vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Accounts with stable ids; the roster moves into the system repository

31df8baea9c9e8acf74b71bdda26d27907b30f2a · Keenan Nemetz · 18d ago · parent 36293228

Accounts with stable ids; the roster moves into the system repository

Names were the primary key everywhere — the keys file name, the ACL entry, the
approval file — so renaming someone broke their access, orphaned their approvals,
and left a retired name able to hand a newcomer the old holder's rights. This
splits identity into an account (stable id, anchored by its SSH keys) and a name
(mutable, never reissued).

  data/system.git  refs/heads/main
    users/<ulid>/meta.json   name, status, keys, former_names

Everything that grants authority now holds the id: ACL entries, approval files,
and the identity resolved at the SSH handshake (VOLE_ACTOR_ID). A rename is a
one-file change that disturbs nothing else, and both the old and new names stay
reserved forever.

The roster moved from a trusted-keys directory back into git, which reverses an
earlier simplification — deliberately, and in a smaller shape (one file per
account, one writer, no CAS plumbing for unused fields). Git buys what a directory
could not: `git log` answers who renamed whom and when a key appeared, and the
roster is now readable by anyone who can clone, since it is served read-only at
ssh://host/system.git. `vole request new` and `approve` use exactly that to turn a
name typed on the command line into the account id they store.

Two latent bugs surfaced, both caught by tests added here:

- gitx inherited git's repository-scoped environment. pre-receive runs with
  GIT_OBJECT_DIRECTORY and GIT_QUARANTINE_PATH pointing at the pushed repository's
  quarantine, so every git call a hook made for a *different* repository silently
  read the pushed one: the hook saw an empty roster. gitx now scrubs those
  variables and the hook restores them for the pushed repository only.
- The hook built the repository name with filepath.Base on receive-pack's path,
  which carries a trailing separator, so refusals read "does not have write access
  to .". Cleaned first.

Verified end to end on a live instance: two accounts file, approve and land a
change; `vole user rename wilbur robert` keeps the same key's write access and the
approval still reads as current, now credited to robert; the roster history shows
"user: rename wilbur to robert"; retiring an account rejects its key within five
seconds and refuses to reissue the name.

internal/id/id.go +44

@@ -0,0 +1,44 @@
	1	// Package id generates ULIDs: 26 characters of Crockford base32, the first 48
	2	// bits a millisecond timestamp. They are client-generated so nothing has to be
	3	// assigned server-side, and they sort by creation time.
	4	package id
	5
	6	import (
	7	"crypto/rand"
	8	"regexp"
	9	"time"
	10	)
	11
	12	const alphabet = "0123456789ABCDEFGHJKMNPQRSTVWXYZ"
	13
	14	var re = regexp.MustCompile(`^[0-9A-HJKMNP-TV-Z]{26}$`)
	15
	16	// New returns a ULID for t.
	17	func New(t time.Time) (string, error) {
	18	var out [26]byte
	19	ms := uint64(t.UnixMilli())
	20	for i := 9; i >= 0; i-- {
	21	out[i] = alphabet[ms&31]
	22	ms >>= 5
	23	}
	24	b := make([]byte, 16)
	25	if _, err := rand.Read(b); err != nil {
	26	return "", err
	27	}
	28	var acc uint32
	29	var bits uint
	30	pos := 10
	31	for _, x := range b {
	32	acc = acc<<8 \| uint32(x)
	33	bits += 8
	34	for bits >= 5 && pos < 26 {
	35	bits -= 5
	36	out[pos] = alphabet[(acc>>bits)&31]
	37	pos++
	38	}
	39	}
	40	return string(out[:]), nil
	41	}
	42
	43	// Valid reports whether s is a well-formed ULID.
	44	func Valid(s string) bool { return re.MatchString(s) }