Complete the SSH transport compatibility, security, and release audit #118

New Issue

hugo · 2026-08-24T20:17:08Z

hugo commented

2026-08-24 20:17:08 +00:00

Goal

Prove the milestone delivers complete, secure, pure-Rust Git-over-SSH rather than URL acceptance or a partial transport stub.

Scope

Maintain a matrix covering both URL spellings across remote add/set/get, branch discovery, clone, fetch, fast-forward pull, merge/conflict pull, push, sync, progress, cancellation, retries, and every CLI/TUI/desktop presentation.
Exercise public-key file and explicitly enabled existing-agent authentication, encrypted key handling, known/unknown/changed host keys, default and non-default ports, supported host/key algorithms, DNS/network failure, server exit/signal, slow/chunked I/O, and ambiguous disconnects.
Cross-check path and remote-command behavior with Git's documented SSH rules for absolute, relative, and ~user paths and prevent command/option injection.
Audit all production code and dependency features for std::process::Command, local git/ssh/shell/helper execution, ProxyCommand, unsafe Rust, accept-all host keys, plaintext key/passphrase persistence, unbounded remote output, weak algorithms, accidental Apple enablement, and transport logic outside crates/storage.
Use a pure-Rust in-process SSH Git server fixture that implements the required upload-pack/receive-pack test behavior. Runtime and CI tests must not depend on installed Git or OpenSSH clients/servers.
Verify compatibility with representative upstream pass repositories and Gitea SSH endpoints using synthetic credentials only. Real-server checks may be a separately documented manual smoke test and must not expose private material.
Review the selected russh release and transitive crypto/runtime dependencies for licenses, target support, active security advisories, and release-size impact. Pin or upgrade to a patched version and document the chosen crypto/algorithm policy.
Confirm feature graphs for Linux, macOS, Windows, iPhone simulator/device, and release packaging. The default iPhone artifact must exclude SSH while CLI/TUI/desktop artifacts include it.
Update AGENTS.md, README, configuration, Git synchronization, secure-secret-storage, CLI parity, desktop audit, and Apple testing/distribution documentation to state the final verified contract and limitations.

Validation

Run cargo fmt --all -- --check.
Run RUSTFLAGS="-D warnings" cargo check --workspace --all-targets.
Run cargo clippy --workspace --all-targets -- -D warnings.
Run cargo test --workspace.
Run feature-isolated checks with and without ssh, inspect cargo tree -e features, and build normal release/package targets.
For Apple build-graph/documentation changes, run xcodegen generate and the affected warnings-as-errors simulator builds without destructive simulator reset.
Record the exact dependency/advisory and artifact evidence in the implementation comment before closing this issue.

Acceptance criteria

The matrix has no unexplained gap: both URL spellings complete the full remote lifecycle in CLI, TUI, and desktop.
Strict host verification, bounded authentication, cancellation, rollback, and ambiguous-failure behavior are covered end to end.
No production path launches or delegates to a local Git/SSH/shell/helper process, and project crates remain free of unsafe Rust.
HTTPS remains green; default Apple/iPhone remains SSH-free; normal CLI/TUI/desktop releases include SSH.
Documentation accurately distinguishes complete Git transport from unsupported OpenSSH extensions such as ProxyCommand, arbitrary OpenSSH config execution, password/keyboard-interactive authentication, and local helper transports.

Depends on every other issue in milestone 07.

