Crate git_zero_server 

Git HTTP backend, upload-pack and opt-in receive-pack building blocks. The host supplies repository storage, authentication and HTTP transfer framing.

Modules

dumb

Immutable packed dumb HTTP publication. Pack names use wire checksums, never selected-cache keys. The host pins the publication’s URL and repository.

receive

Receive-pack wire handling. The host authenticates requests, quarantines objects, resolves deltas, validates graph/ref updates, and publishes them. This module never acknowledges a push or changes refs on its own.

stored

Smart HTTP protocol over an external immutable object/ref catalog. Parsing never grants access: the host authorizes wants, checks common commit IDs, selects a closure and supplies authenticated pack representations separately.

stream

Host-driven request intake and pull-based responses. HTTP transfer framing, socket readiness and staging unsent output remain the host’s responsibility.

Structs

PackOutput

Complete-pack sink passed to host pack writers. It forwards raw pack bytes or frames channel 1 according to the client’s negotiated sideband mode. Uses a fixed 1 KiB buffer; packet sizes stay within both protocol limits. The server flushes the final packet and terminator after the writer succeeds.

Request

Response

RevisionBuffers

Fixed-capacity backing for explicitly enabled revision selection. The added boundary state is exactly OBJECTS bytes; no request-sized allocation is hidden.

RevisionStorage

Explicit opt-in for time/exclusion history. One additional state byte per repository object, with limits shared by ref resolution and graph selection. Existing selection entrypoints retain their old capabilities and behavior.

SelectionBuffers

Fixed-capacity backing storage for one independent selected-fetch session. All capacities are explicit const parameters; construction allocates nothing. Keep separate values for overlapping responses. Only the borrowed descriptor reaches the protocol encoder, so applications may also keep their own arrays and construct SelectionStorage directly.

SelectionStorage

Independent per-request storage for bounded reachable-object selection. wants bounds distinct wanted IDs. objects and indices each need the repository’s complete object count; their extra slots remain untouched. Read/parse scratch budgets match ValidatedRepository::select_objects.

WantOptions

Additional request policy, separate from existing selection storage literals. Occurrences include duplicates. Existing wrappers preserve their strict rule without adding a new occurrence limit. Hosts must still bound request bytes.

Enums

WantPolicy

The host must authenticate and supply one immutable, authorized repository projection. Validation proves its exact reachable union; it does not grant ACLs.

Constants

HEAD

Default HEAD body. The server writes Repository::head_state dynamically.

Functions

serve

Always send Cache-Control: no-store for discovery and upload-pack responses. A failed call invalidates all output; hosts must discard it before replying. Reserves 1 KiB of read scratch on the stack for streaming-only providers.

serve_with_pack

Serve with a host-provided complete-pack writer. It is called once only for a valid upload-pack request ending in done, after writing ACK/NAK packets. The writer must emit a complete checksummed pack containing exactly this repository’s objects, and respect the repository’s stability contract. All refs must alias HEAD; independent roots return Unsupported before output or invoking the writer. Use serve_with_selection for those roots. The supplied sink handles negotiated sideband framing. Complete-pack hooks may resend common history; use selection to omit it. Other routes and no-done requests use the ordinary behavior. On error discard the entire response.

serve_with_revisions

Serve time/exclusion deepening with explicit caller storage and exclusion limits. This also supports all existing selected fetch modes. Only this opt-in path advertises v0/v1 deepen-since/deepen-not. Successful output is invalidated by any later error; a streaming host must abort on provider/transport failure.

serve_with_scratch

Serve generated/file-backed objects with an explicit read-buffer budget. Discovery/ref responses and borrowed bodies need no scratch; nonempty streamed bodies need at least one byte. Errors invalidate all output.

serve_with_selected_pack

Serve selected requests using a trusted host’s raw-pack writer. Routing, authorization and bounded selection are identical to serve_with_selection. The writer runs once only when a pack is needed, including an empty selected set, and must emit exactly indices from this same stable repository. ACK-only rounds and shallow probes never invoke it. Its sink applies the current request’s sideband framing; cache only the raw PACK bytes.

serve_with_selected_pack_policy

Apply an explicit host want policy before the selected-pack writer or cache. Every request, including hits and ACK-only rounds, is checked independently. Keep the authorized repository projection immutable for the entire call. Output and writer-failure contracts match serve_with_selected_pack.

serve_with_selection

Serve independent refs, tags and multiple wanted IDs with caller-owned selection storage. Accept only advertised ref/peeled/HEAD IDs, rejecting arbitrary or merely reachable wants. Select the exact union before writing ACKs or pack. Present commit haves exclude their complete reachable history; unknown and non-commit haves are ignored. Requests are stateless: clients replay wants and acknowledged haves each round. No-done rounds only negotiate. Absolute/relative-depth shallow requests and blob filters use the same graph budget. Shallow haves never imply complete history. Errors invalidate all output; selection failures produce no output at all.

serve_with_selection_policy

Serve selected wants under an explicit host grant and occurrence cap. The validated repository must be the host-authorized immutable projection. All wants are checked before ACKs, pack output or host cache integration.

write_upload_error

Write a terminal v0 ERR packet as a replacement for a failed buffered upload response. Discard the failed response first. No backend details are exposed. Hosts own the HTTP status; never append this to a partial raw pack.