| 1 |
# git-command |
| 2 |
|
| 3 |
The git-over-SSH command grammar, parsed once for every door that serves it. |
| 4 |
|
| 5 |
A git client asks for a repository by sending one line: |
| 6 |
|
| 7 |
git-upload-pack '/max/shop.git' |
| 8 |
|
| 9 |
Two hosts on this platform receive that line: `mnw-cli`'s russh server, which is |
| 10 |
what `ssh.makenot.work` runs, and `mnw-admin git-auth`, which sshd's `command=` |
| 11 |
prefix invokes. Until 2026-08-12 each parsed the line itself, and the two |
| 12 |
hand-written parsers disagreed on 51 of 5,424 measured commands. None of the |
| 13 |
divergences was an escape, because the charset guards downstream held on both |
| 14 |
sides. All of them meant the same push succeeded against one host and failed |
| 15 |
against the other. |
| 16 |
|
| 17 |
One grammar with two implementations is the defect. This crate is the grammar. |
| 18 |
|
| 19 |
## What it promises |
| 20 |
|
| 21 |
**Path safety.** An accepted `Request` has an owner and a repo that are each a |
| 22 |
single, non-empty, non-traversing path segment, so `Request::repo_dir` cannot |
| 23 |
leave the root it is given and `Request::shell_command` cannot produce more than |
| 24 |
one quoted argument. |
| 25 |
|
| 26 |
It does not decide **identity policy** — whether `max` is a real user, whether a |
| 27 |
username may contain a hyphen, whether the caller may push here. That is the |
| 28 |
server's, and `Username::new` still runs on top of this. Path safety is a |
| 29 |
property of the string and belongs where the string is parsed; identity is a |
| 30 |
property of the deployment. |
| 31 |
|
| 32 |
## Fuzzing |
| 33 |
|
| 34 |
The contract is executable, in `oracle::check`. Both the libFuzzer target and |
| 35 |
the committed regression replay call it, so neither can drift into checking less |
| 36 |
than the other. |
| 37 |
|
| 38 |
cargo test # unit tests + replay, stable |
| 39 |
cargo +nightly fuzz run command fuzz/corpus/command fuzz/seeds/command |
| 40 |
|
| 41 |
It is row 4 of the wiki note `astra-soak-overview`, the highest-severity target |
| 42 |
in that plan, and it runs on astra's soak tier as `git-command`. The oracle |
| 43 |
earned its keep on the first run: 90 seconds in, it found that a repo name |
| 44 |
ending in a dot produced a `git-shell` line this parser itself refused. |
| 45 |
|
| 46 |
## License |
| 47 |
|
| 48 |
MIT. The threat model asks whether someone could collect rent with just this |
| 49 |
crate and contribute nothing; a parser for a command grammar is not a service |
| 50 |
anyone can run. Both consumers stay PolyForm Noncommercial. |
| 51 |
|