anvilsign in

collin/anvil

76f9fe529616fae8231551d4bdc13c12aea7e1a1 / TODO.md

BoardRenderedSource

1# Misc TODO
2
3- [x] should show subject line of latest commit in repo page view
4 - we should mirror certain things like this from github ui
5- [x] don't expose a users email on their profile page
6- [x] don't include anvil before the breadcrumbs in the repo name i.e. anvil/collin/repo just do collin/repo
7- [x] implement github action style CI feature _(done, including the (c) sandboxed broker — see "Session notes")_
8 - I want to get this to a sufficient state that we could bootstrap this app using this CI and automate deployments if we wished
9 - probably might want to have other isolated anvil workers or something running for CI jobs
10- [x] implement github pages style hosting feature _(serves from a repo's `pages` branch; each top-level dir is its own site, so rustdoc + others coexist)_
11 - should support multiple generated build pages such as one for rustdoc, and one for other rhings
12- [x] security audit _(threat model + recommendations recorded in `docs/untrusted-mode.md`; CI sandbox landed. The remaining hardening it lists — quotas, separate pages origin, open-registration anti-abuse — only matters for untrusted tenants, which stay unsupported.)_
13
14---
15
16# Error in git push _(FIXED 2026-06-10, uncommitted)_
17
18**Root cause:** every push after the first sends a *thin pack* — deltas whose
19base objects aren't in the pack (the server already has them), referenced by
20object id (`REF_DELTA`). `vendor/gitserver-core/src/receive_pack.rs::write_pack`
21passed `None` as `thin_pack_base_object_lookup` to
22`gix_pack::Bundle::write_to_directory`, so gix couldn't resolve the bases and
23aborted. First-push-to-empty-repo worked because that pack is self-contained.
24
25**Fix:** pass the already-open `gix::Repository` as the lookup (it implements
26`gix_object::Find`). Regression test
27`receive_thin_pack_with_ref_deltas` builds a real thin pack via
28`git pack-objects --thin`, asserts it contains ref-deltas, and pushes it
29through `receive_pack`. Verified the test fails without the fix.
30
31Original report:
32
33```
34collin@mini ~/C/anvil (main)> git push
35Enter passphrase for key '/Users/collin/.ssh/id_ed25519':
36Enumerating objects: 117, done.
37Counting objects: 100% (117/117), done.
38Delta compression using up to 8 threads
39Compressing objects: 100% (62/62), done.
40Writing objects: 100% (66/66), 27.57 KiB | 3.94 MiB/s, done.
41Total 66 (delta 39), reused 0 (delta 0), pack-reused 0 (from 0)
42send-pack: unexpected disconnect while reading sideband packet
43fatal: the remote end hung up unexpectedly
44collin@mini ~/C/anvil (main) [128]>
45```
46
47server logs:
48
49```
5026-06-09T21:53:46.466577Z INFO anvil_ssh: ssh auth: accepted key SHA256:Rg41caN7vw2WYYxiJN6lrIlX0DTXYF0rC2QzKZW1tB0 (user 1)
512026-06-09T21:53:46.635946Z INFO anvil_ssh: ssh git-receive-pack on collin/anvil.git (user Some(1))
522026-06-09T21:53:46.805146Z ERROR anvil_ssh: git ssh git-receive-pack: protocol error: failed to write incoming pack: Ref delta objects are not supported as there is no way to look them up. Resolve them beforehand.
532026-06-09T21:54:28.571834Z INFO anvil_ssh: ssh auth: rejected unknown key SHA256:ZlWZyHqspqFeUQV84qaXtDQq4gcA33dR7y8dYbeg9u8
542026-06-09T21:54:35.565597Z INFO anvil_ssh: ssh auth: accepted key SHA256:Rg41caN7vw2WYYxiJN6lrIlX0DTXYF0rC2QzKZW1tB0 (user 1)
552026-06-09T21:54:35.676113Z INFO anvil_ssh: ssh git-receive-pack on collin/anvil.git (user Some(1))
562026-06-09T21:54:36.268520Z ERROR anvil_ssh: git ssh git-receive-pack: protocol error: failed to write incoming pack: Ref delta objects are not supported as there is no way to look them up. Resolve them beforehand.
572026-06-09T21:55:54.223033Z INFO anvil_ssh: ssh auth: rejected unknown key SHA256:ZlWZyHqspqFeUQV84qaXtDQq4gcA33dR7y8dYbeg9u8
582026-06-09T21:56:00.758384Z INFO anvil_ssh: ssh auth: accepted key SHA256:Rg41caN7vw2WYYxiJN6lrIlX0DTXYF0rC2QzKZW1tB0 (user 1)
592026-06-09T21:56:00.906553Z INFO anvil_ssh: ssh git-receive-pack on collin/anvil.git (user Some(1))
602026-06-09T21:56:01.067903Z ERROR anvil_ssh: git ssh git-receive-pack: protocol error: failed to write incoming pack: Ref delta objects are not supported as there is no way to look them up. Resolve them beforehand.
61```
62
63---
64
65# Session notes / resume point
66
67_Last updated: 2026-06-10 (second session). Working state is clean: `cargo
68build`, `cargo clippy --workspace`, `cargo fmt --all`, and `cargo test
69--workspace` all pass. Everything below is UNCOMMITTED (repo convention:
70commit only when asked). **All top-of-file TODO items are done.**_
71
72## Done this session (2026-06-10, second session)
73
74- **UI quick wins** (`crates/anvil-web/src/ui.rs`) — latest-commit bar on the
75 repo page (sha + subject + author/time, attached above the file box, links
