hanna/fabrica

feat(ssh): russh server — publickey auth and exec pack dispatch

79ec208 · hanna committed on 2026-07-25

Add the SSH front-end. A russh 0.62 server accepts only publickey auth
(identity by the offered key's SHA256 fingerprint, matched against the
keys table; last_used_at bumped), handles only the exec channel, and
streams git-upload-pack/receive-pack over git::pack via the async Handle.
Read needs Read access, push needs Write. A shell request (or any other
command) gets the friendly banner and exit 1; an unregistered key is
rejected.

The host key (ed25519) is generated at ssh.host_key_path on first start
(mode 0600) and bridged to russh's ssh-key version via the OpenSSH PEM.
The root binary runs the SSH server alongside web. Pushes set FABRICA_*
identity + FABRICA_CONFIG so post-receive updates pushed_at.

Verified end-to-end: SSH clone, SSH push (hook fires), the shell banner,
and unregistered-key rejection. russh's aws-lc-rs backend requires the
OpenSSL license and cmake — admitted for the mandatory SSH crypto only
(see docs/decisions.md).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Signed by hannaSSH key fingerprint: SHA256:4g9cWhkAAw8gwqhJUcVbSnGEvdGwklW+1Aa/fMUu59k

Cargo.lock +1336 −146

Cargo.toml +3 −0

crates/cli/src/hook_cmd.rs +4 −4

crates/ssh/Cargo.toml +16 −0

crates/ssh/src/command.rs +114 −0

crates/ssh/src/hostkey.rs +70 −0

crates/ssh/src/lib.rs +27 −0

crates/ssh/src/resolve.rs +56 −0

crates/ssh/src/server.rs +355 −0

crates/store/src/keys.rs +14 −0

deny.toml +5 −0

docs/decisions.md +26 −0

flake.nix +3 −0

src/serve.rs +17 −2

@@ @@ -18,6 +18,7 @@ path = "src/main.rs" @@
 # `serve` back to us so that no library crate has to depend on `web`.
 cli = { path = "crates/cli" }
 web = { path = "crates/web" }
 ssh = { path = "crates/ssh" }
 config = { path = "crates/config" }
 store = { path = "crates/store" }
 anyhow = { workspace = true }
@@ @@ -150,6 +151,8 @@ ammonia = "4" @@
 # gzip-encoded upload-pack requests.
 tokio-util = { version = "0.7", features = ["io"] }
 flate2 = "1"
 # SSH server (default features: aws-lc-rs backend, no ring; re-exports ssh-key).
 russh = "0.62"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "json"] }

@@ @@ -44,10 +44,10 @@ fn post_receive() -> anyhow::Result<()> { @@
     let mut input = String::new();
     std::io::stdin().read_to_string(&mut input)?;
     let git_dir = std::env::var_os("GIT_DIR")
         .map(PathBuf::from)
         .or_else(|| std::env::current_dir().ok())
         .ok_or_else(|| anyhow::anyhow!("cannot determine GIT_DIR"))?;
     // git runs post-receive with cwd = the repo dir and often GIT_DIR=".";
     // canonicalize so we get the absolute `{id}.git` directory either way.
     let git_dir = std::env::var_os("GIT_DIR").map_or_else(|| PathBuf::from("."), PathBuf::from);
     let git_dir = std::fs::canonicalize(&git_dir).unwrap_or(git_dir);
     // The bare repo dir is `{id}.git`; the stem is the repo's ULID.
     let Some(repo_id) = git_dir

@@ @@ -10,6 +10,22 @@ repository.workspace = true @@
 publish.workspace = true
 [dependencies]
 config = { workspace = true }
 store = { workspace = true }
 git = { workspace = true }
 auth = { workspace = true }
 model = { workspace = true }
 ssh-key = { workspace = true }
 rand_core = { workspace = true }
 # SSH server. Default features use the aws-lc-rs crypto backend (no `ring`); it
 # re-exports ssh-key as russh::keys. See docs/decisions.md for the license note.
 russh = { workspace = true }
 tokio = { workspace = true }
 tracing = { workspace = true }
 thiserror = { workspace = true }
 [dev-dependencies]
 tempfile = { workspace = true }
 [lints]
 workspace = true

@@ @@ -0,0 +1,114 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Parsing the SSH `exec` command line.
 //!
 //! Only the three git pack commands are accepted, each with exactly one quoted
 //! path argument. Anything else — including an interactive shell — is refused with
 //! a friendly banner by the caller.
 use git::pack::Service;
 /// A parsed, accepted git command: the service and its (raw, un-normalized) path.
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct GitCommand {
     /// The git service requested.
     pub service: Service,
     /// The repository path argument, as given (still needs normalizing).
     pub path: String,
+}
 /// Parse an exec command line into an accepted [`GitCommand`], or `None` if it is
 /// not one of the three git pack commands with a single path argument.
 #[must_use]
 pub fn parse(command: &str) -> Option<GitCommand> {
     let words = shell_split(command)?;
     let (name, rest) = words.split_first()?;
     if rest.len() != 1 {
         return None;
+    }
     let service = match name.as_str() {
         "git-upload-pack" => Service::UploadPack,
         "git-receive-pack" => Service::ReceivePack,
         "git-upload-archive" => Service::UploadArchive,
         _ => return None,
     };
     Some(GitCommand {
         service,
         path: rest[0].clone(),
     })
+}
 /// Split a command line into words, honouring single and double quotes (git sends
 /// the path single-quoted). Returns `None` on an unterminated quote.
 fn shell_split(input: &str) -> Option<Vec<String>> {
     let mut words = Vec::new();
     let mut current = String::new();
     let mut has_word = false;
     let mut chars = input.chars().peekable();
     while let Some(c) = chars.next() {
         match c {
             ' ' | '\t' => {
                 if has_word {
                     words.push(std::mem::take(&mut current));
                     has_word = false;
+                }
+            }
             '\'' | '"' => {
                 has_word = true;
                 let quote = c;
                 loop {
                     match chars.next() {
                         Some(q) if q == quote => break,
                         Some(other) => current.push(other),
                         None => return None, // unterminated quote
+                    }
+                }
+            }
             other => {
                 has_word = true;
                 current.push(other);
+            }
+        }
+    }
     if has_word {
         words.push(current);
+    }
     Some(words)
+}
 #[cfg(test)]
 mod tests {
     use super::*;
     #[test]
     fn parses_the_three_git_commands() {
         assert_eq!(
             parse("git-upload-pack 'owner/repo.git'"),
             Some(GitCommand {
                 service: Service::UploadPack,
                 path: "owner/repo.git".to_string()
             })
         );
         assert_eq!(
             parse("git-receive-pack '/owner/repo'").map(|c| c.service),
             Some(Service::ReceivePack)
         );
         assert_eq!(
             parse("git-upload-archive 'x'").map(|c| c.service),
             Some(Service::UploadArchive)
         );
+    }
     #[test]
     fn rejects_shells_and_extra_args() {
         assert!(parse("bash").is_none());
         assert!(parse("").is_none());
         assert!(parse("git-upload-pack").is_none());
         assert!(parse("git-upload-pack a b").is_none());
         assert!(parse("scp -t /tmp").is_none());
         assert!(parse("git-upload-pack 'unterminated").is_none());
+    }
+}

@@ @@ -0,0 +1,70 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! The server host key: generated on first start, loaded thereafter.
 //!
 //! Returned as the OpenSSH-format PEM string rather than a typed key so the caller
 //! (`server`) parses it with russh's own re-exported `ssh-key` version — the
 //! workspace pins a different `ssh-key` patch, and the two key types are distinct,
 //! but the OpenSSH text format bridges them.
 use std::fs;
 use std::os::unix::fs::PermissionsExt;
 use std::path::Path;
 use rand_core::OsRng;
 use ssh_key::{Algorithm, LineEnding, PrivateKey};
 use crate::SshError;
 /// Load the ed25519 host key from `path` as an OpenSSH PEM, generating and
 /// persisting one (mode `0600`) if it does not yet exist.
 ///
 /// # Errors
 ///
 /// Returns [`SshError`] if the key file cannot be read, generated, or written.
 pub fn load_or_generate(path: &Path) -> Result<String, SshError> {
     if path.exists() {
         return Ok(fs::read_to_string(path)?);
+    }
     let key = PrivateKey::random(&mut OsRng, Algorithm::Ed25519)
         .map_err(|e| SshError::HostKey(format!("generating host key: {e}")))?;
     if let Some(parent) = path.parent() {
         fs::create_dir_all(parent)?;
+    }
     let pem = key
         .to_openssh(LineEnding::LF)
         .map_err(|e| SshError::HostKey(format!("encoding host key: {e}")))?;
     fs::write(path, pem.as_bytes())?;
     fs::set_permissions(path, fs::Permissions::from_mode(0o600))?;
     Ok(pem.to_string())
+}
 #[cfg(test)]
 mod tests {
     #![allow(clippy::unwrap_used)]
     use super::*;
     #[test]
     fn generates_then_loads_a_stable_host_key() {
         let dir = tempfile::tempdir().unwrap();
         let path = dir.path().join("ssh").join("host_ed25519");
         let first_pem = load_or_generate(&path).unwrap();
         let first = PrivateKey::from_openssh(first_pem.as_str()).unwrap();
         assert_eq!(first.algorithm(), Algorithm::Ed25519);
         // The file is created with owner-only permissions.
         let mode = fs::metadata(&path).unwrap().permissions().mode();
         assert_eq!(mode & 0o777, 0o600);
         // A second load returns the same key (same public fingerprint).
         let second = PrivateKey::from_openssh(load_or_generate(&path).unwrap().as_str()).unwrap();
         assert_eq!(
             first.public_key().fingerprint(ssh_key::HashAlg::Sha256),
             second.public_key().fingerprint(ssh_key::HashAlg::Sha256)
         );
+    }
+}

