hanna/fabrica

feat(git): SHA-1 / SHA-256 object-format selection for new repos

5e112e6 · hanna committed on 2026-07-25

Add an ObjectFormat type and create_bare_with_format: SHA-1 keeps the in-process
git2 path; SHA-256 is created via the git binary (git init --object-format=
sha256), since libgit2's SHA-256 support is experimental — the repo is still a
valid git repo over the pack transport. Store the format per repo (migration
0007), expose a selector on the new-repo form (SHA-1 default, SHA-256 labelled
experimental), and show it read-only in repo settings.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

crates/auth/src/access.rs +1 −0

crates/git/src/lib.rs +164 −0

crates/model/src/entity.rs +2 −0

crates/store/src/repos.rs +24 −2

crates/web/src/pages.rs +26 −1

crates/web/src/repo.rs +4 −0

crates/web/src/tests.rs +49 −0

migrations/postgres/0007_repo_object_format.sql +3 −0

migrations/sqlite/0007_repo_object_format.sql +3 −0

             description: None,
             visibility,
             default_branch: "main".to_string(),
+            object_format: "sha1".to_string(),
             issues_enabled: true,
             pulls_enabled: true,
             next_iid: 1,

 use std::io;
 use std::os::unix::fs::PermissionsExt;
 use std::path::{Path, PathBuf};
+use std::process::Command;
 use git2::{Repository, RepositoryInitOptions};
     /// rebase replay hit conflicts.
     #[error("merge has conflicts")]
     MergeConflict,
+    /// `git init` (used for SHA-256 repositories) failed.
+    #[error("git init failed: {0}")]
+    Init(String),
+}
 /// Compute the on-disk path of a repository from its id: `{root}/{id[0..2]}/{id}.git`.
+    }
+}
+/// The hash algorithm a repository's objects are named with.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum ObjectFormat {
+    /// SHA-1 (the historical default).
+    #[default]
+    Sha1,
+    /// SHA-256 (git's newer, collision-resistant format).
+    Sha256,
+}
+impl ObjectFormat {
+    /// The stable token stored on the repo row and passed to `git init`.
+    #[must_use]
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Sha1 => "sha1",
+            Self::Sha256 => "sha256",
+        }
+    }
+    /// Parse a stored/submitted token, defaulting to SHA-1.
+    #[must_use]
+    pub fn from_token(token: &str) -> Self {
+        if token.eq_ignore_ascii_case("sha256") {
+            Self::Sha256
+        } else {
+            Self::Sha1
+        }
+    }
+}
+/// Create a bare repository with a chosen object format.
+///
+/// SHA-1 uses the in-process [`create_bare`]. SHA-256 is created by the `git`
+/// binary (`git init --object-format=sha256`), because libgit2's SHA-256 support
+/// is experimental and often unavailable — the resulting repository is still a
+/// fully valid git repo served over the pack transport, though in-process
+/// browsing depends on the local libgit2 build.
+///
+/// # Errors
+///
+/// Returns [`GitError`] if the id is invalid, the directory already exists, or a
+/// git/filesystem step fails.
+pub fn create_bare_with_format(
+    root: &Path,
+    id: &str,
+    default_branch: &str,
+    hook_binary: &Path,
+    format: ObjectFormat,
+) -> Result<(), GitError> {
+    match format {
+        ObjectFormat::Sha1 => create_bare(root, id, default_branch, hook_binary).map(|_| ()),
+        ObjectFormat::Sha256 => create_bare_sha256(root, id, default_branch, hook_binary),
+    }
+}
+/// Create a SHA-256 bare repository via the `git` binary, then apply the same
+/// server config and hooks [`create_bare`] installs.
+fn create_bare_sha256(
+    root: &Path,
+    id: &str,
+    default_branch: &str,
+    hook_binary: &Path,
+) -> Result<(), GitError> {
+    let path = repo_path(root, id)?;
+    if path.exists() {
+        return Err(GitError::Io {
+            path: path.clone(),
+            source: io::Error::new(io::ErrorKind::AlreadyExists, "repository directory exists"),
+        });
+    }
+    if let Some(parent) = path.parent() {
+        fs::create_dir_all(parent).map_err(|source| GitError::Io {
+            path: parent.to_path_buf(),
+            source,
+        })?;
+    }
+    match init_sha256_inner(&path, default_branch, hook_binary) {
+        Ok(()) => Ok(()),
+        Err(err) => {
+            let _ = fs::remove_dir_all(&path);
+            Err(err)
+        }
+    }
+}
+/// The fallible body of [`create_bare_sha256`].
+fn init_sha256_inner(
+    path: &Path,
+    default_branch: &str,
+    hook_binary: &Path,
+) -> Result<(), GitError> {
+    let run = |args: &[&str]| -> Result<(), GitError> {
+        let out = Command::new("git")
+            .args(args)
+            .output()
+            .map_err(|source| GitError::Io {
+                path: path.to_path_buf(),
+                source,
+            })?;
+        if out.status.success() {
+            Ok(())
+        } else {
+            Err(GitError::Init(
+                String::from_utf8_lossy(&out.stderr).trim().to_string(),
+            ))
+        }
+    };
+    let path_str = path.to_string_lossy();
+    run(&[
+        "init",
+        "--bare",
+        "--object-format=sha256",
+        "--initial-branch",
+        default_branch,
+        &path_str,
+    ])?;
+    // Mirror the server config `create_bare` sets (§3.2).
+    for (key, value) in [
+        ("core.logallrefupdates", "true"),
+        ("receive.denyNonFastForwards", "false"),
+        ("gc.auto", "0"),
+    ] {
+        run(&["--git-dir", &path_str, "config", key, value])?;
+    }
+    install_hooks(path, hook_binary)?;
+    Ok(())
+}
 /// The fallible body of [`create_bare`], separated so the caller can clean up on
 /// any error.
 fn init_inner(path: &Path, default_branch: &str, hook_binary: &Path) -> Result<(), GitError> {
         // A second create at the same id fails (the directory already exists).
         assert!(create_bare(dir.path(), id, "main", Path::new("/usr/bin/fabrica")).is_err());
+    }
+    #[test]
+    fn create_bare_sha256_uses_the_requested_format() {
+        // SHA-256 creation shells out to `git`; skip cleanly where it is absent.
+        if Command::new("git").arg("--version").output().is_err() {
+            return;
+        }
+        let dir = tempfile::tempdir().unwrap();
+        let id = "01hzxk9m2n8p7q6r5s4t3v2w1y";
+        create_bare_with_format(
+            dir.path(),
+            id,
+            "main",
+            Path::new("/usr/bin/fabrica"),
+            ObjectFormat::Sha256,
+        )
+        .unwrap();
+        let path = repo_path(dir.path(), id).unwrap();
+        // git records the object format under extensions.objectformat.
+        let out = Command::new("git")
+            .args(["--git-dir"])
+            .arg(&path)
+            .args(["rev-parse", "--show-object-format"])
+            .output()
+            .unwrap();
+        assert_eq!(String::from_utf8_lossy(&out.stdout).trim(), "sha256");
+        // The server hooks are installed as for a SHA-1 repo.
+        assert!(path.join("hooks").join("post-receive").exists());
+    }
+}

