Module trust 

Whether this repository’s amont.conf may run.

amont.conf is committed, which is the point — a team shares a check by committing it. The consequence is that cloning a repository and committing to it would otherwise run commands that repository chose, and neither of those acts is one anybody performs as a decision about trust. Reviewing a diff before running it is; nothing asked for that.

So the manifest is inert until somebody says otherwise, and the record is keyed on the FILE’S CONTENT rather than its path: a git pull that adds a command does not inherit the consent given to the file before it.

Why git hash-object and not a hash of our own

amont links no external crates (scripts/check-no-deps.sh), and the only hash in std is DefaultHasher — SipHash with a fixed key, which is not collision-resistant and would let a crafted manifest match a trusted one’s fingerprint. Writing SHA-256 by hand is a hundred lines nobody would review as carefully as they should.

git is already a hard dependency of every path in this binary, and git hash-object is the identity git itself uses for content. It is SHA-1 (or SHA-256 in a repository configured for it), which is not a strong guarantee against a determined attacker with a chosen-prefix collision — but it is enormously better than SipHash, costs no dependency, and a user can reproduce it by hand to check what they trusted:

$ git hash-object --no-filters amont.conf

--no-filters is not decoration. Without it git applies the clean filter and eol conversion that the repository’s own committed .gitattributes asks for — so the repository would be choosing the transform its consent is taken through, and two manifests this parser reads differently can be given the same id. Consent is bound to the bytes we PARSE.

Enums

State

Constants

KEY

Where the decision is recorded. Local, never committed — a repository must not be able to declare itself trusted.

Functions

command

amont trust [--show|--revoke].

confirm

A yes/no on the terminal, or false when there is nobody to ask.

describe

Show what the manifest declares, so the decision is made with it in view.

describe_source

The same listing, rendered from text the caller already read.

fingerprint

Content id of path, as git would compute it.

fingerprint_bytes

The same identity, for bytes already in hand.

record

Record the manifest as it stands now.

record_verified

Record fp as trusted, but ONLY if the manifest still hashes to it.

recorded

What the repository has recorded, if anything.

revoke

Forget it.

state

Decide whether repo’s manifest may run.

state_of

The same decision, about bytes the caller already holds.

why

The reason an external does not run, phrased for the check’s own report.