vole
Clone
Read only, no credentials:
https://rodent.software/git/vole.git
Write over SSH with a registered key:
git clone ssh://git@0.0.0.0:2222/vole.git
A free and open-source forge that lives in your Git repo.
Move writes to SSH, drop web authentication, keep identity in git
a5f19b3c19861e080953096f934df25dc38beaf7 · Keenan Nemetz · 18d ago · parent 653e0cfc
Move writes to SSH, drop web authentication, keep identity in git The authenticated-HTTP design is gone rather than extended. Writes now require an SSH key, the web is read-only, and the user roster lives in git. What replaced what: - internal/sshserver is the only write transport. An embedded SSH server (golang.org/x/crypto/ssh) authenticates by public key and hands the principal to pre-receive through the environment, so the hook's policy code is unchanged. The exec surface is whitelisted to git-upload-pack and git-receive-pack, the repository argument is resolved through the store rather than concatenated, and everything else -- including `sh -c` -- is refused and asserted refused in a test. - internal/identity stores users on refs/heads/main in data/system.git. The directory listing is the table: users/<name>/keys/<sha>.pub. Writes are CAS commits, reads come from an in-memory snapshot so the SSH auth callback is a map lookup. Nothing stored is a secret, so a clone of system.git is a complete backup and git log on it is the audit trail. - internal/transport is now anonymous read-only: upload-pack behind a visibility check, 404 for private repositories, and no push path at all. - internal/web has no login, no sessions and no mutations. Deleted outright: internal/auth, the Basic-auth path, login/logout, web settings/rename/delete, chunked body spooling, the spool janitor, the push semaphore and the hand-rolled byte cap. The cap is now git's receive.maxInputSize per repo, which enforces it on every transport without buffering. Three things worth recording: - The CAS helper read the tree outside the retry loop and compared against a freshly-read old value, so a concurrent writer's commit could be silently discarded while the CAS "succeeded". A test with two stores adding eight keys at once found it losing half of them; read, mutate and compare now all happen inside the loop. - The roster moved from refs/vole/users to refs/heads/main because `git clone` only mirrors refs/heads/*: the documented backup command produced an instance with zero users. Storing on a branch also means git itself refuses to point the ref at a non-commit. - Exec refusals are answered on the channel rather than by rejecting the request. Rejecting made the client print "exec request failed on channel 0", so the reason was unreadable. Verified by hand as well as by test: init -> user -> add-key -> repo -> serve, push over SSH, anonymous HTTP clone, web browse, a private repo answering 404 on both anonymous surfaces while still cloning over SSH, a refused `sh -c` that prints why and executes nothing, and a plain clone of system.git yielding the whole roster with no side database present.
internal/gitx/gitx.go +53
| @@ -80,6 +80,20 @@ func (r *Repo) RevParse(rev string) (string, error) { | |||
| 80 | 80 | return strings.TrimSpace(string(out)), nil | |
| 81 | 81 | } | |
| 82 | 82 | ||
| 83 | // RevParseRaw resolves a rev without peeling to a commit, returning "" when it | ||
| 84 | // does not exist. Use this to detect a ref that points at the wrong object type. | ||
| 85 | func (r *Repo) RevParseRaw(rev string) (string, error) { | ||
| 86 | out, errs, err := r.run(nil, "rev-parse", "--verify", "--quiet", rev) | ||
| 87 | if err != nil { | ||
| 88 | return "", nil | ||
| 89 | } | ||
| 90 | sha := strings.TrimSpace(string(out)) | ||
| 91 | if sha == "" { | ||
| 92 | return "", fmt.Errorf("rev-parse %q: empty result: %s", rev, errs) | ||
| 93 | } | ||
| 94 | return sha, nil | ||
| 95 | } | ||
| 96 | |||
| 83 | 97 | // ResolveAny resolves a rev to an object of any type (tree, blob, commit). | |
| 84 | 98 | func (r *Repo) ResolveAny(rev string) (string, string, error) { | |
| 85 | 99 | out, errs, err := r.run(nil, "cat-file", "-t", rev) | |
| @@ -130,6 +144,45 @@ func (r *Repo) LsTree(treeish string) ([]Entry, error) { | |||
| 130 | 144 | return es, nil | |
| 131 | 145 | } | |
| 132 | 146 | ||
| 147 | // LsTreeR lists every blob under treeish recursively, with full paths. | ||
| 148 | func (r *Repo) LsTreeR(treeish string) ([]Entry, error) { | ||
| 149 | out, errs, err := r.run(nil, "ls-tree", "-r", "-z", treeish) | ||
| 150 | if err != nil { | ||
| 151 | return nil, fmt.Errorf("ls-tree -r %q: %w: %s", treeish, err, errs) | ||
| 152 | } | ||
| 153 | var es []Entry | ||
| 154 | for _, rec := range bytes.Split(out, []byte{0}) { | ||
| 155 | if len(rec) == 0 { | ||
| 156 | continue | ||
| 157 | } | ||
| 158 | tab := bytes.IndexByte(rec, '\t') | ||
| 159 | if tab < 0 { | ||
| 160 | return nil, fmt.Errorf("bad ls-tree record %q", rec) | ||
| 161 | } | ||
| 162 | f := strings.Fields(string(rec[:tab])) | ||
| 163 | if len(f) != 3 { | ||
| 164 | return nil, fmt.Errorf("bad ls-tree fields %q", rec) | ||
| 165 | } | ||
| 166 | es = append(es, Entry{Mode: f[0], Type: f[1], SHA: f[2], Name: string(rec[tab+1:])}) | ||
| 167 | } | ||
| 168 | return es, nil | ||
| 169 | } | ||
| 170 | |||
| 171 | // BlobBySHA returns a blob's contents by object id. | ||
| 172 | func (r *Repo) BlobBySHA(sha string) ([]byte, error) { | ||
| 173 | out, errs, err := r.run(nil, "cat-file", "blob", sha) | ||
| 174 | if err != nil { | ||
| 175 | return nil, fmt.Errorf("cat-file blob %s: %w: %s", sha, err, errs) | ||
| 176 | } | ||
| 177 | return out, nil | ||
| 178 | } | ||
| 179 | |||
| 180 | // SetConfig writes a repo-local git config value. | ||
| 181 | func (r *Repo) SetConfig(key, value string) error { | ||
| 182 | _, err := r.Run(nil, "config", key, value) | ||
| 183 | return err | ||
| 184 | } | ||
| 185 | |||
| 133 | 186 | func (r *Repo) MkTree(es []Entry) (string, error) { | |
| 134 | 187 | sorted := make([]Entry, len(es)) | |
| 135 | 188 | copy(sorted, es) | |