Prove the milestone delivers complete, secure, pure-Rust Git-over-SSH rather than URL acceptance or a partial transport stub.
Scope
Maintain a matrix covering both URL spellings across remote add/set/get, branch discovery, clone, fetch, fast-forward pull, merge/conflict pull, push, sync, progress, cancellation, retries, and every CLI/TUI/desktop presentation.
Exercise public-key file and explicitly enabled existing-agent authentication, encrypted key handling, known/unknown/changed host keys, default and non-default ports, supported host/key algorithms, DNS/network failure, server exit/signal, slow/chunked I/O, and ambiguous disconnects.
Cross-check path and remote-command behavior with Git's documented SSH rules for absolute, relative, and ~user paths and prevent command/option injection.
Audit all production code and dependency features for std::process::Command, local git/ssh/shell/helper execution, ProxyCommand, unsafe Rust, accept-all host keys, plaintext key/passphrase persistence, unbounded remote output, weak algorithms, accidental Apple enablement, and transport logic outside crates/storage.
Use a pure-Rust in-process SSH Git server fixture that implements the required upload-pack/receive-pack test behavior. Runtime and CI tests must not depend on installed Git or OpenSSH clients/servers.
Verify compatibility with representative upstream pass repositories and Gitea SSH endpoints using synthetic credentials only. Real-server checks may be a separately documented manual smoke test and must not expose private material.
Review the selected russh release and transitive crypto/runtime dependencies for licenses, target support, active security advisories, and release-size impact. Pin or upgrade to a patched version and document the chosen crypto/algorithm policy.
Confirm feature graphs for Linux, macOS, Windows, iPhone simulator/device, and release packaging. The default iPhone artifact must exclude SSH while CLI/TUI/desktop artifacts include it.
Update AGENTS.md, README, configuration, Git synchronization, secure-secret-storage, CLI parity, desktop audit, and Apple testing/distribution documentation to state the final verified contract and limitations.
Validation
Run cargo fmt --all -- --check.
Run RUSTFLAGS="-D warnings" cargo check --workspace --all-targets.
Run cargo clippy --workspace --all-targets -- -D warnings.
Run cargo test --workspace.
Run feature-isolated checks with and without ssh, inspect cargo tree -e features, and build normal release/package targets.
For Apple build-graph/documentation changes, run xcodegen generate and the affected warnings-as-errors simulator builds without destructive simulator reset.
Record the exact dependency/advisory and artifact evidence in the implementation comment before closing this issue.
Acceptance criteria
The matrix has no unexplained gap: both URL spellings complete the full remote lifecycle in CLI, TUI, and desktop.
Strict host verification, bounded authentication, cancellation, rollback, and ambiguous-failure behavior are covered end to end.
No production path launches or delegates to a local Git/SSH/shell/helper process, and project crates remain free of unsafe Rust.
HTTPS remains green; default Apple/iPhone remains SSH-free; normal CLI/TUI/desktop releases include SSH.
Documentation accurately distinguishes complete Git transport from unsupported OpenSSH extensions such as ProxyCommand, arbitrary OpenSSH config execution, password/keyboard-interactive authentication, and local helper transports.
Depends on every other issue in milestone 07.
## Goal
Prove the milestone delivers complete, secure, pure-Rust Git-over-SSH rather than URL acceptance or a partial transport stub.
## Scope
- Maintain a matrix covering both URL spellings across remote add/set/get, branch discovery, clone, fetch, fast-forward pull, merge/conflict pull, push, sync, progress, cancellation, retries, and every CLI/TUI/desktop presentation.
- Exercise public-key file and explicitly enabled existing-agent authentication, encrypted key handling, known/unknown/changed host keys, default and non-default ports, supported host/key algorithms, DNS/network failure, server exit/signal, slow/chunked I/O, and ambiguous disconnects.
- Cross-check path and remote-command behavior with Git's documented SSH rules for absolute, relative, and `~user` paths and prevent command/option injection.
- Audit all production code and dependency features for `std::process::Command`, local `git`/`ssh`/shell/helper execution, `ProxyCommand`, unsafe Rust, accept-all host keys, plaintext key/passphrase persistence, unbounded remote output, weak algorithms, accidental Apple enablement, and transport logic outside `crates/storage`.