## Goal Prove the milestone delivers complete, secure, pure-Rust Git-over-SSH rather than URL acceptance or a partial transport stub. ## Scope - Maintain a matrix covering both URL spellings across remote add/set/get, branch discovery, clone, fetch, fast-forward pull, merge/conflict pull, push, sync, progress, cancellation, retries, and every CLI/TUI/desktop presentation. - Exercise public-key file and explicitly enabled existing-agent authentication, encrypted key handling, known/unknown/changed host keys, default and non-default ports, supported host/key algorithms, DNS/network failure, server exit/signal, slow/chunked I/O, and ambiguous disconnects. - Cross-check path and remote-command behavior with Git's documented SSH rules for absolute, relative, and `~user` paths and prevent command/option injection. - Audit all production code and dependency features for `std::process::Command`, local `git`/`ssh`/shell/helper execution, `ProxyCommand`, unsafe Rust, accept-all host keys, plaintext key/passphrase persistence, unbounded remote output, weak algorithms, accidental Apple enablement, and transport logic outside `crates/storage`. - Use a pure-Rust in-process SSH Git server fixture that implements the required upload-pack/receive-pack test behavior. Runtime and CI tests must not depend on installed Git or OpenSSH clients/servers. - Verify compatibility with representative upstream `pass` repositories and Gitea SSH endpoints using synthetic credentials only. Real-server checks may be a separately documented manual smoke test and must not expose private material. - Review the selected `russh` release and transitive crypto/runtime dependencies for licenses, target support, active security advisories, and release-size impact. Pin or upgrade to a patched version and document the chosen crypto/algorithm policy. - Confirm feature graphs for Linux, macOS, Windows, iPhone simulator/device, and release packaging. The default iPhone artifact must exclude SSH while CLI/TUI/desktop artifacts include it. - Update `AGENTS.md`, README, configuration, Git synchronization, secure-secret-storage, CLI parity, desktop audit, and Apple testing/distribution documentation to state the final verified contract and limitations. ## Validation - Run `cargo fmt --all -- --check`. - Run `RUSTFLAGS="-D warnings" cargo check --workspace --all-targets`. - Run `cargo clippy --workspace --all-targets -- -D warnings`. - Run `cargo test --workspace`. - Run feature-isolated checks with and without `ssh`, inspect `cargo tree -e features`, and build normal release/package targets. - For Apple build-graph/documentation changes, run `xcodegen generate` and the affected warnings-as-errors simulator builds without destructive simulator reset. - Record the exact dependency/advisory and artifact evidence in the implementation comment before closing this issue. ## Acceptance criteria - The matrix has no unexplained gap: both URL spellings complete the full remote lifecycle in CLI, TUI, and desktop. - Strict host verification, bounded authentication, cancellation, rollback, and ambiguous-failure behavior are covered end to end. - No production path launches or delegates to a local Git/SSH/shell/helper process, and project crates remain free of unsafe Rust. - HTTPS remains green; default Apple/iPhone remains SSH-free; normal CLI/TUI/desktop releases include SSH. - Documentation accurately distinguishes complete Git transport from unsupported OpenSSH extensions such as `ProxyCommand`, arbitrary OpenSSH config execution, password/keyboard-interactive authentication, and local helper transports. Depends on every other issue in milestone 07.

hugo added this to the 07 - Pure-Rust Git-over-SSH remotes milestone 2026-08-24 20:17:08 +00:00

hugo added the enhancement label 2026-08-24 20:17:08 +00:00

hugo referenced this issue

2026-08-25 19:40:05 +00:00

Enable SSH remotes in CLI, TUI, and desktop while keeping iPhone opt-in #117

hugo referenced this issue from a commit

2026-08-25 20:07:52 +00:00

Complete SSH transport release audit (#118)

hugo commented

2026-08-25 20:08:39 +00:00

Implemented and verified in commit a3da9fd (Complete SSH transport release audit).

Implementation:

Added the final two-URL lifecycle matrix. Both ssh:// and scp-like remotes now exercise add/set/get, discovery, clone, explicit fetch, fast-forward pull, merge/conflict rollback, new/fast-forward/already-current push, and pull-then-push sync against the pure-Rust in-process SSH Git server.
Added explicit client-owned algorithm policy: modern SHA-2/SHA-512 KEX, Ed25519/ECDSA/RSA-SHA2 keys, ChaCha20-Poly1305/AES-GCM/CTR, SHA-2 MACs, no compression, and no host certificates. Legacy SHA-1, DSA, CBC, none, and RSA/SHA-1 are excluded and regression-tested.
Expanded host/user algorithm, DNS/network, exact service-command/path, chunking, cancellation, rollback, and ambiguous push coverage. Existing agent, encrypted-key retry, known/unknown/changed-host, non-default-port, exit/signal, malformed stream, progress, frontend retry, and HTTPS regression coverage remains green.
Exactly pinned Russh 0.63.1 with default features off and ring+rsa only. Added executable release/feature/security audit tests and a weekly/push/PR cargo-audit workflow that ignores only RUSTSEC-2023-0071.
Added docs/ssh-transport-audit.md and reconciled AGENTS, README, dependency, configuration, Git sync, secure-secret, CLI, desktop, and Apple testing/distribution contracts.

