Commit `77ff123033`

77ff123033d5374a8e17162f96514342049c19df

parent: ead6796abe

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-28 22:56 UTC

wiki: unkeyed audit chain, stall kill, enforced limits, pack-limit gaps

Ref #275
Ref #262

Layout: unified · split

.gitbay/wiki/Admin.org +18 −6

   at most =pack_concurrency= − 1 slots when it is above 1, so a signed-in
   client (SSH key, bearer token or web session) can always get the last.
   Past that an SSH client gets "the server is busy…" and exit 1, HTTP
-  gets 503 with =Retry-After: 30=, git:// an =ERR= line. A queued
+  gets 503 with =Retry-After: 30=, git:// an =ERR= line. An SSH client
-  client that disconnects leaves the queue; a running clone whose
+  that disconnects while queued leaves the queue; an HTTP or git:// one
-  client disconnects is killed. Ref listings (info/refs, protocol v2
+  keeps its place until the wait runs out. A running clone is killed
+  when its client disconnects, or when no write to the client completes
+  for two minutes: a client reading below about 550 B/s, or an HTTP
+  request body that takes over two minutes with nothing written back,
+  is cut. Ref listings (info/refs, protocol v2
   =ls-refs=), pushes and =repo download= are outside the budget. For the
   three counts 0 means the default and a negative value turns that
   bound off. The defaults suit a four-core host; see [[Performance]].
   With =ssh.mode = "system"= each SSH session is its own process and
   SSH clones are not counted.
-- =max_pack_bytes=, =ssh_auth_rate= — reserved, not yet enforced.
+- =max_pack_bytes= (2 GiB) — the largest pack one push may send,
+  enforced as =receive.maxInputSize= and lowered to what an owner's
+  storage quota has left.
+- =ssh_auth_rate= (10) — SSH authentication failures per client address
+  per minute on the embedded listener; see below.
 ** [git_daemon]
 - =enabled= (false), =port= (9418) — the anonymous =git://= listener.
 verify= opens the store as other admin commands do, applying pending
 migrations, so run it with the binary that matches the daemon. It
 recomputes the chain and exits 1 naming the first row that was
-edited or whose predecessor was removed. Retention removing the oldest
+edited or whose predecessor was removed. The chain is unkeyed: whoever
+can write the database can recompute every hash after an edit, and
+verify then finds nothing. It catches an edit only when the later
+hashes were not recomputed. Retention removing the oldest
 rows is not a break. Rows written before the chain existed are counted
 and skipped; when every row is such a row, verify warns and exits 1,
 since clearing the hash columns looks the same. After an upgrade that
 afterwards under the freed ids. The database cannot show either. The
 daemon logs every row it writes to its journal, outside the database
 (=journalctl -u gitbayd -g 'INFO audit '=), and verify prints the last
-id and hash: compare them with the newest journal line. Rows written by
+id and hash: comparing them with the newest journal line is the check
+for any change, recomputed hashes included. Rows written by
 host =gitbayd admin= commands, and by =gitbayd shell= when =ssh.mode =
 "system"=, are not copied to the journal.

.gitbay/wiki/Architecture/09-Controls.org +1 −1

	@@ -69,7 +69,7 @@ chapter names of OWASP ASVS 4.0 where one fits.
69	\| Security-relevant writes audited \| in place \| every successful mutating command (=control.go=) \|	69	\| Security-relevant writes audited \| in place \| every successful mutating command (=control.go=) \|
70	\| Authentication failures audited \| in place \| =auth.failed=, =auth.throttled= \|	70	\| Authentication failures audited \| in place \| =auth.failed=, =auth.throttled= \|
71	\| Denied attempts audited \| in place \| refused mutating commands and pushes, ten a minute per actor, 600 in all (=internal/control/auditrefusal.go=) \|	71	\| Denied attempts audited \| in place \| refused mutating commands and pushes, ten a minute per actor, 600 in all (=internal/control/auditrefusal.go=) \|
72	\| Audit log tamper resistance \| partial \| hash chain checked by =gitbayd admin audit verify=; every row the daemon writes copied to its journal; the table is writable by the daemon user, and removing the newest rows (or reusing their ids) shows only by comparing verify's last id and hash with the journal \|	72	\| Audit log tamper resistance \| partial \| unkeyed hash chain checked by =gitbayd admin audit verify=; every row the daemon writes copied to its journal; the table is writable by the daemon user, who can recompute the chain after an edit, so comparing verify's last id and hash with the journal is the check for any change \|
73		73
74	** Communications and integrations (V9, V10, V12)	74	** Communications and integrations (V9, V10, V12)
75		75

