner allowlist — the same list that decides
who may lease a job — and the record must describe the job the queue handed that
account: same run, same attempt, same commit, workflow, job and steps digest.
Without that an allowed runner could report a green result for a commit nobody
asked it to build, or invent attempt 99 and have the next rebuild believe it.
Records are append-only, with no admin override: an edit or a deletion is a
rewrite of evidence, and the alternative to refusing is running the job again.

runs.db keeps the queue (queued and leased jobs have no record because they have
not happened) and mirrors finished runs as derived rows, which vole index
rebuild reconstructs from the branch. The attestation row now names the commit
instead of storing a claim and a signature.

Measured: a real run finished, a bare clone carried runs/<id>/1/record.md, git
verify-commit accepted that commit under the roster and refused an unsigned one;
a writer who is not a runner was refused by pre-receive naming the allowlist;
one CI release commit carried both the record and releases/v1.0.0/tool-linux;
deleting runs.db and rebuilding restored the row, the attestation and the log.

internal/gitx/trees.go +17−1

@@ -64,6 +64,17 @@ func WriteFlatTree(g *Repo, files map[string][]byte) (string, error) {
	64	64	// path for metadata refs; a second implementation would eventually disagree
	65	65	// about ordering or retries, and that shows up as lost data.
	66	66	func CommitFiles(g *Repo, ref string, mutate func(map[string][]byte) error, message, author string) (string, error) {
		67	return commitFiles(g, ref, mutate, message, author, "")
		68	}
		69
		70	// CommitFilesSigned is CommitFiles with every commit SSH-signed by signingKey, which
		71	// is how a runner writes a result: the commit is the attestation, so it has to be
		72	// signed by the party whose result it is.
		73	func CommitFilesSigned(g *Repo, ref string, mutate func(map[string][]byte) error, message, author, signingKey string) (string, error) {
		74	return commitFiles(g, ref, mutate, message, author, signingKey)
		75	}
		76
		77	func commitFiles(g *Repo, ref string, mutate func(map[string][]byte) error, message, author, signingKey string) (string, error) {
	67	78	const maxAttempts = 64
	68	79	var lastErr error
	69	80	for attempt := 0; attempt < maxAttempts; attempt++ {
@@ -82,7 +93,12 @@ func CommitFiles(g *Repo, ref string, mutate func(map[string][]byte) error, mess
	82	93	if err != nil {
	83	94	return "", err
	84	95	}
	85		commit, err := g.CommitTreeAs(tree, old, message, author)
		96	var commit string
		97	if signingKey != "" {
		98	commit, err = g.CommitTreeAsSigned(tree, old, message, author, signingKey)
		99	} else {
		100	commit, err = g.CommitTreeAs(tree, old, message, author)
		101	}
	86	102	if err != nil {
	87	103	return "", err
	88	104	}