 dependencies = [
  "bytes",
  "crypto-common 0.1.6",
  "generic-array",
  "generic-array 0.14.9",
+]
 [[package]]
 name = "aead"
 version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
 dependencies = [
  "crypto-common 0.2.2",
  "inout 0.2.2",
+]
 [[package]]
 checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
  "cipher",
  "cipher 0.4.4",
  "cpufeatures 0.2.17",
+]
 [[package]]
 name = "aes"
 version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1fc76eaeac4c9164506c466d4ffdd8ec9d0c5bf57ee97177c4d8eceb3a0e138"
 dependencies = [
  "cipher 0.5.2",
  "cpubits",
  "cpufeatures 0.3.0",
  "zeroize",
+]
 [[package]]
 name = "aes-gcm"
 version = "0.10.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"
 dependencies = [
  "aead",
  "aes",
  "cipher",
  "ctr",
  "ghash",
  "aead 0.5.2",
  "aes 0.8.4",
  "cipher 0.4.4",
  "ctr 0.9.2",
  "ghash 0.5.1",
  "subtle",
+]
 [[package]]
 name = "aes-gcm"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdf011db2e21ce0d575593d749db5554b47fed37aff429e4dc50bc91ac93a028"
 dependencies = [
  "aead 0.6.1",
  "aes 0.9.1",
  "cipher 0.5.2",
  "ctr 0.10.1",
  "ghash 0.6.0",
  "subtle",
  "zeroize",
+]
 [[package]]
@@ @@ -50,7 +87,7 @@ version = "0.2.1" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69fa2b352dcefb5f7f3a5fb840e02665d311d878955380515e4fd50095dd3d8c"
 dependencies = [
  "aes",
  "aes 0.8.4",
+]
 [[package]]
@@ @@ -94,6 +131,15 @@ dependencies = [ @@
+]
 [[package]]
 name = "android_system_properties"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
 dependencies = [
  "libc",
+]
 [[package]]
 name = "anstream"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
 dependencies = [
  "base64ct",
  "blake2",
  "blake2 0.10.6",
  "cpufeatures 0.2.17",
  "password-hash",
  "password-hash 0.5.0",
  "zeroize",
+]
 [[package]]
 name = "argon2"
 version = "0.6.0-rc.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7af50940b73bf4e16c15c448a2b121c63f2d68e3e54b6a8731673cb4aa0cdff5"
 dependencies = [
  "base64ct",
  "blake2 0.11.0-rc.6",
  "cpufeatures 0.3.0",
  "password-hash 0.6.1",
+]
 [[package]]
 name = "async-compression"
 version = "0.4.42"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 name = "auth"
 version = "0.1.0"
 dependencies = [
  "argon2",
  "argon2 0.5.3",
  "base64",
  "hmac 0.12.1",
  "model",
 checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 [[package]]
 name = "aws-lc-rs"
 version = "1.17.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "00bdb5da18dac48ca2cc7cd4a98e533e8635a58e2361d13a1a4ee3888e0d72f1"
 dependencies = [
  "aws-lc-sys",
  "untrusted",
  "zeroize",
+]
 [[package]]
 name = "aws-lc-sys"
 version = "0.43.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "43103168cc76fe62678a375e722fc9cb3a0146159ac5828bc4f0dfd755c2224c"
 dependencies = [
  "cc",
  "cmake",
  "dunce",
  "fs_extra",
  "pkg-config",
+]
 [[package]]
 name = "axum"
 version = "0.8.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 [[package]]
 name = "base16ct"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
 [[package]]
 name = "base64"
 version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 [[package]]
 name = "bcrypt-pbkdf"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "144e573728da132683b9488acd528274c790e07fc06ff81ee29f9d8f8b1041e0"
 dependencies = [
  "blowfish 0.10.0",
  "pbkdf2",
  "sha2 0.11.0",
+]
 [[package]]
 name = "bitfields"
 version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -378,12 +477,21 @@ dependencies = [ @@
+]
 [[package]]
 name = "blake2"
 version = "0.11.0-rc.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "061f1a09225e328e1ffbb378d2d49923c0ca5fee19fb5ac1cc9c1e9d52b93690"
 dependencies = [
  "digest 0.11.3",
+]
 [[package]]
 name = "block-buffer"
 version = "0.10.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
 dependencies = [
  "generic-array",
  "generic-array 0.14.9",
+]
 [[package]]
 checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
 dependencies = [
  "hybrid-array",
  "zeroize",
+]
 [[package]]
@@ @@ -401,7 +510,16 @@ version = "0.3.3" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a8894febbff9f758034a5b8e12d87918f56dfc64a8e1fe757d65e29041538d93"
 dependencies = [
  "generic-array",
  "generic-array 0.14.9",
+]
 [[package]]
 name = "block-padding"
 version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "710f1dd022ef4e93f8a438b4ba958de7f64308434fa6a87104481645cc30068b"
 dependencies = [
  "hybrid-array",
+]
 [[package]]
 checksum = "e412e2cd0f2b2d93e02543ceae7917b3c70331573df19ee046bcbc35e45e87d7"
 dependencies = [
  "byteorder",
  "cipher",
  "cipher 0.4.4",
+]
 [[package]]
 name = "blowfish"
 version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "62ce3946557b35e71d1bbe07ec385073ce9eda05043f95de134eb578fcf1a298"
 dependencies = [
  "byteorder",
  "cipher 0.5.2",
+]
 [[package]]
 checksum = "3264e2574e9ef2b53ce6f536dea83a69ac0bc600b762d1523ff83fe07230ce30"
 dependencies = [
  "byteorder",
  "cipher",
  "cipher 0.4.4",
+]
 [[package]]
@@ @@ -491,7 +619,16 @@ version = "0.11.1" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26b07d673db1ccf000e90f54b819db9e75a8348d6eb056e9b8ab53231b7a9911"
 dependencies = [
  "cipher",
  "cipher 0.4.4",
+]
 [[package]]
 name = "cbc"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce2dc9ee5f88d11e0beb842c88b33c8a5cf0d1329c4b19494af42b07dbfe8896"
 dependencies = [
  "cipher 0.5.2",
+]
 [[package]]
@@ @@ -512,7 +649,7 @@ version = "0.8.2" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "738b8d467867f80a71351933f70461f5b56f24d5c93e0cf216e59229c968d330"
 dependencies = [
  "cipher",
  "cipher 0.4.4",
+]
 [[package]]
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 [[package]]
 name = "cfg_aliases"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
 [[package]]
 name = "chacha20"
 version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
  "cipher 0.5.2",
  "cpufeatures 0.3.0",
  "rand_core 0.10.1",
  "zeroize",
+]
 [[package]]
 name = "chrono"
 version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
  "iana-time-zone",
  "js-sys",
  "num-traits",
  "wasm-bindgen",
  "windows-link",
+]
 [[package]]
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
  "crypto-common 0.1.6",
  "inout",
  "inout 0.1.4",
+]
 [[package]]
 name = "cipher"
 version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
 dependencies = [
  "block-buffer 0.12.1",
  "crypto-common 0.2.2",
  "inout 0.2.2",
  "zeroize",
+]
 [[package]]
@@ @@ -607,12 +777,21 @@ version = "0.7.2" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8543454e3c3f5126effff9cd44d562af4e31fb8ce1cc0d3dcd8f084515dbc1aa"
 dependencies = [
  "cipher",
  "cipher 0.4.4",
  "dbl",
  "digest 0.10.7",
+]
 [[package]]
 name = "cmake"
 version = "0.1.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
 dependencies = [
  "cc",
+]
 [[package]]
 name = "cmov"
 version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 [[package]]
 name = "cpubits"
 version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae"
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -824,19 +1009,36 @@ version = "0.5.5" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
  "generic-array",
  "generic-array 0.14.9",
  "rand_core 0.6.4",
  "subtle",
  "zeroize",
+]
 [[package]]
 name = "crypto-bigint"
 version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a52aa3fcda4e6302a9f48734f234d35d4721b96f8fe07d073f07ce9df4f0271"
 dependencies = [
  "cpubits",
  "ctutils",
  "getrandom 0.4.3",
  "hybrid-array",
  "num-traits",
  "rand_core 0.10.1",
  "serdect 0.4.3",
  "subtle",
  "zeroize",
+]
 [[package]]
 name = "crypto-common"
 version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
  "generic-array",
  "generic-array 0.14.9",
  "rand_core 0.6.4",
  "typenum",
+]
@@ @@ -847,7 +1049,19 @@ version = "0.2.2" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
  "getrandom 0.4.3",
  "hybrid-array",
  "rand_core 0.10.1",
+]
 [[package]]
 name = "crypto-primes"
 version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3633a51a39c69ebbaa4feaa694bd83d241e4093901c84a0963b19d9bb3f0cf8f"
 dependencies = [
  "crypto-bigint 0.7.5",
  "rand_core 0.10.1",
+]
 [[package]]
@@ @@ -867,7 +1081,16 @@ version = "0.9.2" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"
 dependencies = [
  "cipher",
  "cipher 0.4.4",
+]
 [[package]]
 name = "ctr"
 version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baaca1c4b237092596f64d571e9db6ce4109c4ef9742e27590f1709594461f21"
 dependencies = [
  "cipher 0.5.2",
+]
 [[package]]
 checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
 dependencies = [
  "cmov",
  "subtle",
+]
 [[package]]
@@ @@ -889,7 +1113,24 @@ dependencies = [ @@
  "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
  "digest 0.10.7",
  "fiat-crypto",
  "fiat-crypto 0.2.9",
  "rustc_version",
  "subtle",
  "zeroize",
+]
 [[package]]
 name = "curve25519-dalek"
 version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
  "curve25519-dalek-derive",
  "digest 0.11.3",
  "fiat-crypto 0.3.0",
  "rand_core 0.10.1",
  "rustc_version",
  "subtle",
  "zeroize",
@@ @@ -912,13 +1153,13 @@ version = "0.1.1" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4c0cf476284b03eb6c10e78787b21c7abb7d7d43cb2f02532ba6b831ed892fa"
 dependencies = [
  "crypto-bigint",
  "elliptic-curve",
  "pkcs8",
  "crypto-bigint 0.5.5",
  "elliptic-curve 0.13.8",
  "pkcs8 0.10.2",
  "rand_core 0.6.4",
  "serdect 0.3.0",
  "sha3",
  "signature",
  "sha3 0.10.9",
  "signature 2.2.0",
  "subtle",
  "zeroize",
+]
@@ @@ -959,12 +1200,29 @@ dependencies = [ @@
+]
 [[package]]
 name = "data-encoding"
 version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 [[package]]
 name = "dbl"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bd2735a791158376708f9347fe8faba9667589d82427ef3aed6794a8981de3d9"
 dependencies = [
  "generic-array",
  "generic-array 0.14.9",
+]
 [[package]]
 name = "delegate"
 version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "780eb241654bf097afb00fc5f054a09b687dad862e485fdcf8399bb056565370"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.119",
+]
 [[package]]
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
  "const-oid 0.9.6",
  "pem-rfc7468",
  "pem-rfc7468 0.7.0",
  "zeroize",
+]
 [[package]]
 name = "der"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a69dedd701da44b0536442edf09c81a64b0ab97a7a4a5e3d1971f00027cbc63d"
 dependencies = [
  "const-oid 0.10.2",
  "pem-rfc7468 1.0.0",
  "zeroize",
+]
@@ @@ -1047,7 +1316,16 @@ version = "0.8.1" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ffdd80ce8ce993de27e9f063a444a4d53ce8e8db4c1f00cc03af5ad5a9867a1e"
 dependencies = [
  "cipher",
  "cipher 0.4.4",
+]
 [[package]]
 name = "des"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "916a94e407b54f9034d71dd748234cd1e516ced6284009906ae246f177eafe5a"
