vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Phase 7 slice 4: a published release cannot change under its link

948a6d7dcdacb72d6f90074ac0e5f9999314c4f4 · Keenan Nemetz · 17d ago · parent 85cc89fe

Phase 7 slice 4: a published release cannot change under its link

The last piece of the release story is the one that makes the download links
trustworthy: pre-receive now refuses to move or delete a tag that has artifacts
attached, and on the metadata branch refuses removing a pointer or re-pointing
one at different bytes. Comparing blob ids is enough — a pointer's id is its
text, so "unchanged" needs no parsing and cannot be fooled by reformatting.

Adding an artifact stays legal: an artifact is published when its pointer lands,
so an addition invalidates nothing.

The rules sit with the integrity checks rather than the review gate, because a
download that can change bytes is broken whoever pushed it. An admin may
override, with a line in data/audit.log, following the force-push precedent: a
mistyped tag is otherwise unrepairable, and an unaudited override leaves no trace
of the bytes that changed under somebody's link.

Four refusals are tested through a writer account (moved tag, deleted tag,
removed pointer, re-pointed pointer), plus the admin override and its audit line.

README.md +7−2

@@ -66,8 +66,7 @@ Working today:
	66	66	- An instance ed25519 key generated at first boot (used for metadata signing in
	67	67	Phase 7)
	68	68
	69		Not yet: workflow artifact uploads, LFS locking, and release immutability (a tag that has
	70		artifacts can still be moved until Phase 7's last slice lands).
		69	Not yet: workflow artifact uploads, LFS locking.
	71	70	Signature verification is deferred,
	72	71	not planned: the SSH handshake already establishes who pushed, so signing approvals
	73	72	would restate it for a verifier this deployment does not have (see the roadmap).
@@ -280,6 +279,12 @@ Artifacts are reachable by `vole gc` because the pointers live on the `vole` bra
	280	279	vole gc --dry-run # the published artifact is a reachable root
	281	280	```
	282	281
		282	A release with artifacts is immutable from the moment they land: the server refuses to
		283	move or delete that tag, to remove a pointer, or to re-point one at different bytes
		284	(`pre-receive`), so a saved download keeps meaning what it said. Adding another artifact
		285	is fine — that invalidates nothing. An admin can still repair a mistyped release, and the
		286	override is written to `data/audit.log`.
		287
	283	288	## Hosting a site
	284	289
	285	290	A repository's `pages` branch is a website at `<repo>.<pages_domain>`. Nothing is