.gitbay/wiki/Architecture/10-Known-Gaps.org +4 −1

 | Area  | Gap                                                                                                         | Severity |
 |-------+-------------------------------------------------------------------------------------------------------------+----------|
-| Audit | Removing the newest audit rows, or writing new rows under their freed ids, is not detectable from the database; only comparing =gitbayd admin audit verify='s last id and hash with the daemon's journal shows it. Rows written by =gitbayd shell= (=ssh.mode = "system"=) and host admin commands have no journal copy, and the refusal caps are per process, so under that mode each connection counts separately | low |
+| Audit | The hash chain is unkeyed, so whoever can write the database can edit a row and recompute every later hash; removing the newest audit rows, or writing new rows under their freed ids, needs no recomputing at all. Neither is detectable from the database; only comparing =gitbayd admin audit verify='s last id and hash with the daemon's journal shows it. Rows written by =gitbayd shell= (=ssh.mode = "system"=) and host admin commands have no journal copy, and the refusal caps are per process, so under that mode each connection counts separately | low |
 | Availability | Under =ssh.mode = "system"= each SSH session is a separate =gitbayd shell= process, so the pack-generation limit (=internal/packlimit=, #262) cannot count SSH clones across sessions; only HTTP and git:// share a budget there | low |
+| Availability | Pushes have no concurrency limit; =max_pack_bytes= bounds each one, not how many run at once | medium |
+| Availability | =repo download= (SSH, API) runs =git archive= outside the pack limit; only its two-minute deadline and 512 MiB cap bound it | low |
+| Availability | An HTTP or git:// client that disconnects while queued for a pack slot keeps its place until =pack_queue_wait= runs out; only SSH notices the disconnect | low |
 * Questions an auditor will ask that have no answer yet

.gitbay/wiki/Performance.org +9 −7

	@@ -47,13 +47,15 @@ The practical ceiling on this hardware is concurrent pack generation:
47	full clones of large repositories are CPU-bound in git itself (the 17s	47	full clones of large repositories are CPU-bound in git itself (the 17s
48	clone ran git at ~156% CPU). =limits.pack_concurrency= bounds how many	48	clone ran git at ~156% CPU). =limits.pack_concurrency= bounds how many
49	run at once across SSH, HTTP and git://, with a queue behind it (see	49	run at once across SSH, HTTP and git://, with a queue behind it (see
50	[[Admin]], =[limits]=); the measurements below set its default.	50	[[Admin]], =[limits]=).
51		51
52	* Concurrent clones	52	* Concurrent clones
53		53
54	Measured with =deploy/clonebench.sh https://gitbay.org/krz/gitbay.git <n>=	54	The defaults (=pack_concurrency= 3, =pack_per_principal= 2,
55	from a machine outside bay1 (four cores), before and after the pack	55	=pack_queue= 32, =pack_queue_wait= 60s) are set for a four-core host
56	limit was deployed with its defaults (=pack_concurrency= 3,	56	from the single-clone figure above; no concurrent-clone measurement
57	=pack_per_principal= 2, =pack_queue= 32, =pack_queue_wait= 60s). All	57	backs them yet. =deploy/clonebench.sh <clone-url> <n>= starts n full
58	clones in one run come from one address, so the per-principal cap	58	clones at once from a machine other than the server. Clones from one
59	applies to them; the "limit off" run sets the counts to -1.	59	address count against one principal, so run it from two addresses, or
		60	against an instance with =pack_per_principal = -1=, or it measures the
		61	per-principal cap instead of the global one.