 dependencies = [
  "cipher 0.5.2",
+]
 [[package]]
@@ @@ -1100,10 +1378,10 @@ dependencies = [ @@
  "digest 0.10.7",
  "num-bigint-dig",
  "num-traits",
  "pkcs8",
  "rfc6979",
  "pkcs8 0.10.2",
  "rfc6979 0.4.0",
  "sha2 0.10.9",
  "signature",
  "signature 2.2.0",
  "zeroize",
+]
@@ @@ -1123,15 +1401,21 @@ dependencies = [ @@
+]
 [[package]]
 name = "dunce"
 version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
 [[package]]
 name = "eax"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9954fabd903b82b9d7a68f65f97dc96dd9ad368e40ccc907a7c19d53e6bfac28"
 dependencies = [
  "aead",
  "cipher",
  "aead 0.5.2",
  "cipher 0.4.4",
  "cmac",
  "ctr",
  "ctr 0.9.2",
  "subtle",
+]
@@ @@ -1141,12 +1425,27 @@ version = "0.16.9" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
 dependencies = [
  "der",
  "der 0.7.10",
  "digest 0.10.7",
  "elliptic-curve",
  "rfc6979",
  "signature",
  "spki",
  "elliptic-curve 0.13.8",
  "rfc6979 0.4.0",
  "signature 2.2.0",
  "spki 0.7.3",
+]
 [[package]]
 name = "ecdsa"
 version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0681a4fc24c767085329728d8dfba959af91228aa4610cca4f8ce317ba46ae0"
 dependencies = [
  "der 0.8.1",
  "digest 0.11.3",
  "elliptic-curve 0.14.1",
  "rfc6979 0.6.0",
  "signature 3.0.0",
  "spki 0.8.0",
  "zeroize",
+]
 [[package]]
@@ @@ -1155,8 +1454,18 @@ version = "2.2.3" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
  "pkcs8",
  "signature",
  "pkcs8 0.10.2",
  "signature 2.2.0",
+]
 [[package]]
 name = "ed25519"
 version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a"
 dependencies = [
  "pkcs8 0.11.0",
  "signature 3.0.0",
+]
 [[package]]
@@ @@ -1165,8 +1474,8 @@ version = "2.2.0" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
  "curve25519-dalek",
  "ed25519",
  "curve25519-dalek 4.1.3",
  "ed25519 2.2.3",
  "rand_core 0.6.4",
  "serde",
  "sha2 0.10.9",
@@ @@ -1175,6 +1484,22 @@ dependencies = [ @@
+]
 [[package]]
 name = "ed25519-dalek"
 version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de"
 dependencies = [
  "curve25519-dalek 5.0.0",
  "ed25519 3.0.0",
  "rand_core 0.10.1",
  "serde",
  "sha2 0.11.0",
  "signature 3.0.0",
  "subtle",
  "zeroize",
+]
 [[package]]
 name = "either"
 version = "1.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -1189,18 +1514,18 @@ version = "0.13.8" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
  "base16ct",
  "base16ct 0.2.0",
  "base64ct",
  "crypto-bigint",
  "crypto-bigint 0.5.5",
  "digest 0.10.7",
  "ff",
  "generic-array",
  "group",
  "ff 0.13.1",
  "generic-array 0.14.9",
  "group 0.13.0",
  "hkdf 0.12.4",
  "pem-rfc7468",
  "pkcs8",
  "pem-rfc7468 0.7.0",
  "pkcs8 0.10.2",
  "rand_core 0.6.4",
  "sec1",
  "sec1 0.7.3",
  "serde_json",
  "serdect 0.2.0",
  "subtle",
@@ @@ -1209,6 +1534,28 @@ dependencies = [ @@
+]
 [[package]]
 name = "elliptic-curve"
 version = "0.14.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d65aa39b3a5c1c9c1b745c9a019234bb7a21b77abcb4f4d266d706e2d577d65"
 dependencies = [
  "base16ct 1.0.0",
  "crypto-bigint 0.7.5",
  "crypto-common 0.2.2",
  "digest 0.11.3",
  "ff 0.14.0",
  "group 0.14.0",
  "hkdf 0.13.0",
  "hybrid-array",
  "pem-rfc7468 1.0.0",
  "pkcs8 0.11.0",
  "rand_core 0.10.1",
  "sec1 0.8.1",
  "subtle",
  "zeroize",
+]
 [[package]]
 name = "email-encoding"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5320ae4c3782150d900b79807611a59a99fc9a1d61d686faafc24b93fc8d7ca"
 [[package]]
 name = "enum_dispatch"
 version = "0.3.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aa18ce2bc66555b3218614519ac839ddb759a7d6720732f979ef8d13be147ecd"
 dependencies = [
  "once_cell",
  "proc-macro2",
  "quote",
  "syn 2.0.119",
+]
 [[package]]
 name = "equivalent"
 version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -1280,6 +1639,7 @@ dependencies = [ @@
  "anyhow",
  "cli",
  "config",
  "ssh",
  "store",
  "tokio",
  "web",
@@ @@ -1303,12 +1663,28 @@ dependencies = [ @@
+]
 [[package]]
 name = "ff"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a1f686ab92a9fb0eaf188f6c6c87b89490baa6fdb0db4544ba4dc47f7942489f"
 dependencies = [
  "rand_core 0.10.1",
  "subtle",
+]
 [[package]]
 name = "fiat-crypto"
 version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 [[package]]
 name = "fiat-crypto"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
 [[package]]
 name = "figment"
 version = "0.10.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -1395,12 +1771,33 @@ dependencies = [ @@
+]
 [[package]]
 name = "fs_extra"
 version = "1.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
 [[package]]
 name = "funty"
 version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6d5a32815ae3f33302d95fdcb2ce17862f8c65363dcfd29360480ba1001fc9c"
 [[package]]
 name = "futures"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a88cf1f829d945f548cf8fec32c61b1f202b6d93b45848602fc02af4b12ad218"
 dependencies = [
  "futures-channel",
  "futures-core",
  "futures-executor",
  "futures-io",
  "futures-sink",
  "futures-task",
  "futures-util",
+]
 [[package]]
 name = "futures-channel"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4577ecaa3c4f96589d473f679a71b596316f6641bc350038b962a5daf0085d7a"
 [[package]]
 name = "futures-macro"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d6d3cde68c518367be28956066ddfef33813991b77a55005a69dae04bf3b10b"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.119",
+]
 [[package]]
 name = "futures-sink"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -1462,8 +1870,10 @@ version = "0.3.33" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a77a90a256fce34da66415271e30f94ee91c57b04b8a2c042d9cf3220179deaa"
 dependencies = [
  "futures-channel",
  "futures-core",
  "futures-io",
  "futures-macro",
  "futures-sink",
  "futures-task",
  "memchr",
@@ @@ -1483,6 +1893,17 @@ dependencies = [ @@
+]
 [[package]]
 name = "generic-array"
 version = "1.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab4e5aa225bc56696909483320f0ff9b600f1a971b52e07a17d70f3d9b43254b"
 dependencies = [
  "generic-array 0.14.9",
  "rustversion",
  "typenum",
+]
 [[package]]
 name = "getrandom"
 version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
  "r-efi 6.0.0",
  "rand_core 0.10.1",
  "wasm-bindgen",
+]
 [[package]]
 checksum = "f0d8a4362ccb29cb0b265253fb0a2728f592895ee6854fd9bc13f2ffda266ff1"
 dependencies = [
  "opaque-debug",
  "polyval",
  "polyval 0.6.2",
+]
 [[package]]
 name = "ghash"
 version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2eecf2d5dc9b66b732b97707a0210906b1d30523eb773193ab777c0c84b3e8d5"
 dependencies = [
  "polyval 0.7.3",
+]
 [[package]]
@@ @@ -1538,7 +1970,7 @@ dependencies = [ @@
  "moka",
  "pgp",
  "rand_core 0.6.4",
  "ssh-key",
  "ssh-key 0.6.7",
  "tempfile",
  "thiserror 2.0.19",
  "tokio",
@@ @@ -1576,12 +2008,23 @@ version = "0.13.0" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
  "ff",
  "ff 0.13.1",
  "rand_core 0.6.4",
  "subtle",
+]
 [[package]]
 name = "group"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7fd1a1c7a5206c5b7a3f5a0d7ccd3ff85d0c8f5133d62a02680255b0004af5f4"
 dependencies = [
  "ff 0.14.0",
  "rand_core 0.10.1",
  "subtle",
+]
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 [[package]]
 name = "hex-literal"
 version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e712f64ec3850b98572bffac52e2c6f282b29fe6c5fa6d42334b30be438d95c1"
 [[package]]
 name = "highlight"
 version = "0.1.0"
 dependencies = [
@@ @@ -1735,7 +2184,10 @@ version = "0.4.13" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
 dependencies = [
  "ctutils",
  "subtle",
  "typenum",
  "zeroize",
+]
 [[package]]
@@ @@ -1774,6 +2226,30 @@ dependencies = [ @@
+]
 [[package]]
 name = "iana-time-zone"
 version = "0.1.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
  "iana-time-zone-haiku",
  "js-sys",
  "log",
  "wasm-bindgen",
  "windows-core",
+]
 [[package]]
 name = "iana-time-zone-haiku"
 version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
 dependencies = [
  "cc",
+]
 [[package]]
 name = "icu_collections"
 version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -1860,7 +2336,7 @@ version = "0.5.1" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "075557004419d7f2031b8bb7f44bb43e55a83ca7b63076a8fb8fe75753836477"
 dependencies = [
  "cipher",
  "cipher 0.4.4",
+]
 [[package]]
@@ @@ -1929,7 +2405,17 @@ version = "0.1.4" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
 dependencies = [
  "generic-array",
  "generic-array 0.14.9",
+]
 [[package]]
 name = "inout"
 version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
 dependencies = [
  "block-padding 0.4.2",
  "hybrid-array",
+]
 [[package]]
@@ @@ -1945,6 +2431,18 @@ dependencies = [ @@
+]
 [[package]]
 name = "internal-russh-num-bigint"
 version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ae8e22120c32fb4d19ec55fba35015f57095cd95a2e3b732e44457f5915b2ee8"
 dependencies = [
  "num-integer",
  "num-traits",
  "rand 0.10.2",
  "rand_core 0.10.1",
+]
 [[package]]
 name = "is_terminal_polyfill"
 version = "1.70.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
 dependencies = [
  "cfg-if",
  "ecdsa",
  "elliptic-curve",
  "ecdsa 0.16.9",
  "elliptic-curve 0.13.8",
  "once_cell",
  "sha2 0.10.9",
  "signature",
  "signature 2.2.0",
+]
 [[package]]
@@ @@ -2007,6 +2505,26 @@ dependencies = [ @@
+]
 [[package]]
 name = "keccak"
 version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e24a010dd405bd7ed803e5253182815b41bf2e6a80cc3bfc066658e03a198aa"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
+]
 [[package]]
 name = "kem"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "01737161ba802849cfd486b5bd209d38ba4943494c249a8126005170c7621edd"
 dependencies = [
  "crypto-common 0.2.2",
  "rand_core 0.10.1",
+]
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2209,6 +2727,12 @@ dependencies = [ @@
+]
 [[package]]
 name = "md5"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7ebb8d8732c6a6df3d8f032a82911cfc747e00efb95cc46e8d0acd5b5b88570c"
 [[package]]
 name = "memchr"
 version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2252,6 +2776,20 @@ dependencies = [ @@
+]
 [[package]]
 name = "ml-kem"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e15f3e5b957493873e396a66914e83e616b6afe335cdef7efe5c6e1216aba66"
 dependencies = [
  "hybrid-array",
  "kem",
  "module-lattice",
  "pkcs8 0.11.0",
  "rand_core 0.10.1",
  "sha3 0.11.0",
+]
 [[package]]
 name = "model"
 version = "0.1.0"
 dependencies = [
@@ @@ -2259,6 +2797,17 @@ dependencies = [ @@
+]
 [[package]]
 name = "module-lattice"
 version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c61b87c9683ab7cb1c6871d261ad5479b6b10ceb52c4352aaca3b5d35a8febe"
 dependencies = [
  "ctutils",
  "hybrid-array",
  "num-traits",
+]