76 to the commit); profile page no longer shows the email; repo header reads
77 `owner / repo` without the leading `anvil /`.
78- **(c) sandboxed CI broker** — job containers now run with `cap_drop=ALL` +
79 `no-new-privileges` unconditionally, plus config-driven `pids_limit` (512),
80 `memory_mb`+swap (2048), `cpus` (2), wall-clock `timeout_secs` (1800,
81 force-removed on expiry), optional `network = false`, `run_as`, and an
82 `allowed_images` allowlist (empty = any; tagless entry allows all tags).
83 `CiConfig` in `crates/anvil-core/src/config.rs` (with `image_allowed` test);
84 `execute()` in `crates/anvil-ci/src/lib.rs`. Read-only rootfs deliberately
85 skipped (workspace lives in the container fs; no volumes ever attached).
86 Docs: `DEPLOY.md` §7, `anvil.example.toml` `[ci]`.
87- **(b) threat model** — `docs/untrusted-mode.md`: severity-ranked analysis
88 (CI containment, pages/stored-XSS origin, git resource exhaustion,
89 registration anti-abuse, authz granularity, webhook SSRF), the already-right
90 list, and the stance: single-tenant supported, untrusted gated on items 1–4.
91- **Pages hosting** — `crates/anvil-web/src/pages.rs`: serves a repo's `pages`
92 branch at `/{owner}/{repo}/pages/...`; top-level dirs are separate sites
93 (rustdoc, book, …); `index.html` resolution with trailing-slash redirect so
94 relative links work; extension→content-type map + `nosniff`; listing page
95 with publish hint; "Pages" button on the repo header. Visibility follows the
96 repo (private → 404). Publish with `git push origin <built-branch>:pages`.
97
98## Done earlier (same day, first session)
99
100- **CI UI** — runs list `/{owner}/{repo}/ci`, run-detail (status/timing/log),
101 per-commit status badges, "CI" nav link. (`crates/anvil-web/src/ui.rs`)
102- **CD redeploy webhook** — on a green run of `[ci] deploy_branch` in the single
103 `[ci] deploy_repo`, POST to `[ci] deploy_webhook` (`X-Anvil-Deploy-Secret`
104 header). Scoped to ONE repo. `CiConfig` in `crates/anvil-core/src/config.rs`;
105 `deploy()` in `crates/anvil-ci/src/lib.rs`. Docs: `DEPLOY.md` §7,
106 `deploy/anvil.toml`. `reqwest` added with NO TLS feature (keeps musl
107 cross-compile aws-lc-free).
108- **Docker socket on hagrid** — `deploy/run.sh` mounts it + `--group-add`s the
109 gid for the non-root user; caveat in `DEPLOY.md` §4.
110- **Toasty ORM cleanup** — `ci.rs` `list_by_repo`/`latest_for_commit`/
111 `queued_ids` now sort/limit/filter in SQL, not in memory. Verified by the new
112 `ordering_and_limit_run_in_the_database` test. (Sweep: these were the only
113 real instances; `repos::list_all_with_owner` sorts by a joined username and
114 needs all rows — intentionally left.)
115- **(a) CSRF + cookie hardening** —
116 - Cookie: `HttpOnly` + `SameSite=Lax` + `Secure` (auto via
117 `Config::secure_cookies()` when base_url is https).
118 - Synchronizer token `HMAC-SHA256(server_secret, session)`; secret persisted
119 at `data_dir/csrf_secret` (`App::csrf_token` in `crates/anvil-core/src/lib.rs`).
120 Deps `hmac`, `sha2`.
121 - `Csrf` extractor + constant-time `verify_csrf` (`crates/anvil-web/src/auth.rs`).
122 Hidden `csrf` field + verification on add/delete SSH key, new repo, repo
123 settings. Login exempt; logout relies on SameSite.
124 - htmx insurance: `auth::csrf_context` middleware → request-scoped task-local;
125 `layout` sends the token via `hx-headers` on every htmx request.
126
127## The a/b/c plan — ALL DONE
128
129(a) CSRF + cookie hardening, (b) `docs/untrusted-mode.md` threat model,
130(c) sandboxed CI broker. Stronger isolation tiers (gVisor/Kata/Firecracker,
131egress filtering, CI-minute quotas) are recorded in the threat model as the
132gate for untrusted tenants, not planned work.
133
134## Loose ends
135
136- **CSRF header consumption:** `hx-headers` sends the token as a `csrf` header,
137 but `verify_csrf` only reads the form field. When we add a tokenless htmx
138 action (raw `hx-post`/`hx-delete`, no `<form>`), also read the `csrf` header.
139- **Toasty migrations:** schema only pushed on a fresh DB (`db::connect`); new
140 columns won't apply to an existing DB until migrations land. (The
141 `data_dir/csrf_secret` file is created automatically — no DB change.)
142- **Suggested commits when ready:** (1) CI UI, (2) CD webhook + deploy wiring,
143 (3) ci.rs ORM cleanup + test, (4) CSRF + cookies, (5) UI quick wins
144 (latest-commit bar, profile email, breadcrumb), (6) CI sandbox + threat-model
145 doc, (7) pages hosting. Trailer: `Co-Authored-By: Claude ...`.
146- **Pages caveats (single-tenant-acceptable):** served from the forge origin —
147 move to a separate origin before untrusted users (threat model §2); whole
148 blobs load into memory per request (fine at our scale).
149
150## Remaining roadmap (plan milestones beyond a/b/c)
151
1528. Issues · 9. Pull requests (gix merge) · 10. Webhooks (mind the SSRF item).