.gitbay/wiki/Threat-Model.org +13 −9

   escape what is there. #144 covers the missing isolation.
 - *Timing and traffic analysis.* Token comparison is a hash index lookup
   by design, but nothing has been measured.
-- *Denial of service by resource exhaustion* beyond rate: large pushes,
+- *Denial of service by resource exhaustion* beyond rate. Concurrent
-  pathological diffs, deep histories, zip bombs in LFS.
+  clones, fetches and web archives are bounded by the pack limit
+  (#262); pushes are not, beyond =max_pack_bytes= on each one. Nor are
+  pathological diffs, deep histories, or zip bombs in LFS.
 A sweep is a point in time. This section says what a reader should not
 assume has been checked.
   present as objects no archived ref names, and a repository's refs may
   be newer than the database snapshot (see [[Admin]]).
 - The audit log lives in the database the daemon writes, so anyone with
-  the daemon user's access can change it. The hash chain makes an edited
+  the daemon user's access can change it. The hash chain is unkeyed:
-  or removed row show as a break under =gitbayd admin audit verify=,
+  whoever can write the database can edit a row and recompute every
-  except at the end: removing the newest rows, and writing new rows
+  later hash. =gitbayd admin audit verify= catches an edited or removed
-  under their freed ids, leaves a valid chain. Only comparing verify's
+  row only when the later hashes were not recomputed, and never catches
-  last id and hash with the daemon's journal copy shows it, and rows
+  removing the newest rows or writing new rows under their freed ids.
-  written outside the daemon (=gitbayd shell= under =ssh.mode =
+  Comparing verify's last id and hash with the daemon's journal copy is
-  "system"=, host =gitbayd admin= commands) have no journal copy.
+  the check for any change; rows written outside the daemon (=gitbayd
+  shell= under =ssh.mode = "system"=, host =gitbayd admin= commands)
+  have no journal copy.
 - A global signature-verification epoch over-invalidates the cache on any
   trust-input change. Correct, not a leak; a performance tradeoff.
 - A build's secrets are environment variables inside its container, so

CHANGELOG.org +10 −4

   before it (migration 0064), and the daemon logs a copy of every row it
   writes to its journal. =gitbayd admin audit verify= prints the row
   count and the last id and hash, and exits 1 naming the first row that
-  was edited or whose predecessor was removed. Removing the newest rows
+  was edited or whose predecessor was removed. The chain is unkeyed:
-  shows only by comparing that last id and hash with the journal (#275).
+  someone who can write the database can recompute the later hashes,
+  and verify catches an edit only when they were not recomputed.
+  Comparing verify's last id and hash with the journal is the check for
+  any change, including removing the newest rows (#275).
 - Refused mutating commands (exit 3 or 4) are audited as =refused
   <command>=, and refused pushes as =refused git-receive-pack=, keeping
   flag names and the target but no values; ten a minute per account and
   "the server is busy…" and exits 1, HTTP gets 503 with
   =Retry-After: 30=, and git:// gets an =ERR= line. *Operators:* the
   defaults are tuned for a four-core host; set the three counts to -1
-  to turn the limit off. Ref listings, pushes and =repo download= are
+  to turn the limit off. A running clone is killed when no write to
-  unaffected. Under =ssh.mode = "system"= SSH clones are not counted,
+  its client completes for two minutes: a client reading below about
+  550 B/s, or an HTTP request body that takes over two minutes with
+  nothing written back, is cut. Ref listings, pushes and =repo
+  download= are unaffected. Under =ssh.mode = "system"= SSH clones are not counted,
   since each session is its own process (#262).
 - Anonymous clones are counted per IPv4 address or IPv6 /64, and
   together hold at most =pack_concurrency= − 1 slots, so a signed-in

Commit 77ff123033

Commit `77ff123033`