     pub visibility: Visibility,
     /// The branch shown by default and used for HEAD.
     pub default_branch: String,
+    /// The object hash algorithm (`sha1` or `sha256`), fixed at creation.
+    pub object_format: String,
     /// Whether issues are enabled for this repository.
     pub issues_enabled: bool,
     /// Whether pull requests are enabled for this repository.

 /// The columns of `repos` in a fixed order, shared by every `SELECT`.
 const REPO_COLUMNS: &str = "id, owner_id, group_id, name, path, description, visibility, \
-     default_branch, issues_enabled, pulls_enabled, next_iid, archived_at, size_bytes, \
+     default_branch, object_format, issues_enabled, pulls_enabled, next_iid, archived_at, \
-     pushed_at, created_at, updated_at";
+     size_bytes, pushed_at, created_at, updated_at";
 /// Fields needed to create a repository. The server fills in the id, timestamps,
 /// and the derived size/push bookkeeping.
             description: new.description,
             visibility: new.visibility,
             default_branch: new.default_branch,
+            object_format: "sha1".to_string(),
             issues_enabled: true,
             pulls_enabled: true,
             next_iid: 1,
         Ok(repo)
+    }
+    /// Set a repository's object format (`sha1` | `sha256`). Called right after
+    /// [`Store::create_repo`] when a non-default format was chosen, before the
+    /// on-disk repository is created, so the row matches the on-disk repo.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`StoreError::Query`] on a database failure.
+    pub async fn set_object_format(
+        &self,
+        repo_id: &str,
+        object_format: &str,
+    ) -> Result<(), StoreError> {
+        sqlx::query("UPDATE repos SET object_format = $1 WHERE id = $2")
+            .bind(object_format)
+            .bind(repo_id)
+            .execute(&self.pool)
+            .await?;
+        Ok(())
+    }
     /// Resolve a repository by `(owner_id, path)`, or `None` if absent. This is
     /// the authoritative name→repo lookup; the on-disk tree is keyed by id.
     ///
             visibility: Visibility::from_token(&row.try_get::<String, _>("visibility")?)
                 .unwrap_or(Visibility::Private),
             default_branch: row.try_get("default_branch")?,
+            object_format: row.try_get("object_format")?,
             issues_enabled: self.get_bool(row, "issues_enabled")?,
             pulls_enabled: self.get_bool(row, "pulls_enabled")?,
             next_iid: row.try_get("next_iid")?,