 [[package]]
 name = "moka"
 version = "0.12.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
 [[package]]
 name = "nix"
 version = "0.31.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
 dependencies = [
  "bitflags",
  "cfg-if",
  "cfg_aliases",
  "libc",
+]
 [[package]]
 name = "nom"
 version = "8.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2317,6 +2878,16 @@ dependencies = [ @@
+]
 [[package]]
 name = "num-bigint"
 version = "0.4.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c89e69e7e0f03bea5ef08013795c25018e101932225a656383bd384495ecc367"
 dependencies = [
  "num-integer",
  "num-traits",
+]
 [[package]]
 name = "num-bigint-dig"
 version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2395,9 +2966,9 @@ version = "0.1.0" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c196e0276c471c843dd5777e7543a36a298a4be942a2a688d8111cd43390dedb"
 dependencies = [
  "aead",
  "cipher",
  "ctr",
  "aead 0.5.2",
  "cipher 0.4.4",
  "ctr 0.9.2",
  "subtle",
+]
@@ @@ -2468,39 +3039,100 @@ version = "0.13.2" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
 dependencies = [
  "ecdsa",
  "elliptic-curve",
  "primeorder",
  "ecdsa 0.16.9",
  "elliptic-curve 0.13.8",
  "primeorder 0.13.6",
  "sha2 0.10.9",
+]
 [[package]]
 name = "p256"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2c9239b2dbc807adbbe147e8cf72ea7450c3a0aabe62cb8e75ff4ec22e1f72a"
 dependencies = [
  "ecdsa 0.17.0",
  "elliptic-curve 0.14.1",
  "primefield",
  "primeorder 0.14.0",
  "sha2 0.11.0",
+]
 [[package]]
 name = "p384"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
 dependencies = [
  "ecdsa",
  "elliptic-curve",
  "primeorder",
  "ecdsa 0.16.9",
  "elliptic-curve 0.13.8",
  "primeorder 0.13.6",
  "sha2 0.10.9",
+]
 [[package]]
 name = "p384"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d17b851e6b3e378ab4ecb07fa2ed23f4d15f075735f8fec9fa1e7bdce5f8301f"
 dependencies = [
  "ecdsa 0.17.0",
  "elliptic-curve 0.14.1",
  "fiat-crypto 0.3.0",
  "primefield",
  "primeorder 0.14.0",
  "sha2 0.11.0",
+]
 [[package]]
 name = "p521"
 version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0fc9e2161f1f215afdfce23677034ae137bbd45016a880c2eb3ba8eb95f085b2"
 dependencies = [
  "base16ct",
  "ecdsa",
  "elliptic-curve",
  "primeorder",
  "base16ct 0.2.0",
  "ecdsa 0.16.9",
  "elliptic-curve 0.13.8",
  "primeorder 0.13.6",
  "rand_core 0.6.4",
  "sha2 0.10.9",
+]
 [[package]]
 name = "p521"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4ad64cc32c2dc466317c12ee5853e61f159f9eab1fe7efade0395dc2e7b43449"
 dependencies = [
  "base16ct 1.0.0",
  "ecdsa 0.17.0",
  "elliptic-curve 0.14.1",
  "primefield",
  "primeorder 0.14.0",
  "sha2 0.11.0",
+]
 [[package]]
 name = "pageant"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4f3a5ae18f65a85c67a77d18d42d3606c07948e3c17c1e5f74852b26589e88a5"
 dependencies = [
  "base16ct 1.0.0",
  "byteorder",
  "bytes",
  "delegate",
  "futures",
  "log",
  "rand 0.10.2",
  "sha2 0.11.0",
  "thiserror 2.0.19",
  "tokio",
  "windows",
  "windows-strings",
+]
 [[package]]
 name = "parking"
 version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2541,6 +3173,25 @@ dependencies = [ @@
+]
 [[package]]
 name = "password-hash"
 version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aab41826031698d6ffcd9cff78ef56ef998e39dc7e5067cdfebe373842d4723b"
 dependencies = [
  "phc",
+]
 [[package]]
 name = "pbkdf2"
 version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629"
 dependencies = [
  "digest 0.11.3",
  "hmac 0.13.0",
+]
 [[package]]
 name = "pear"
 version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2573,6 +3224,15 @@ dependencies = [ @@
+]
 [[package]]
 name = "pem-rfc7468"
 version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6305423e0e7738146434843d1694d621cce767262b2a86910beab705e4493d9"
 dependencies = [
  "base64ct",
+]
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2584,15 +3244,15 @@ version = "0.20.0" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1cfa4743b28656065ff4c0ba09e46b357a65e8c00fc2341e89084b82f87cbdf1"
 dependencies = [
  "aead",
  "aes",
  "aes-gcm",
  "aead 0.5.2",
  "aes 0.8.4",
  "aes-gcm 0.10.3",
  "aes-kw",
  "argon2",
  "argon2 0.5.3",
  "base64",
  "bitfields",
  "block-padding",
  "blowfish",
  "block-padding 0.3.3",
  "blowfish 0.9.1",
  "buffer-redux",
  "byteorder",
  "bytes",
@@ @@ -2600,22 +3260,22 @@ dependencies = [ @@
  "camellia",
  "cast5",
  "cfb-mode",
  "cipher",
  "cipher 0.4.4",
  "const-oid 0.9.6",
  "crc24",
  "curve25519-dalek",
  "curve25519-dalek 4.1.3",
  "cx448",
  "derive_builder",
  "derive_more",
  "des",
  "des 0.8.1",
  "digest 0.10.7",
  "dsa",
  "eax",
  "ecdsa",
  "ed25519-dalek",
  "elliptic-curve",
  "ecdsa 0.16.9",
  "ed25519-dalek 2.2.0",
  "elliptic-curve 0.13.8",
  "flate2",
  "generic-array",
  "generic-array 0.14.9",
  "hex",
  "hkdf 0.12.4",
  "idea",
@@ @@ -2628,18 +3288,18 @@ dependencies = [ @@
  "num-traits",
  "num_enum",
  "ocb3",
  "p256",
  "p384",
  "p521",
  "p256 0.13.2",
  "p384 0.13.1",
  "p521 0.13.3",
  "rand 0.8.7",
  "replace_with",
  "ripemd",
  "rsa",
  "rsa 0.9.10",
  "sha1 0.10.7",
  "sha1-checked",
  "sha2 0.10.9",
  "sha3",
  "signature",
  "sha3 0.10.9",
  "signature 2.2.0",
  "smallvec",
  "snafu",
  "subtle",
@@ @@ -2649,6 +3309,16 @@ dependencies = [ @@
+]
 [[package]]
 name = "phc"
 version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "44dc769b75f93afdddd8c7fa12d685292ddeff1e66f7f0f3a234cf1818afe892"
 dependencies = [
  "base64ct",
  "ctutils",
+]
 [[package]]
 name = "phf"
 version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2699,9 +3369,36 @@ version = "0.7.5" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
 dependencies = [
  "der",
  "pkcs8",
  "spki",
  "der 0.7.10",
  "pkcs8 0.10.2",
  "spki 0.7.3",
+]
 [[package]]
 name = "pkcs1"
 version = "0.8.0-rc.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "986d2e952779af96ea048f160fd9194e1751b4faea78bcf3ceb456efe008088e"
 dependencies = [
  "der 0.8.1",
  "spki 0.8.0",
+]
 [[package]]
 name = "pkcs5"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63d440a804ec8d6fafbb6b84471e013286658d373248927692ab3366686220ca"
 dependencies = [
  "aes 0.9.1",
  "aes-gcm 0.11.0",
  "cbc",
  "der 0.8.1",
  "pbkdf2",
  "rand_core 0.10.1",
  "scrypt",
  "sha2 0.11.0",
  "spki 0.8.0",
+]
 [[package]]
@@ @@ -2710,8 +3407,20 @@ version = "0.10.2" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
  "der",
  "spki",
  "der 0.7.10",
  "spki 0.7.3",
+]
 [[package]]
 name = "pkcs8"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
 dependencies = [
  "der 0.8.1",
  "pkcs5",
  "rand_core 0.10.1",
  "spki 0.8.0",
+]
 [[package]]
 checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 [[package]]
 name = "poly1305"
 version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e2d0073b297041425c7c3df6eb4792d598a15323fe63346852b092eca02904c"
 dependencies = [
  "cpufeatures 0.3.0",
  "universal-hash 0.6.1",
  "zeroize",
+]
 [[package]]
 name = "polyval"
 version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2729,7 +3449,18 @@ dependencies = [ @@
  "cfg-if",
  "cpufeatures 0.2.17",
  "opaque-debug",
  "universal-hash",
  "universal-hash 0.5.1",
+]
 [[package]]
 name = "polyval"
 version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0fa31d631f2b2cb2a544d0aa321ce847a94764d701ca2becc411138b93d49cd"
 dependencies = [
  "cpubits",
  "cpufeatures 0.3.0",
  "universal-hash 0.6.1",
+]
 [[package]]
 checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
 [[package]]
 name = "primefield"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c555a6e4eb7d4e158fcb028c835c3b8642206ddc279b5c6b202ef9a8bdb592f4"
 dependencies = [
  "crypto-bigint 0.7.5",
  "crypto-common 0.2.2",
  "ff 0.14.0",
  "rand_core 0.10.1",
  "subtle",
  "zeroize",
+]
 [[package]]
 name = "primeorder"
 version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
 dependencies = [
  "elliptic-curve",
  "elliptic-curve 0.13.8",
+]
 [[package]]
 name = "primeorder"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5c9f42978c78a00e3d68f69fc03e57a234debae69da4020a4fb588fcdcd07b06"
 dependencies = [
  "elliptic-curve 0.14.1",
  "once_cell",
  "primefield",
  "serdect 0.4.3",
  "wnaf",
+]
 [[package]]
@@ @@ -2963,6 +3721,16 @@ dependencies = [ @@
+]
 [[package]]
 name = "rfc6979"
 version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4a459cddafb3fe76b31fd8f1108007566c40301feb64dc7b54656eb7388172b"
 dependencies = [
  "crypto-bigint 0.7.5",
  "hmac 0.13.0",
+]
 [[package]]
 name = "ripemd"
 version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -2975,42 +3743,157 @@ dependencies = [ @@
 name = "rpassword"
 version = "7.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2da316a15f47e3d053de9cb2c439650bd8fa4aaeb9365f2e5f27f492ff73c196"
 checksum = "2da316a15f47e3d053de9cb2c439650bd8fa4aaeb9365f2e5f27f492ff73c196"
 dependencies = [
  "libc",
  "rtoolbox",
  "windows-sys 0.61.2",
+]
 [[package]]
 name = "rsa"
 version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
  "const-oid 0.9.6",
  "digest 0.10.7",
  "num-bigint-dig",
  "num-integer",
  "num-traits",
  "pkcs1 0.7.5",
  "pkcs8 0.10.2",
  "rand_core 0.6.4",
  "sha2 0.10.9",
  "signature 2.2.0",
  "spki 0.7.3",
  "subtle",
  "zeroize",
+]
 [[package]]
 name = "rsa"
 version = "0.10.0-rc.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "30b2aa4ba0d89f73d1e332df05be0eeab8840351c36ca5654341dfdb57bb3caf"
 dependencies = [
  "const-oid 0.10.2",
  "crypto-bigint 0.7.5",
  "crypto-primes",
  "digest 0.11.3",
  "pkcs1 0.8.0-rc.4",
  "pkcs8 0.11.0",
  "rand_core 0.10.1",
  "sha2 0.11.0",
  "signature 3.0.0",
  "spki 0.8.0",
  "zeroize",
+]
 [[package]]
 name = "rtoolbox"
 version = "0.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "50a0e551c1e27e1731aba276dbeaeac73f53c7cd34d1bda485d02bd1e0f36844"
 dependencies = [
  "libc",
  "rtoolbox",
  "windows-sys 0.61.2",
  "windows-sys 0.59.0",
+]
 [[package]]
 name = "rsa"
 version = "0.9.10"
 name = "russh"
 version = "0.62.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 checksum = "b8b67b5a0d8068c89dcbe9d95df986af7a851d1f3c604525274c37468e60464f"
 dependencies = [
  "const-oid 0.9.6",
  "digest 0.10.7",
  "num-bigint-dig",
  "num-integer",
  "num-traits",
  "pkcs1",
  "pkcs8",
  "rand_core 0.6.4",
  "sha2 0.10.9",
  "signature",
  "spki",
  "aes 0.9.1",
  "aws-lc-rs",
  "bitflags",
  "block-padding 0.4.2",
  "byteorder",
  "bytes",
  "cbc",
  "cipher 0.5.2",
  "crypto-bigint 0.7.5",
  "ctr 0.10.1",
  "curve25519-dalek 5.0.0",
  "data-encoding",
  "delegate",
  "der 0.8.1",
  "digest 0.11.3",
  "ecdsa 0.17.0",
  "ed25519-dalek 3.0.0",
  "elliptic-curve 0.14.1",
  "enum_dispatch",
  "flate2",
  "futures",
  "generic-array 1.4.4",
  "getrandom 0.4.3",
  "ghash 0.6.0",
  "hex-literal",
