Complete SSH transport release audit (#118)

crates/storage/tests/git_embedded.rs

@@ -208,12 +208,17 @@ fn ssh_remotes_are_typed_but_unavailable_before_transport_or_mutation() -> TestR
 
 #[cfg(feature = "ssh")]
 #[test]
-fn ssh_feature_allows_repository_remote_configuration() -> TestResult {
+fn ssh_feature_allows_both_remote_forms_through_add_set_and_get() -> TestResult {
     let temporary = tempfile::tempdir()?;
     let store = Repository::open(temporary.path())?;
     let mut git = GitRepository::init(&store, identity())?;
     git.add_remote("origin", "git@example.test:team/store.git")?;
     assert_eq!(git.remote_url("origin")?, "git@example.test:team/store.git");
+    git.set_remote_url("origin", "ssh://git@example.test/team/store.git")?;
+    assert_eq!(
+        git.remote_url("origin")?,
+        "ssh://git@example.test/team/store.git"
+    );
     Ok(())
 }
 

crates/storage/tests/ssh_release_audit.rs

@@ -0,0 +1,53 @@
+const WORKSPACE: &str = include_str!("../../../Cargo.toml");
+const STORAGE_MANIFEST: &str = include_str!("../Cargo.toml");
+const APPLE_MANIFEST: &str = include_str!("../../apple/Cargo.toml");
+const CLI_MANIFEST: &str = include_str!("../../../apps/cli/Cargo.toml");
+const TUI_MANIFEST: &str = include_str!("../../../apps/tui/Cargo.toml");
+const DESKTOP_MANIFEST: &str = include_str!("../../../apps/desktop/Cargo.toml");
+const SSH_SOURCE: &str = include_str!("../src/ssh.rs");
+const GIT_SOURCE: &str = include_str!("../src/git.rs");
+const AUDIT: &str = include_str!("../../../docs/ssh-transport-audit.md");
+const AUDIT_WORKFLOW: &str = include_str!("../../../.gitea/workflows/security-audit.yml");
+
+#[test]
+fn release_feature_and_advisory_boundaries_stay_explicit() {
+    assert!(WORKSPACE.contains(
+        "russh = { version = \"=0.63.1\", default-features = false, features = [\"ring\", \"rsa\"] }"
+    ));
+    assert!(STORAGE_MANIFEST.contains("ssh = [\"dep:russh\", \"dep:tokio\"]"));
+    for manifest in [CLI_MANIFEST, TUI_MANIFEST, DESKTOP_MANIFEST] {
+        assert!(manifest.contains("features = [\"ssh\"]"));
+    }
+    assert!(APPLE_MANIFEST.contains("default-features = false, features = [\"full\"]"));
+    assert!(!APPLE_MANIFEST.contains("features = [\"ssh\"]"));
+    assert!(AUDIT_WORKFLOW.contains("cargo-audit --locked --version 0.22.2"));
+    assert!(AUDIT_WORKFLOW.contains("cargo audit --ignore RUSTSEC-2023-0071"));
+    assert!(AUDIT.contains("RUSTSEC-2023-0071"));
+}
+
+#[test]
+fn production_ssh_transport_has_no_process_unsafe_or_proxy_escape_hatch() {
+    let process_command = ["process", "::Command"].concat();
+    let command_constructor = ["Command", "::new("].concat();
+    let unsafe_block = ["unsafe", " {"].concat();
+    for (name, source) in [("ssh.rs", SSH_SOURCE), ("git.rs", GIT_SOURCE)] {
+        let production = source.split("#[cfg(test)]").next().unwrap_or(source);
+        for forbidden in [
+            process_command.as_str(),
+            command_constructor.as_str(),
+            unsafe_block.as_str(),
+            "ProxyCommand",
+            "proxy_command",
+            "russh_config",
+        ] {
+            assert!(
+                !production.contains(forbidden),
+                "{name} contains forbidden production token {forbidden}"
+            );
+        }
+    }
+    assert!(SSH_SOURCE.contains("check_server_key"));
+    assert!(SSH_SOURCE.contains("verify_known_host"));
+    assert!(SSH_SOURCE.contains("MAX_SSH_DIAGNOSTIC_BYTES"));
+    assert!(SSH_SOURCE.contains("MAX_CHANNEL_CHUNK"));
+}