     /// Optional default branch override.
     #[serde(default)]
     default_branch: String,
+    /// Object format (`sha1` | `sha256`).
+    #[serde(default)]
+    object_format: String,
     /// CSRF token.
     #[serde(rename = "_csrf")]
     csrf: String,
             other => other.to_string(),
         })?;
+    let format = git::ObjectFormat::from_token(&form.object_format);
+    if format != git::ObjectFormat::Sha1 {
+        // Record the non-default format on the row before creating the on-disk repo.
+        let _ = state
+            .store
+            .set_object_format(&repo.id, format.as_str())
+            .await;
+    }
     let hook = std::env::current_exe().unwrap_or_else(|_| std::path::PathBuf::from("fabrica"));
-    if let Err(e) = git::create_bare(&state.config.storage.repo_dir, &repo.id, &branch, &hook) {
+    if let Err(e) = git::create_bare_with_format(
+        &state.config.storage.repo_dir,
+        &repo.id,
+        &branch,
+        &hook,
+        format,
+    ) {
         let _ = state.store.delete_repo(&repo.id).await;
         return Err(format!("Could not create the repository on disk: {e}"));
+    }
                     label for="default_branch" { "Default branch" }
                     input type="text" id="default_branch" name="default_branch"
                           placeholder=(state.config.instance.default_branch);
+                    label for="object_format" { "Object format" }
+                    select id="object_format" name="object_format" {
+                        option value="sha1" selected { "SHA-1 (legacy, widely compatible)" }
+                        option value="sha256" { "SHA-256 (modern, experimental tooling support)" }
+                    }
+                    p class="muted field-hint" {
+                        "SHA-256 repositories are collision-resistant but not yet supported by all git clients and hosts. This cannot be changed later."
+                    }
                     button class="btn btn-primary" type="submit" { "Create repository" }
+                }
+            }

                         input type="checkbox" name="pulls_enabled" value="1"
                               checked[ctx.repo.pulls_enabled]; " Pull requests"
+                    }
+                    p class="muted field-hint" {
+                        "Object format: " (ctx.repo.object_format.to_uppercase())
+                        " · fixed at creation."
+                    }
+                }
                 div class="settings-actions" {
                     button class="btn btn-primary" type="submit" form="repo-general" { "Save changes" }

+}
 #[tokio::test]
+async fn new_repo_can_use_sha256_object_format() {
+    if std::process::Command::new("git")
+        .arg("--version")
+        .output()
+        .is_err()
+    {
+        return;
+    }
+    let (state, app, _dir) = app_with_git().await;
+    let cookie = login(&app).await;
+    let token = cookie
+        .split("fabrica_csrf=")
+        .nth(1)
+        .and_then(|s| s.split(';').next())
+        .unwrap()
+        .to_string();
+    let req = Request::builder()
+        .method("POST")
+        .uri("/new")
+        .header(header::CONTENT_TYPE, "application/x-www-form-urlencoded")
+        .header(header::COOKIE, cookie)
+        .body(Body::from(format!(
+            "name=modern&visibility=private&default_branch=main&object_format=sha256&_csrf={token}"
+        )))
+        .unwrap();
+    let res = app.oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::SEE_OTHER);
+    let ada = state.store.user_by_username("ada").await.unwrap().unwrap();
+    let repo = state
+        .store
+        .repo_by_owner_path(&ada.id, "modern")
+        .await
+        .unwrap()
+        .unwrap();
+    assert_eq!(repo.object_format, "sha256", "row records the format");
+    // The on-disk repo is really SHA-256.
+    let path = git::repo_path(&state.config.storage.repo_dir, &repo.id).unwrap();
+    let out = std::process::Command::new("git")
+        .arg("--git-dir")
+        .arg(&path)
+        .args(["rev-parse", "--show-object-format"])
+        .output()
+        .unwrap();
+    assert_eq!(String::from_utf8_lossy(&out.stdout).trim(), "sha256");
+}
+#[tokio::test]
 async fn pulls_404_when_disabled() {
     let (state, app) = app().await;
     let ada = state.store.user_by_username("ada").await.unwrap().unwrap();

+-- The object hash algorithm each repository was created with. Existing repos are
+-- SHA-1; new repos may opt into SHA-256.
+ALTER TABLE repos ADD COLUMN object_format TEXT NOT NULL DEFAULT 'sha1';