  "hmac 0.13.0",
  "inout 0.2.2",
  "internal-russh-num-bigint",
  "keccak 0.2.0",
  "log",
  "md5",
  "ml-kem",
  "module-lattice",
  "num-bigint",
  "p256 0.14.0",
  "p384 0.14.0",
  "p521 0.14.0",
  "pageant",
  "pbkdf2",
  "pkcs1 0.8.0-rc.4",
  "pkcs5",
  "pkcs8 0.11.0",
  "polyval 0.7.3",
  "rand 0.10.2",
  "rand_core 0.10.1",
  "rsa 0.10.0-rc.18",
  "russh-cryptovec",
  "russh-util",
  "salsa20",
  "scrypt",
  "sec1 0.8.1",
  "sha1 0.11.0",
  "sha2 0.11.0",
  "sha3 0.12.0",
  "signature 3.0.0",
  "spki 0.8.0",
  "ssh-encoding 0.3.0",
  "ssh-key 0.7.0-rc.11",
  "subtle",
  "thiserror 2.0.19",
  "tokio",
  "typenum",
  "universal-hash 0.6.1",
  "zeroize",
+]
 [[package]]
 name = "rtoolbox"
 version = "0.0.5"
 name = "russh-cryptovec"
 version = "0.62.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "50a0e551c1e27e1731aba276dbeaeac73f53c7cd34d1bda485d02bd1e0f36844"
 checksum = "3aec6cb630dbe85d72ffd7bcd95f07e1bd69f9f270ee8adfa1afe443a6331438"
 dependencies = [
  "libc",
  "windows-sys 0.59.0",
  "log",
  "nix",
  "ssh-encoding 0.3.0",
  "windows-sys 0.61.2",
+]
 [[package]]
 name = "russh-util"
 version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "668424a5dde0bcb45b55ba7de8476b93831b4aa2fa6947e145f3b053e22c60b6"
 dependencies = [
  "chrono",
  "tokio",
  "wasm-bindgen",
  "wasm-bindgen-futures",
+]
 [[package]]
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 [[package]]
 name = "salsa20"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2f874456e72520ff1375a06c588eaf074b0f01f9e9e1aada45bd9b7954a6e42c"
 dependencies = [
  "cfg-if",
  "cipher 0.5.2",
+]
 [[package]]
 name = "same-file"
 version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 [[package]]
 name = "scrypt"
 version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d87af57419b594aa23fa95f09f0e06d80d84ba01c26148c43844cad6ff4485f0"
 dependencies = [
  "cfg-if",
  "pbkdf2",
  "salsa20",
  "sha2 0.11.0",
+]
 [[package]]
 name = "sec1"
 version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
  "base16ct",
  "der",
  "generic-array",
  "pkcs8",
  "base16ct 0.2.0",
  "der 0.7.10",
  "generic-array 0.14.9",
  "pkcs8 0.10.2",
  "serdect 0.2.0",
  "subtle",
  "zeroize",
+]
 [[package]]
 name = "sec1"
 version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d56d437c2f19203ce5f7122e507831de96f3d2d4d3be5af44a0b0a09d8a80e4d"
 dependencies = [
  "base16ct 1.0.0",
  "ctutils",
  "der 0.8.1",
  "hybrid-array",
  "subtle",
  "zeroize",
+]
 [[package]]
 name = "security-framework"
 version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -3237,7 +4156,7 @@ version = "0.2.0" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a84f14a19e9a014bb9f4512488d9829a68e04ecabffb0f9904cd1ace94598177"
 dependencies = [
  "base16ct",
  "base16ct 0.2.0",
  "serde",
+]
@@ @@ -3247,7 +4166,17 @@ version = "0.3.0" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f42f67da2385b51a5f9652db9c93d78aeaf7610bf5ec366080b6de810604af53"
 dependencies = [
  "base16ct",
  "base16ct 0.2.0",
  "serde",
+]
 [[package]]
 name = "serdect"
 version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66cf8fedced2fcf12406bcb34223dffb92eaf34908ede12fed414c82b7f00b3e"
 dependencies = [
  "base16ct 1.0.0",
  "serde",
+]
 checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
 dependencies = [
  "digest 0.10.7",
  "keccak",
  "keccak 0.1.6",
+]
 [[package]]
 name = "sha3"
 version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be176f1a57ce4e3d31c1a166222d9768de5954f811601fb7ca06fc8203905ce1"
 dependencies = [
  "digest 0.11.3",
  "keccak 0.2.0",
+]
 [[package]]
 name = "sha3"
 version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bc9bad02c26382724b2d2692c6f179285e4b54eeecd7968f52a50059c3c11759"
 dependencies = [
  "digest 0.11.3",
  "keccak 0.2.0",
  "sponge-cursor",
+]
 [[package]]
@@ @@ -3352,6 +4302,16 @@ dependencies = [ @@
+]
 [[package]]
 name = "signature"
 version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28d567dcbaf0049cb8ac2608a76cd95ff9e4412e1899d389ee400918ca7537f5"
 dependencies = [
  "digest 0.11.3",
  "rand_core 0.10.1",
+]
 [[package]]
 name = "simd-adler32"
 version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
  "der",
  "der 0.7.10",
+]
 [[package]]
 name = "spki"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f"
 dependencies = [
  "base64ct",
  "der 0.8.1",
+]
 [[package]]
 name = "sponge-cursor"
 version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a0219bd7d979d58245a4f41f695e1ac9f8befdffadd7f61f1bae9e39abc6620"
 [[package]]
 name = "sqlx"
 version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -3534,7 +4510,7 @@ dependencies = [ @@
  "either",
  "futures-core",
  "futures-util",
  "generic-array",
  "generic-array 0.14.9",
  "log",
  "percent-encoding",
  "serde",
@@ @@ -3607,6 +4583,20 @@ dependencies = [ @@
 [[package]]
 name = "ssh"
 version = "0.1.0"
 dependencies = [
  "auth",
  "config",
  "git",
  "model",
  "rand_core 0.6.4",
  "russh",
  "ssh-key 0.6.7",
  "store",
  "tempfile",
  "thiserror 2.0.19",
  "tokio",
  "tracing",
+]
 [[package]]
 name = "ssh-cipher"
@@ @@ -3614,8 +4604,26 @@ version = "0.2.0" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "caac132742f0d33c3af65bfcde7f6aa8f62f0e991d80db99149eb9d44708784f"
 dependencies = [
  "cipher",
  "ssh-encoding",
  "cipher 0.4.4",
  "ssh-encoding 0.2.0",
+]
 [[package]]
 name = "ssh-cipher"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d801accda99469cde6d73da741422610fdf6508a72d9a69d1b55cb241c720597"
 dependencies = [
  "aead 0.6.1",
  "aes 0.9.1",
  "aes-gcm 0.11.0",
  "chacha20",
  "cipher 0.5.2",
  "ctutils",
  "des 0.9.0",
  "poly1305",
  "ssh-encoding 0.3.0",
  "zeroize",
+]
 [[package]]
 checksum = "eb9242b9ef4108a78e8cd1a2c98e193ef372437f8c22be363075233321dd4a15"
 dependencies = [
  "base64ct",
  "pem-rfc7468",
  "pem-rfc7468 0.7.0",
  "sha2 0.10.9",
+]
 [[package]]
 name = "ssh-encoding"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b54d0ed0498daf3f78d82e00e28c8eec9d75a067c4cfbcc7a0f7d0f4077749e"
 dependencies = [
  "base64ct",
  "bytes",
  "crypto-bigint 0.7.5",
  "ctutils",
  "digest 0.11.3",
  "pem-rfc7468 1.0.0",
  "zeroize",
+]
 [[package]]
 name = "ssh-key"
 version = "0.6.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3b86f5297f0f04d08cabaa0f6bff7cb6aec4d9c3b49d87990d63da9d9156a8c3"
 dependencies = [
  "ed25519-dalek",
  "ed25519-dalek 2.2.0",
  "num-bigint-dig",
  "p256",
  "p384",
  "p521",
  "p256 0.13.2",
  "p384 0.13.1",
  "p521 0.13.3",
  "rand_core 0.6.4",
  "rsa",
  "sec1",
  "rsa 0.9.10",
  "sec1 0.7.3",
  "sha2 0.10.9",
  "signature",
  "ssh-cipher",
  "ssh-encoding",
  "signature 2.2.0",
  "ssh-cipher 0.2.0",
  "ssh-encoding 0.2.0",
  "subtle",
  "zeroize",
+]
 [[package]]
 name = "ssh-key"
 version = "0.7.0-rc.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9a32fae177b74a22aa9c5b01bf7e68b33545be32d9e381e248058d2adc15ce3"
 dependencies = [
  "argon2 0.6.0-rc.8",
  "bcrypt-pbkdf",
  "ctutils",
  "ed25519-dalek 3.0.0",
  "hex",
  "hmac 0.13.0",
  "p256 0.14.0",
  "p384 0.14.0",
  "p521 0.14.0",
  "rand_core 0.10.1",
  "rsa 0.10.0-rc.18",
  "sec1 0.8.1",
  "sha1 0.11.0",
  "sha2 0.11.0",
  "signature 3.0.0",
  "ssh-cipher 0.3.0",
  "ssh-encoding 0.3.0",
  "zeroize",
+]
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -4156,7 +5205,7 @@ version = "0.7.1" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a78e83a30223c757c3947cd144a31014ff04298d8719ae10d03c31c0448c8013"
 dependencies = [
  "cipher",
  "cipher 0.4.4",
+]
 [[package]]
@@ @@ -4246,6 +5295,22 @@ dependencies = [ @@
+]
 [[package]]
 name = "universal-hash"
 version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
 dependencies = [
  "crypto-common 0.2.2",
  "ctutils",
+]
 [[package]]
 name = "untrusted"
 version = "0.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
 [[package]]
 name = "url"
 version = "2.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -4343,6 +5408,16 @@ dependencies = [ @@
+]
 [[package]]
 name = "wasm-bindgen-futures"
 version = "0.4.76"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c62df1340f32221cb9c54d6a27b030e3dba64361d4a95bed55f9aacb44da291d"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
+]
 [[package]]
 name = "wasm-bindgen-macro"
 version = "0.2.126"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -4444,12 +5519,107 @@ dependencies = [ @@
+]
 [[package]]
 name = "windows"
 version = "0.62.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
 dependencies = [
  "windows-collections",
  "windows-core",
  "windows-future",
  "windows-numerics",
+]
 [[package]]
 name = "windows-collections"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
 dependencies = [
  "windows-core",
+]
 [[package]]
 name = "windows-core"
 version = "0.62.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
 dependencies = [
  "windows-implement",
  "windows-interface",
  "windows-link",
  "windows-result",
  "windows-strings",
+]
 [[package]]
 name = "windows-future"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
 dependencies = [
  "windows-core",
  "windows-link",
  "windows-threading",
+]
 [[package]]
 name = "windows-implement"
 version = "0.60.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.119",
+]
 [[package]]
 name = "windows-interface"
 version = "0.59.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn 2.0.119",
+]
 [[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 [[package]]
 name = "windows-numerics"
 version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
 dependencies = [
  "windows-core",
  "windows-link",
+]
 [[package]]
 name = "windows-result"
 version = "0.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
 dependencies = [
  "windows-link",
+]
 [[package]]
 name = "windows-strings"
 version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
 dependencies = [
  "windows-link",
+]
 [[package]]
 name = "windows-sys"
 version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -4484,6 +5654,15 @@ dependencies = [ @@
+]
 [[package]]
 name = "windows-threading"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
 dependencies = [
  "windows-link",
+]
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f17a85883d4e6d00e8a97c586de764dabcc06133f7f1d55dce5cdc070ad7fe59"
 [[package]]
 name = "wnaf"
 version = "0.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ab12e7090f27e2ffd9322651492942d50c2926094af30601e1964337db39daf1"
 dependencies = [
  "ff 0.14.0",
  "group 0.14.0",
  "hybrid-array",
+]
 [[package]]
 name = "writeable"
 version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ @@ -4567,7 +5757,7 @@ version = "2.0.1" @@
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
 dependencies = [
  "curve25519-dalek",
  "curve25519-dalek 4.1.3",
  "rand_core 0.6.4",
  "serde",
  "zeroize",