- Use a pure-Rust in-process SSH Git server fixture that implements the required upload-pack/receive-pack test behavior. Runtime and CI tests must not depend on installed Git or OpenSSH clients/servers.
- Verify compatibility with representative upstream `pass` repositories and Gitea SSH endpoints using synthetic credentials only. Real-server checks may be a separately documented manual smoke test and must not expose private material.
- Review the selected `russh` release and transitive crypto/runtime dependencies for licenses, target support, active security advisories, and release-size impact. Pin or upgrade to a patched version and document the chosen crypto/algorithm policy.
- Confirm feature graphs for Linux, macOS, Windows, iPhone simulator/device, and release packaging. The default iPhone artifact must exclude SSH while CLI/TUI/desktop artifacts include it.
- Update `AGENTS.md`, README, configuration, Git synchronization, secure-secret-storage, CLI parity, desktop audit, and Apple testing/distribution documentation to state the final verified contract and limitations.
## Validation
- Run `cargo fmt --all -- --check`.
- Run `RUSTFLAGS="-D warnings" cargo check --workspace --all-targets`.
- Run `cargo clippy --workspace --all-targets -- -D warnings`.
- Run `cargo test --workspace`.
- Run feature-isolated checks with and without `ssh`, inspect `cargo tree -e features`, and build normal release/package targets.
- For Apple build-graph/documentation changes, run `xcodegen generate` and the affected warnings-as-errors simulator builds without destructive simulator reset.
- Record the exact dependency/advisory and artifact evidence in the implementation comment before closing this issue.
## Acceptance criteria
- The matrix has no unexplained gap: both URL spellings complete the full remote lifecycle in CLI, TUI, and desktop.
- Strict host verification, bounded authentication, cancellation, rollback, and ambiguous-failure behavior are covered end to end.
- No production path launches or delegates to a local Git/SSH/shell/helper process, and project crates remain free of unsafe Rust.
- HTTPS remains green; default Apple/iPhone remains SSH-free; normal CLI/TUI/desktop releases include SSH.
- Documentation accurately distinguishes complete Git transport from unsupported OpenSSH extensions such as `ProxyCommand`, arbitrary OpenSSH config execution, password/keyboard-interactive authentication, and local helper transports.
Depends on every other issue in milestone 07.
hugo
added this to the 07 - Pure-Rust Git-over-SSH remotes milestone 2026-08-24 20:17:08 +00:00
Implemented and verified in commit a3da9fd (Complete SSH transport release audit).
Implementation:
Added the final two-URL lifecycle matrix. Both ssh:// and scp-like remotes now exercise add/set/get, discovery, clone, explicit fetch, fast-forward pull, merge/conflict rollback, new/fast-forward/already-current push, and pull-then-push sync against the pure-Rust in-process SSH Git server.
Added explicit client-owned algorithm policy: modern SHA-2/SHA-512 KEX, Ed25519/ECDSA/RSA-SHA2 keys, ChaCha20-Poly1305/AES-GCM/CTR, SHA-2 MACs, no compression, and no host certificates. Legacy SHA-1, DSA, CBC, none, and RSA/SHA-1 are excluded and regression-tested.
Exactly pinned Russh 0.63.1 with default features off and ring+rsa only. Added executable release/feature/security audit tests and a weekly/push/PR cargo-audit workflow that ignores only RUSTSEC-2023-0071.
Added docs/ssh-transport-audit.md and reconciled AGENTS, README, dependency, configuration, Git sync, secure-secret, CLI, desktop, and Apple testing/distribution contracts.
cargo bundle-macos: passed and produced a signed local IronStorage.app containing the SSH-enabled CLI, TUI, and desktop binaries
Computer Use: launched that packaged desktop app, opened Tools > Git Status, verified the storage-owned transport/host-trust notice and clean typed repository state, then quit normally
xcodegen generate plus the IronStorage iPhone simulator build for F715B99A-4729-4315-81F7-6697C93057BD: BUILD SUCCEEDED. Apple source/runtime was unchanged, so no app install or physical iPhone deploy was needed.
