Artifact [ee7af2c3db]

Artifact ee7af2c3dba121a11584becdd6916cb75aa9abff6e0c549b3b52d5b0c69add87:

• File internal/sync/stubs.go — part of check-in [612f2e7acc] at 2026-10-23 20:05:29 on branch main — feat(signing): sign check-ins and horizon seeds with gpg or ssh

  go-libfossil signed nothing and verified nothing, so a structural-horizon clone could not tell a seed its origin minted from one substituted on disk (draft-fossil-horizon-00 §5.2.4, HZ-5.2-5 and HZ-5.2-6), and a repository with fossil's clearsign setting on stored its check-ins unsigned.

  Signing follows fossil's contract, the same one zit follows. With clearsign on (and the legacy omitsign off), every check-in a commit or branch creation stores is clear-signed by pgp-command: unset, gpg --clearsign -o, run as COMMAND OUTFILE INFILE; a command named ssh* runs as COMMAND INFILE and its detached signature is wrapped in fossil's SSH envelope. A signer that fails, or returns text that does not strip back to the manifest, abandons the commit. NoSign and --nosign store one check-in unsigned.

  An origin with clearsign on signs each seed it mints. It signs only after the request is authorized, outside the request's transaction, keeps one signature per seed and command so the seed's name is stable, and re-signs a kept signature its own horizon-seed-key no longer verifies. Keeping is best effort, so a read-only mirror still serves.

  A clone given its origin's key (CloneOpts.SeedKey, repo clone --seed-key, kept as horizon-seed-key) verifies every seed on clone, pull and rebuild, and falls back to the content horizon from one unsigned or signed by another key. An SSH key is verified in process: namespace fossilscm, the configured key, no SHA-1 ssh-rsa, and exactly fossil's envelope. An OpenPGP fingerprint is verified by gpg, which must report one good signature by that key over text byte-equal to what the parser reads, with nothing after the signature. A verifier that cannot run keeps the held seed and fails the sync instead of discarding it.

  fossil 2.28 and zit read the signed check-ins; a check-in zit signs with the same SSH key verifies here; zit clones a signing origin and holds its seed. (user: [email protected], size: 2669) [annotate] [blame] [check-ins using] [more...]

package sync

import (
	"github.com/danmestas/go-libfossil/internal/cone"
	"github.com/danmestas/go-libfossil/simio"
)

// CloneOpts configures a clone operation.
type CloneOpts struct {
	StoreCone *cone.Cone // nil is dense; local policy, never synchronized
	User      string     // Credentials for clone auth (also default admin user)
	Password  string
	Version   int            // Protocol version (default 3)
	Env       *simio.Env     // nil defaults to RealEnv
	Observer  Observer       // nil defaults to no-op
	Buggify   BuggifyChecker // fault injection for DST (nil = no faults)
	// PullPhantoms, when set, makes Clone fetch the artifacts the clone
	// rounds left missing with a follow-up pull session, and fail with a
	// *PhantomStallError if any are still missing after it. That pull
	// departs from Section 8.2 of the sync draft, which sends no clone,
	// pull or push card after clone_seqno 0, so it is off by default.
	PullPhantoms bool
	// SeedKey, when set, is the origin's public key: an SSH public key line
	// or an OpenPGP fingerprint. The clone keeps it as its horizon-seed-key
	// setting and verifies every structural seed against it
	// (draft-fossil-horizon-00 §5.2.4); empty accepts an unsigned seed.
	SeedKey string
	// Origin names the peer the clone addresses, keying the horizon cursor
	// a converged horizon clone records (draft-fossil-horizon-00 §6.2.6) as
	// SyncOpts.Origin keys a sync's. Empty keeps none.
	Origin string
}

// CloneResult reports what happened during a clone.
type CloneResult struct {
	Elided        int // artifacts deliberately absent under the store cone
	ConeServed    int // replies acknowledging the store cone (sparse-cone §6.3); the rest were filtered locally
	HorizonServed int // replies serving the store's horizon at either level (horizon §6.2.5); the rest were classified locally
	// StructuralServed counts the replies that served the structural level,
	// and HorizonFallback reports a structural clone that kept the content
	// horizon instead: its origin did not serve the structural level with a
	// seed in the first reply, or the seed failed its provenance (§5.1,
	// §5.2.4, §6.3).
	StructuralServed int
	HorizonFallback  bool
	Rounds           int
	BlobsRecvd       int
	ArtifactsLinked  int // Manifests crosslinked into event table
	ProjectCode      string
	ServerCode       string
	Messages         []string // Informational messages from server
	// HorizonHistoryURL is the interface outside the protocol at which the
	// origin says history below a horizon can be queried (horizon-served
	// URL, §6.2.5), the last a reply named; "" when none did.
	HorizonHistoryURL string
}