@@ @@ -3,3 +3,30 @@ @@
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! The SSH front-end: publickey auth and `exec` dispatch into pack processes.
 //!
 //! A `russh` server accepts only `publickey` auth (matching the offered key's
 //! SHA256 fingerprint against the `keys` table), handles only the `exec` channel
 //! request, and streams the channel data to and from a spawned `git`
 //! upload-pack/receive-pack process via [`git::pack`]. Anything else — a shell,
 //! a PTY, an unrecognized command — gets a friendly banner and a non-zero exit.
 mod command;
 mod hostkey;
 mod resolve;
 mod server;
 pub use crate::server::serve;
 /// An error from the SSH layer.
 #[derive(Debug, thiserror::Error)]
 pub enum SshError {
     /// A filesystem or socket I/O error.
     #[error(transparent)]
     Io(#[from] std::io::Error),
     /// The host key could not be generated, read, or written.
     #[error("host key error: {0}")]
     HostKey(String),
     /// The russh server failed to start or run.
     #[error("ssh server error: {0}")]
     Server(String),
+}

@@ @@ -0,0 +1,56 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! Normalizing and resolving the repository path from an SSH command.
 /// Normalize an SSH repo path into `(owner, repo_path)`.
 ///
 /// Strips a leading `/` and a trailing `.git`, and rejects `..`, absolute, or
 /// empty paths. The remainder is `owner/group…/repo`; the owner is the first
 /// segment and the repo path is everything after it.
 #[must_use]
 pub fn normalize(raw: &str) -> Option<(String, String)> {
     let trimmed = raw.trim().trim_matches('\'');
     let without_lead = trimmed.strip_prefix('/').unwrap_or(trimmed);
     let path = without_lead.strip_suffix(".git").unwrap_or(without_lead);
     if path.is_empty() || path.starts_with('/') {
         return None;
+    }
     // Reject traversal in any segment.
     if path
         .split('/')
         .any(|seg| seg == ".." || seg == "." || seg.is_empty())
+    {
         return None;
+    }
     let (owner, repo_path) = path.split_once('/')?;
     Some((owner.to_string(), repo_path.to_string()))
+}
 #[cfg(test)]
 mod tests {
     use super::*;
     #[test]
     fn strips_lead_and_git_suffix() {
         assert_eq!(
             normalize("/hanna/backend/api.git"),
             Some(("hanna".to_string(), "backend/api".to_string()))
         );
         assert_eq!(
             normalize("hanna/proj"),
             Some(("hanna".to_string(), "proj".to_string()))
         );
+    }
     #[test]
     fn rejects_traversal_and_malformed() {
         assert!(normalize("../etc/passwd").is_none());
         assert!(normalize("hanna/../secret").is_none());
         assert!(normalize("/absolute//path").is_none());
         assert!(normalize("").is_none());
         assert!(normalize("noowner").is_none()); // no repo path
+    }
+}

