Skip to main content

max / makenotwork

1.8 KB · 45 lines History Blame Raw
1 # git-command
2
3 The git-over-SSH command grammar, parsed once for every door that serves it.
4
5 A git client asks for a repository by sending one line:
6
7 git-upload-pack '/max/shop.git'
8
9 Two hosts on this platform receive that line: `mnw-cli`'s russh server, which is
10 what `ssh.makenot.work` runs, and `mnw-admin git-auth`, which sshd's `command=`
11 prefix invokes. Both parse it through this crate, so the grammar has one
12 implementation. A second parser anywhere is a source of divergence: the same push
13 accepted by one host and refused by the other.
14
15 ## What it promises
16
17 **Path safety.** An accepted `Request` has an owner and a repo that are each a
18 single, non-empty, non-traversing path segment, so `Request::repo_dir` cannot
19 leave the root it is given and `Request::shell_command` cannot produce more than
20 one quoted argument.
21
22 It does not decide **identity policy**: whether `max` is a real user, whether a
23 username may contain a hyphen, whether the caller may push here. That is the
24 server's job, and `Username::new` runs on top of this. Path safety is a property
25 of the string and belongs where the string is parsed; identity is a property of
26 the deployment.
27
28 ## Fuzzing
29
30 The contract is executable, in `oracle::check`. Both the libFuzzer target and
31 the committed regression replay call it, so neither can drift into checking less
32 than the other.
33
34 cargo test # unit tests + replay, stable
35 cargo +nightly fuzz run command fuzz/corpus/command fuzz/seeds/command
36
37 It is row 4 of the wiki note `astra-soak-overview`, the highest-severity target
38 in that plan, and it runs on astra's soak tier as `git-command`.
39
40 ## License
41
42 MIT. The threat model asks whether someone could collect rent with just this
43 crate and contribute nothing; a parser for a command grammar is not a service
44 anyone can run. Both consumers stay PolyForm Noncommercial.
45