| 1 |
# git-command |
| 2 |
|
| 3 |
The git-over-SSH command grammar, parsed once for every door that serves it. |
| 4 |
|
| 5 |
A git client asks for a repository by sending one line: |
| 6 |
|
| 7 |
git-upload-pack '/max/shop.git' |
| 8 |
|
| 9 |
Two hosts on this platform receive that line: `mnw-cli`'s russh server, which is |
| 10 |
what `ssh.makenot.work` runs, and `mnw-admin git-auth`, which sshd's `command=` |
| 11 |
prefix invokes. Both parse it through this crate, so the grammar has one |
| 12 |
implementation. A second parser anywhere is a source of divergence: the same push |
| 13 |
accepted by one host and refused by the other. |
| 14 |
|
| 15 |
## What it promises |
| 16 |
|
| 17 |
**Path safety.** An accepted `Request` has an owner and a repo that are each a |
| 18 |
single, non-empty, non-traversing path segment, so `Request::repo_dir` cannot |
| 19 |
leave the root it is given and `Request::shell_command` cannot produce more than |
| 20 |
one quoted argument. |
| 21 |
|
| 22 |
It does not decide **identity policy**: whether `max` is a real user, whether a |
| 23 |
username may contain a hyphen, whether the caller may push here. That is the |
| 24 |
server's job, and `Username::new` runs on top of this. Path safety is a property |
| 25 |
of the string and belongs where the string is parsed; identity is a property of |
| 26 |
the deployment. |
| 27 |
|
| 28 |
## Fuzzing |
| 29 |
|
| 30 |
The contract is executable, in `oracle::check`. Both the libFuzzer target and |
| 31 |
the committed regression replay call it, so neither can drift into checking less |
| 32 |
than the other. |
| 33 |
|
| 34 |
cargo test # unit tests + replay, stable |
| 35 |
cargo +nightly fuzz run command fuzz/corpus/command fuzz/seeds/command |
| 36 |
|
| 37 |
It is row 4 of the wiki note `astra-soak-overview`, the highest-severity target |
| 38 |
in that plan, and it runs on astra's soak tier as `git-command`. |
| 39 |
|
| 40 |
## License |
| 41 |
|
| 42 |
MIT. The threat model asks whether someone could collect rent with just this |
| 43 |
crate and contribute nothing; a parser for a command grammar is not a service |
| 44 |
anyone can run. Both consumers stay PolyForm Noncommercial. |
| 45 |
|