Dependency and target evidence:
Russh 0.63.1: Apache-2.0, MSRV 1.85; project toolchain 1.92.0. Tokio lockfile version 1.53.1: MIT.
Target cargo tree -e features shows Russh ring+rsa through storage ssh for macOS CLI, Linux TUI, and Windows desktop. Both aarch64-apple-ios and aarch64-apple-ios-sim Apple graphs report no Russh package; the built simulator static library also contains no Russh symbol/string.
The host Mac cannot directly link aarch64-unknown-linux-gnu because aarch64-linux-gnu-gcc is not installed. The checked-in tagged release workflow instead uses the pinned cargo-zigbuild container for Linux/macOS and pinned cargo-xwin container for Windows; the target feature graphs were inspected locally.
Audit and artifact evidence:
Full cargo audit 0.22.2 reports exactly two instances of RUSTSEC-2023-0071, both medium 5.9 with no fixed upgrade: rsa 0.10.0-rc.18 through Russh/ssh-key and rsa 0.9.10 through existing pgp/apple-codesign. It also reports 15 allowed unmaintained/unsound warnings.
cargo audit --ignore RUSTSEC-2023-0071 exits successfully. CI names only that no-fix advisory, so any other vulnerability fails.
Storage full without SSH: 422 compiled packages, 15,961,360-byte optimized rlib. Storage full+ssh: 489 packages, 18,376,592-byte rlib; delta 67 packages and 2,415,232 bytes (15.1%).
Final review found no unexplained matrix gap, process/helper/proxy/unsafe/host-bypass escape hatch, Apple feature leak, or transport policy outside crates/storage. A real Gitea smoke is deliberately optional; the synthetic in-process server validates the exact upload-pack/receive-pack exec and packet-line behavior without private credentials or external Git/OpenSSH processes.
Implemented and verified in commit a3da9fd (Complete SSH transport release audit).
Implementation:
- Added the final two-URL lifecycle matrix. Both ssh:// and scp-like remotes now exercise add/set/get, discovery, clone, explicit fetch, fast-forward pull, merge/conflict rollback, new/fast-forward/already-current push, and pull-then-push sync against the pure-Rust in-process SSH Git server.
- Added explicit client-owned algorithm policy: modern SHA-2/SHA-512 KEX, Ed25519/ECDSA/RSA-SHA2 keys, ChaCha20-Poly1305/AES-GCM/CTR, SHA-2 MACs, no compression, and no host certificates. Legacy SHA-1, DSA, CBC, none, and RSA/SHA-1 are excluded and regression-tested.
- Expanded host/user algorithm, DNS/network, exact service-command/path, chunking, cancellation, rollback, and ambiguous push coverage. Existing agent, encrypted-key retry, known/unknown/changed-host, non-default-port, exit/signal, malformed stream, progress, frontend retry, and HTTPS regression coverage remains green.
- Exactly pinned Russh 0.63.1 with default features off and ring+rsa only. Added executable release/feature/security audit tests and a weekly/push/PR cargo-audit workflow that ignores only RUSTSEC-2023-0071.
- Added docs/ssh-transport-audit.md and reconciled AGENTS, README, dependency, configuration, Git sync, secure-secret, CLI, desktop, and Apple testing/distribution contracts.
Verification on the committed tree:
- cargo fmt --all -- --check: passed
- RUSTFLAGS=-D warnings cargo check --workspace --all-targets: passed
- cargo clippy --workspace --all-targets -- -D warnings: passed
- cargo test --workspace: passed, including 58 storage unit tests, 2 release-audit tests, 17 CLI tests, 37 desktop tests, and 102 TUI tests
- No-SSH storage feature test: passed; SSH endpoints remain typed and fail before transport/mutation
- cargo metadata --locked and git diff --check: passed
- Focused full-lifecycle, push, sync, DNS/network, algorithm-policy, remote add/set/get, and release-audit tests: passed
- cargo bundle-macos: passed and produced a signed local IronStorage.app containing the SSH-enabled CLI, TUI, and desktop binaries
- Computer Use: launched that packaged desktop app, opened Tools > Git Status, verified the storage-owned transport/host-trust notice and clean typed repository state, then quit normally
- xcodegen generate plus the IronStorage iPhone simulator build for F715B99A-4729-4315-81F7-6697C93057BD: BUILD SUCCEEDED. Apple source/runtime was unchanged, so no app install or physical iPhone deploy was needed.
