vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Phase 4: the runner publishes its result as a signed commit

90fdaf397a1120677a1246201369e6dcc82b0aed · Keenan Nemetz · 17d ago · parent 96cbb6fa

Phase 4: the runner publishes its result as a signed commit

A finished run's result existed only in data/runs.db and the object store, so a
clone carried the commits and the workflow but not the fact that CI passed, who
said so, or the log it said it with. And the previous cut of this change had the
server commit the record — which is the box vouching for a party, the same
mistake as the instance signing key that was deleted.

The runner now publishes it. When an attempt ends the runner commits
runs/<run id>/<attempt>/ — record.md (repo, ref, sha, workflow blob, job, steps
digest, exit, finish time, signer, key) plus an LFS pointer for the log and one
per artifact — together with any release pointers the build published, and
pushes that once. One push per run: the result and the artifacts it produced are
one fact, so a release cannot carry bytes whose build has no record.

The commit is signed with the runner's SSH key, and that signature is the whole
attestation: it covers the tree, the parents and the message, so the separate
claim and signature file are gone, and there is no second statement to keep in
step with the files it describes. pre-receive checks it against an
allowed-signers file built from the pushing account's keys, so identity comes
from the key and not from a name typed into a commit.

Who may report is the repository's runner allowlist — the same list that decides
who may lease a job — and the record must describe the job the queue handed that
account: same run, same attempt, same commit, workflow, job and steps digest.
Without that an allowed runner could report a green result for a commit nobody
asked it to build, or invent attempt 99 and have the next rebuild believe it.
Records are append-only, with no admin override: an edit or a deletion is a
rewrite of evidence, and the alternative to refusing is running the job again.

runs.db keeps the queue (queued and leased jobs have no record because they have
not happened) and mirrors finished runs as derived rows, which vole index
rebuild reconstructs from the branch. The attestation row now names the commit
instead of storing a claim and a signature.

Measured: a real run finished, a bare clone carried runs/<id>/1/record.md, git
verify-commit accepted that commit under the roster and refused an unsigned one;
a writer who is not a runner was refused by pre-receive naming the allowlist;
one CI release commit carried both the record and releases/v1.0.0/tool-linux;
deleting runs.db and rebuilding restored the row, the attestation and the log.

internal/sshserver/runlog_test.go −49

@@ -1,49 +0,0 @@
	1	package sshserver
	2
	3	// A run log is a claim about bytes, and the store is what makes it checkable: the
	4	// runner uploads the log, names the object id it computed, and the server records
	5	// that id only if the bytes are really there and are the size claimed. These tests
	6	// pin the rule for logs the way the artifact tests pin it for outputs — the log is
	7	// no longer assembled by the server, so this check is the whole guarantee.
	8
	9	import (
	10	"testing"
	11
	12	"github.com/rodent-software/vole/internal/lfs"
	13	)
	14
	15	func TestCheckRunLogTrustsTheStore(t *testing.T) {
	16	store := lfs.New(t.TempDir(), 1<<20)
	17	s := &Server{cfg: Config{LFS: store}}
	18
	19	text := []byte("=== demo · build · main @ 6beaa53\nok\n")
	20	oid, err := store.PutBytes(text)
	21	if err != nil {
	22	t.Fatal(err)
	23	}
	24	if err := s.checkRunLog(oid, int64(len(text))); err != nil {
	25	t.Fatalf("a stored log was refused: %v", err)
	26	}
	27
	28	// The size is part of the claim: a log that says the wrong length is a log whose
	29	// reader would be reading a different file than the one attested to.
	30	if err := s.checkRunLog(oid, 1); err == nil {
	31	t.Fatal("a size mismatch was accepted")
	32	}
	33
	34	// An object the store does not have is not a log, whatever it is called.
	35	missing := "0000000000000000000000000000000000000000000000000000000000000000"
	36	if err := s.checkRunLog(missing, 1); err == nil {
	37	t.Fatal("a log naming an object that is not in the store was accepted")
	38	}
	39	if err := s.checkRunLog("not-an-oid", 1); err == nil {
	40	t.Fatal("a log naming something that is not an object id was accepted")
	41	}
	42
	43	// An instance with no store cannot archive a log, and says so rather than
	44	// recording a pointer to nothing.
	45	bare := &Server{cfg: Config{}}
	46	if err := bare.checkRunLog(oid, int64(len(text))); err == nil {
	47	t.Fatal("an instance with no object store accepted a log")
	48	}
	49	}