Verification on the committed tree:

cargo fmt --all -- --check: passed
RUSTFLAGS=-D warnings cargo check --workspace --all-targets: passed
cargo clippy --workspace --all-targets -- -D warnings: passed
cargo test --workspace: passed, including 58 storage unit tests, 2 release-audit tests, 17 CLI tests, 37 desktop tests, and 102 TUI tests
No-SSH storage feature test: passed; SSH endpoints remain typed and fail before transport/mutation
cargo metadata --locked and git diff --check: passed
Focused full-lifecycle, push, sync, DNS/network, algorithm-policy, remote add/set/get, and release-audit tests: passed
cargo bundle-macos: passed and produced a signed local IronStorage.app containing the SSH-enabled CLI, TUI, and desktop binaries
Computer Use: launched that packaged desktop app, opened Tools > Git Status, verified the storage-owned transport/host-trust notice and clean typed repository state, then quit normally
xcodegen generate plus the IronStorage iPhone simulator build for F715B99A-4729-4315-81F7-6697C93057BD: BUILD SUCCEEDED. Apple source/runtime was unchanged, so no app install or physical iPhone deploy was needed.

Dependency and target evidence:

Russh 0.63.1: Apache-2.0, MSRV 1.85; project toolchain 1.92.0. Tokio lockfile version 1.53.1: MIT.
Target cargo tree -e features shows Russh ring+rsa through storage ssh for macOS CLI, Linux TUI, and Windows desktop. Both aarch64-apple-ios and aarch64-apple-ios-sim Apple graphs report no Russh package; the built simulator static library also contains no Russh symbol/string.
The host Mac cannot directly link aarch64-unknown-linux-gnu because aarch64-linux-gnu-gcc is not installed. The checked-in tagged release workflow instead uses the pinned cargo-zigbuild container for Linux/macOS and pinned cargo-xwin container for Windows; the target feature graphs were inspected locally.

Audit and artifact evidence:

Full cargo audit 0.22.2 reports exactly two instances of RUSTSEC-2023-0071, both medium 5.9 with no fixed upgrade: rsa 0.10.0-rc.18 through Russh/ssh-key and rsa 0.9.10 through existing pgp/apple-codesign. It also reports 15 allowed unmaintained/unsound warnings.
cargo audit --ignore RUSTSEC-2023-0071 exits successfully. CI names only that no-fix advisory, so any other vulnerability fails.
Storage full without SSH: 422 compiled packages, 15,961,360-byte optimized rlib. Storage full+ssh: 489 packages, 18,376,592-byte rlib; delta 67 packages and 2,415,232 bytes (15.1%).
Packaged binaries: CLI 25,687,424 bytes; TUI 26,550,816 bytes; desktop 37,349,248 bytes; complete app bundle 89,112 KiB.

Final review found no unexplained matrix gap, process/helper/proxy/unsafe/host-bypass escape hatch, Apple feature leak, or transport policy outside crates/storage. A real Gitea smoke is deliberately optional; the synthetic in-process server validates the exact upload-pack/receive-pack exec and packet-line behavior without private credentials or external Git/OpenSSH processes.