Dependency and target evidence:
- Russh 0.63.1: Apache-2.0, MSRV 1.85; project toolchain 1.92.0. Tokio lockfile version 1.53.1: MIT.
- Target cargo tree -e features shows Russh ring+rsa through storage ssh for macOS CLI, Linux TUI, and Windows desktop. Both aarch64-apple-ios and aarch64-apple-ios-sim Apple graphs report no Russh package; the built simulator static library also contains no Russh symbol/string.
- The host Mac cannot directly link aarch64-unknown-linux-gnu because aarch64-linux-gnu-gcc is not installed. The checked-in tagged release workflow instead uses the pinned cargo-zigbuild container for Linux/macOS and pinned cargo-xwin container for Windows; the target feature graphs were inspected locally.
Audit and artifact evidence:
- Full cargo audit 0.22.2 reports exactly two instances of RUSTSEC-2023-0071, both medium 5.9 with no fixed upgrade: rsa 0.10.0-rc.18 through Russh/ssh-key and rsa 0.9.10 through existing pgp/apple-codesign. It also reports 15 allowed unmaintained/unsound warnings.
- cargo audit --ignore RUSTSEC-2023-0071 exits successfully. CI names only that no-fix advisory, so any other vulnerability fails.
- Storage full without SSH: 422 compiled packages, 15,961,360-byte optimized rlib. Storage full+ssh: 489 packages, 18,376,592-byte rlib; delta 67 packages and 2,415,232 bytes (15.1%).
- Packaged binaries: CLI 25,687,424 bytes; TUI 26,550,816 bytes; desktop 37,349,248 bytes; complete app bundle 89,112 KiB.
Final review found no unexplained matrix gap, process/helper/proxy/unsafe/host-bypass escape hatch, Apple feature leak, or transport policy outside crates/storage. A real Gitea smoke is deliberately optional; the synthetic in-process server validates the exact upload-pack/receive-pack exec and packet-line behavior without private credentials or external Git/OpenSSH processes.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Goal
Prove the milestone delivers complete, secure, pure-Rust Git-over-SSH rather than URL acceptance or a partial transport stub.
Scope
~userpaths and prevent command/option injection.std::process::Command, localgit/ssh/shell/helper execution,ProxyCommand, unsafe Rust, accept-all host keys, plaintext key/passphrase persistence, unbounded remote output, weak algorithms, accidental Apple enablement, and transport logic outsidecrates/storage.passrepositories and Gitea SSH endpoints using synthetic credentials only. Real-server checks may be a separately documented manual smoke test and must not expose private material.russhrelease and transitive crypto/runtime dependencies for licenses, target support, active security advisories, and release-size impact. Pin or upgrade to a patched version and document the chosen crypto/algorithm policy.AGENTS.md, README, configuration, Git synchronization, secure-secret-storage, CLI parity, desktop audit, and Apple testing/distribution documentation to state the final verified contract and limitations.Validation
cargo fmt --all -- --check.RUSTFLAGS="-D warnings" cargo check --workspace --all-targets.cargo clippy --workspace --all-targets -- -D warnings.cargo test --workspace.ssh, inspectcargo tree -e features, and build normal release/package targets.xcodegen generateand the affected warnings-as-errors simulator builds without destructive simulator reset.Acceptance criteria
ProxyCommand, arbitrary OpenSSH config execution, password/keyboard-interactive authentication, and local helper transports.Depends on every other issue in milestone 07.
Implemented and verified in commit
a3da9fd(Complete SSH transport release audit).Implementation:
Verification on the committed tree:
Dependency and target evidence:
Audit and artifact evidence:
Final review found no unexplained matrix gap, process/helper/proxy/unsafe/host-bypass escape hatch, Apple feature leak, or transport policy outside crates/storage. A real Gitea smoke is deliberately optional; the synthetic in-process server validates the exact upload-pack/receive-pack exec and packet-line behavior without private credentials or external Git/OpenSSH processes.