@@ @@ -0,0 +1,355 @@ @@
 // This Source Code Form is subject to the terms of the Mozilla Public
 // License, v. 2.0. If a copy of the MPL was not distributed with this
 // file, You can obtain one at https://mozilla.org/MPL/2.0/.
 //! The russh server: publickey auth, exec dispatch into pack processes.
 use std::sync::Arc;
 use std::time::Duration;
 use config::Config;
 use model::KeyKind;
 use russh::keys::{HashAlg, PublicKey};
 use russh::server::{Auth, ChannelOpenHandle, Handler, Msg, Server as _, Session};
 use russh::{Channel, ChannelId, MethodKind, MethodSet};
 use store::Store;
 use tokio::io::{AsyncReadExt as _, AsyncWriteExt as _};
 use tokio::process::ChildStdin;
 use tokio::sync::Mutex;
 use crate::SshError;
 use crate::{command, resolve};
 /// State shared across every connection.
 struct Shared {
     store: Store,
     config: Arc<Config>,
     /// The `--config` path to hand hooks via `FABRICA_CONFIG`.
     config_path: Option<String>,
+}
 /// The russh `Server` factory.
 struct GitServer {
     shared: Arc<Shared>,
+}
 impl russh::server::Server for GitServer {
     type Handler = GitHandler;
     fn new_client(&mut self, _peer: Option<std::net::SocketAddr>) -> GitHandler {
         GitHandler {
             shared: Arc::clone(&self.shared),
             identity: None,
             stdin: Arc::new(Mutex::new(None)),
+        }
+    }
+}
 /// The authenticated identity, bound after publickey auth.
 #[derive(Clone)]
 struct Identity {
     user_id: String,
     username: String,
     is_admin: bool,
     key_id: String,
+}
 /// One connection's handler.
 struct GitHandler {
     shared: Arc<Shared>,
     identity: Option<Identity>,
     /// The running pack subprocess's stdin, written to as client data arrives.
     stdin: Arc<Mutex<Option<ChildStdin>>>,
+}
 impl Handler for GitHandler {
     type Error = russh::Error;
     async fn auth_publickey(
         &mut self,
         _user: &str,
         public_key: &PublicKey,
     ) -> Result<Auth, Self::Error> {
         // Identify by key fingerprint, not the SSH username (everyone is `git@`).
         let fingerprint = public_key.fingerprint(HashAlg::Sha256).to_string();
         let Ok(Some(key)) = self
             .shared
             .store
             .key_by_fingerprint(KeyKind::Ssh, &fingerprint)
             .await
         else {
             return Ok(Auth::reject());
         };
         let Ok(Some(user)) = self.shared.store.user_by_id(&key.user_id).await else {
             return Ok(Auth::reject());
         };
         if user.disabled_at.is_some() {
             return Ok(Auth::reject());
+        }
         let _ = self.shared.store.touch_key_used(&key.id).await;
         self.identity = Some(Identity {
             user_id: user.id,
             username: user.username,
             is_admin: user.is_admin,
             key_id: key.id,
         });
         Ok(Auth::Accept)
+    }
     async fn channel_open_session(
         &mut self,
         _channel: Channel<Msg>,
         reply: ChannelOpenHandle,
         _session: &mut Session,
     ) -> Result<(), Self::Error> {
         // Dropping the handle rejects the channel, so accept it explicitly.
         reply.accept().await;
         Ok(())
+    }
     async fn exec_request(
         &mut self,
         channel: ChannelId,
         data: &[u8],
         session: &mut Session,
     ) -> Result<(), Self::Error> {
         session.channel_success(channel)?;
         let command = String::from_utf8_lossy(data).into_owned();
         if let Err(banner) = self.spawn_exec(channel, &command, session).await {
             let _ = session.extended_data(channel, 1, banner.into_bytes());
             let _ = session.exit_status_request(channel, 1);
             let _ = session.eof(channel);
             let _ = session.close(channel);
+        }
         Ok(())
+    }
     async fn shell_request(
         &mut self,
         channel: ChannelId,
         session: &mut Session,
     ) -> Result<(), Self::Error> {
         session.channel_success(channel)?;
         // Use the async handle so the banner/close actually flush before return.
         let handle = session.handle();
         let _ = handle
             .extended_data(channel, 1, self.no_shell_banner().into_bytes())
             .await;
         let _ = handle.exit_status_request(channel, 1).await;
         let _ = handle.eof(channel).await;
         let _ = handle.close(channel).await;
         Ok(())
+    }
     async fn data(
         &mut self,
         _channel: ChannelId,
         data: &[u8],
         _session: &mut Session,
     ) -> Result<(), Self::Error> {
         if let Some(stdin) = self.stdin.lock().await.as_mut() {
             let _ = stdin.write_all(data).await;
+        }
         Ok(())
+    }
     async fn channel_eof(
         &mut self,
         _channel: ChannelId,
         _session: &mut Session,
     ) -> Result<(), Self::Error> {
         // Close the child's stdin so upload-pack/receive-pack sees EOF.
         *self.stdin.lock().await = None;
         Ok(())
+    }
+}
 impl GitHandler {
     /// The friendly shell-access banner.
     fn no_shell_banner(&self) -> String {
         let who = self
             .identity
             .as_ref()
             .map_or("there", |i| i.username.as_str());
         format!("Hi {who}! fabrica does not provide shell access.\n")
+    }
     /// Authorize the exec command and, on success, spawn the pack process and start
     /// streaming. On failure returns the banner to write to stderr.
     async fn spawn_exec(
         &mut self,
         channel: ChannelId,
         command: &str,
         session: &mut Session,
     ) -> Result<(), String> {
         let Some(identity) = self.identity.clone() else {
             return Err("Authentication required.".to_string());
         };
         let parsed = command::parse(command).ok_or_else(|| self.no_shell_banner())?;
         let (owner, repo_path) = resolve::normalize(&parsed.path)
             .ok_or_else(|| "Invalid repository path.".to_string())?;
         let repo = self
             .resolve_repo(&owner, &repo_path, &identity, parsed.service)
             .await?;
         let repo_dir = git::repo_path(&self.shared.config.storage.repo_dir, &repo.id)
             .map_err(|_| "Repository is unavailable.".to_string())?;
         let env = git::pack::PackEnv {
             home: self.shared.config.storage.data_dir.join("tmp"),
             config_path: self.shared.config_path.clone(),
             user_id: Some(identity.user_id),
             user_name: Some(identity.username),
             repo_id: Some(repo.id),
             key_id: Some(identity.key_id),
             protocol: None,
         };
         let mut child = git::pack::spawn(
             &self.shared.config.git.binary,
             parsed.service,
             &[],
             &repo_dir,
             &env,
+        )
         .map_err(|e| format!("Failed to start git: {e}"))?;
         let (Some(stdin), Some(mut stdout), Some(mut stderr)) =
             (child.stdin.take(), child.stdout.take(), child.stderr.take())
         else {
             return Err("Internal error.".to_string());
         };
         *self.stdin.lock().await = Some(stdin);
         let handle = session.handle();
         tokio::spawn(async move {
             let mut obuf = vec![0u8; 32 * 1024];
             let mut ebuf = vec![0u8; 32 * 1024];
             let (mut out_done, mut err_done) = (false, false);
             while !(out_done && err_done) {
                 tokio::select! {
                     r = stdout.read(&mut obuf), if !out_done => match r {
                         Ok(0) | Err(_) => out_done = true,
                         Ok(n) => { let _ = handle.data(channel, obuf[..n].to_vec()).await; }
                     },
                     r = stderr.read(&mut ebuf), if !err_done => match r {
                         Ok(0) | Err(_) => err_done = true,
                         Ok(n) => { let _ = handle.extended_data(channel, 1, ebuf[..n].to_vec()).await; }
                     },
+                }
+            }
             let code = child
                 .wait()
                 .await
                 .ok()
                 .and_then(|s| s.code())
                 .and_then(|c| u32::try_from(c).ok())
                 .unwrap_or(0);
             let _ = handle.exit_status_request(channel, code).await;
             let _ = handle.eof(channel).await;
             let _ = handle.close(channel).await;
         });
         Ok(())
+    }
     /// Resolve and authorize the repo for the requested service.
     async fn resolve_repo(
         &self,
         owner: &str,
         repo_path: &str,
         identity: &Identity,
         service: git::pack::Service,
     ) -> Result<model::Repo, String> {
         let not_found = || "Repository not found.".to_string();
         let owner_user = self
             .shared
             .store
             .user_by_username(owner)
             .await
             .ok()
             .flatten()
             .ok_or_else(not_found)?;
         let repo = self
             .shared
             .store
             .repo_by_owner_path(&owner_user.id, repo_path)
             .await
             .ok()
             .flatten()
             .ok_or_else(not_found)?;
         let collaborator = self
             .shared
             .store
             .collaborator_permission(&repo.id, &identity.user_id)
             .await
             .ok()
             .flatten()
             .and_then(|p| auth::Permission::parse(&p));
         let viewer = auth::Viewer {
             id: identity.user_id.clone(),
             is_admin: identity.is_admin,
         };
         let access = auth::access(
             Some(&viewer),
             &repo,
             collaborator,
             self.shared.config.instance.allow_anonymous,
         );
         let required = match service {
             git::pack::Service::ReceivePack => auth::Access::Write,
             _ => auth::Access::Read,
         };
         if access >= required {
             Ok(repo)
         } else if access >= auth::Access::Read {
             Err("You do not have write access to this repository.".to_string())
         } else {
             // No read access at all: do not confirm the repo exists.
             Err(not_found())
+        }
+    }
+}
 /// Run the SSH server until the process exits. A no-op when `ssh.enabled` is false.
 ///
 /// # Errors
 ///
 /// Returns [`SshError`] if the host key cannot be prepared or the server fails to
 /// bind or run.
 pub async fn serve(
     config: Arc<Config>,
     store: Store,
     config_path: Option<String>,
 ) -> Result<(), SshError> {
     if !config.ssh.enabled {
         tracing::info!("ssh disabled (ssh.enabled = false)");
         return Ok(());
+    }
     let host_pem = crate::hostkey::load_or_generate(&config.ssh.host_key_path)?;
     let host_key = russh::keys::PrivateKey::from_openssh(host_pem.as_str())
         .map_err(|e| SshError::HostKey(format!("parsing host key: {e}")))?;
     let russh_config = Arc::new(russh::server::Config {
         methods: MethodSet::from(&[MethodKind::PublicKey][..]),
         keys: vec![host_key],
         inactivity_timeout: Some(Duration::from_secs(3600)),
         auth_rejection_time: Duration::from_secs(2),
         ..russh::server::Config::default()
     });
     let shared = Arc::new(Shared {
         store,
         config: Arc::clone(&config),
         config_path,
     });
     let addr = (config.ssh.address.clone(), config.ssh.port);
     tracing::info!(address = %config.ssh.address, port = config.ssh.port, "ssh server listening");
     let mut server = GitServer { shared };
     server
         .run_on_address(russh_config, addr)
         .await
         .map_err(|e| SshError::Server(e.to_string()))
+}