Implemented and verified in commit a3da9fd (Complete SSH transport release audit). Implementation: - Added the final two-URL lifecycle matrix. Both ssh:// and scp-like remotes now exercise add/set/get, discovery, clone, explicit fetch, fast-forward pull, merge/conflict rollback, new/fast-forward/already-current push, and pull-then-push sync against the pure-Rust in-process SSH Git server. - Added explicit client-owned algorithm policy: modern SHA-2/SHA-512 KEX, Ed25519/ECDSA/RSA-SHA2 keys, ChaCha20-Poly1305/AES-GCM/CTR, SHA-2 MACs, no compression, and no host certificates. Legacy SHA-1, DSA, CBC, none, and RSA/SHA-1 are excluded and regression-tested. - Expanded host/user algorithm, DNS/network, exact service-command/path, chunking, cancellation, rollback, and ambiguous push coverage. Existing agent, encrypted-key retry, known/unknown/changed-host, non-default-port, exit/signal, malformed stream, progress, frontend retry, and HTTPS regression coverage remains green. - Exactly pinned Russh 0.63.1 with default features off and ring+rsa only. Added executable release/feature/security audit tests and a weekly/push/PR cargo-audit workflow that ignores only RUSTSEC-2023-0071. - Added docs/ssh-transport-audit.md and reconciled AGENTS, README, dependency, configuration, Git sync, secure-secret, CLI, desktop, and Apple testing/distribution contracts. Verification on the committed tree: - cargo fmt --all -- --check: passed - RUSTFLAGS=-D warnings cargo check --workspace --all-targets: passed - cargo clippy --workspace --all-targets -- -D warnings: passed - cargo test --workspace: passed, including 58 storage unit tests, 2 release-audit tests, 17 CLI tests, 37 desktop tests, and 102 TUI tests - No-SSH storage feature test: passed; SSH endpoints remain typed and fail before transport/mutation - cargo metadata --locked and git diff --check: passed - Focused full-lifecycle, push, sync, DNS/network, algorithm-policy, remote add/set/get, and release-audit tests: passed - cargo bundle-macos: passed and produced a signed local IronStorage.app containing the SSH-enabled CLI, TUI, and desktop binaries - Computer Use: launched that packaged desktop app, opened Tools > Git Status, verified the storage-owned transport/host-trust notice and clean typed repository state, then quit normally - xcodegen generate plus the IronStorage iPhone simulator build for F715B99A-4729-4315-81F7-6697C93057BD: BUILD SUCCEEDED. Apple source/runtime was unchanged, so no app install or physical iPhone deploy was needed. Dependency and target evidence: - Russh 0.63.1: Apache-2.0, MSRV 1.85; project toolchain 1.92.0. Tokio lockfile version 1.53.1: MIT. - Target cargo tree -e features shows Russh ring+rsa through storage ssh for macOS CLI, Linux TUI, and Windows desktop. Both aarch64-apple-ios and aarch64-apple-ios-sim Apple graphs report no Russh package; the built simulator static library also contains no Russh symbol/string. - The host Mac cannot directly link aarch64-unknown-linux-gnu because aarch64-linux-gnu-gcc is not installed. The checked-in tagged release workflow instead uses the pinned cargo-zigbuild container for Linux/macOS and pinned cargo-xwin container for Windows; the target feature graphs were inspected locally. Audit and artifact evidence: - Full cargo audit 0.22.2 reports exactly two instances of RUSTSEC-2023-0071, both medium 5.9 with no fixed upgrade: rsa 0.10.0-rc.18 through Russh/ssh-key and rsa 0.9.10 through existing pgp/apple-codesign. It also reports 15 allowed unmaintained/unsound warnings. - cargo audit --ignore RUSTSEC-2023-0071 exits successfully. CI names only that no-fix advisory, so any other vulnerability fails. - Storage full without SSH: 422 compiled packages, 15,961,360-byte optimized rlib. Storage full+ssh: 489 packages, 18,376,592-byte rlib; delta 67 packages and 2,415,232 bytes (15.1%). - Packaged binaries: CLI 25,687,424 bytes; TUI 26,550,816 bytes; desktop 37,349,248 bytes; complete app bundle 89,112 KiB. Final review found no unexplained matrix gap, process/helper/proxy/unsafe/host-bypass escape hatch, Apple feature leak, or transport policy outside crates/storage. A real Gitea smoke is deliberately optional; the synthetic in-process server validates the exact upload-pack/receive-pack exec and packet-line behavior without private credentials or external Git/OpenSSH processes.

hugo closed this issue

2026-08-25 20:08:43 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: hugo/IronStorage#118