@@ @@ -156,6 +156,20 @@ impl Store { @@
         Ok(row.as_ref().map(map_key).transpose()?)
+    }
     /// Stamp a key's `last_used_at` with the current time (SSH auth binding).
     ///
     /// # Errors
     ///
     /// Returns [`StoreError::Query`] on a database failure.
     pub async fn touch_key_used(&self, key_id: &str) -> Result<(), StoreError> {
         sqlx::query("UPDATE keys SET last_used_at = $1 WHERE id = $2")
             .bind(now_ms())
             .bind(key_id)
             .execute(&self.pool)
             .await?;
         Ok(())
+    }
     /// Delete a key by id. Returns `true` if a row was removed.
     ///
     /// # Errors

@@ @@ -22,6 +22,11 @@ allow = [ @@
     "Unicode-3.0",
     "Zlib",
     "CC0-1.0",
     # SSH transport requires a crypto backend (russh -> aws-lc-rs). aws-lc-rs and
     # aws-lc-sys carry the OpenSSL license in their SPDX expression; SSH is not
     # optional for a git server, so this one addition is accepted. See
     # docs/decisions.md.
     "OpenSSL",
+]
 confidence-threshold = 0.9

 `GIT_DIR` basename and loads config from `FABRICA_CONFIG` (set by the SSH/HTTP
 server on the child) or the default location; a local push with neither set no-ops
 cleanly, and it always exits 0 so a hook error never rejects an accepted push.
 ## 2026-07-25 — SSH via russh; the OpenSSL license is admitted for the crypto backend
 **Decision:** `crates/ssh` uses `russh` 0.62 with its **default** crypto backend
 `aws-lc-rs` (explicitly **not** `ring`). `deny.toml` gains the **`OpenSSL`** license,
 and `flake.nix` gains `cmake` (aws-lc-sys builds AWS-LC via cmake).
 **Alternatives:** the `ring` backend (also carries OpenSSL-family terms and is not
 allowlisted); not shipping SSH at all.
 **Rationale:** SSH is not optional for a git server (the DoD requires push over
 SSH), the spec names russh, and russh cannot function without a crypto backend.
 Its only backends are `aws-lc-rs` (default) and `ring`; both pull the OpenSSL
 license into the SPDX graph, so *some* license admission is unavoidable to have SSH
 at all. `aws-lc-rs` is the default and keeps `ring` out. Admitting `OpenSSL` — a
 permissive license — for the crypto backend is the minimal, contained concession,
 justified by SSH being mandatory. This is the one place the otherwise-strict
 allowlist is widened, and it is scoped to the transport crypto.
 **Implementation notes:** russh merged `russh-keys` into `russh::keys` and
 re-exports `ssh-key` at a patch level distinct from the workspace's, so the two
 `PrivateKey` types differ; the host key bridges them via the OpenSSH PEM text
 (generate/load with the workspace `ssh-key`, parse with `russh::keys`). Identity is
 by key fingerprint, not the SSH username (everyone connects as `git@`);
 `channel_open_session` must explicitly `reply.accept()` in 0.62 or the channel is
 rejected; exec output streams through the `Clone + Send` `Handle` from a task.

@@ @@ -53,6 +53,8 @@ @@
             nativeBuildInputs = [
               pkgs.pkg-config
               pkgs.makeWrapper
               # aws-lc-sys (russh's crypto backend) builds AWS-LC via cmake.
               pkgs.cmake
             ];
             buildInputs = [
               pkgs.libgit2
@@ @@ -161,6 +163,7 @@ @@
               pkgs.cargo-deny
               pkgs.just
               pkgs.pkg-config
               pkgs.cmake
             ];
             buildInputs = commonArgs.buildInputs;
             LIBGIT2_NO_VENDOR = "1";

@@ @@ -54,8 +54,23 @@ pub fn run(req: ServeRequest) -> anyhow::Result<ExitCode> { @@
+        )
         .parse()?;
         let state = web::AppState::build(Arc::new(loaded.config), store, secret)?;
         web::serve(state, addr).await?;
         let config = Arc::new(loaded.config);
         // Start the SSH server alongside the web server. Its lifetime is tied to
         // the process: when web's graceful shutdown returns, we abort it.
         let ssh_config = Arc::clone(&config);
         let ssh_store = store.clone();
         let ssh_config_path = req.config_path.as_ref().map(|p| p.display().to_string());
         let ssh_task = tokio::spawn(async move {
             if let Err(err) = ssh::serve(ssh_config, ssh_store, ssh_config_path).await {
                 eprintln!("ssh server error: {err}");
+            }
         });
         let state = web::AppState::build(config, store, secret)?;
         let result = web::serve(state, addr).await;
         ssh_task.abort();
         result?;
         Ok(ExitCode::SUCCESS)
     })
+}