Struct Config 

pub struct Config {

    pub user_identity: String,
    pub user_name: String,
    pub user_email: String,
    pub trusted_remote_endpoint: String,
    pub admission_helper: String,
    pub remote_admission_headers: BTreeMap<String, String>,
    pub signing_key: String,
    pub default_branch: String,
    pub remote_endpoint: String,
    pub remote_bucket: String,
    pub remote_type: String,
    pub ssh_strict_host_key_checking: String,
    pub ssh_user_known_hosts_file: String,
    pub ssh_identity_file: String,
    pub http_ssl_ca_info: String,
    pub transport_auth: String,
    pub grant_webauthn_rp: Vec<String>,
    pub signer: String,
    pub pull_require_signed: String,
    pub key: KeyConfig,
    pub attest: AttestConfig,
    pub remotes: BTreeMap<String, RemoteEntry>,
    pub branch_upstreams: BTreeMap<String, Upstream>,
    pub durability_objects: String,
    pub core: BTreeMap<String, String>,
}

Full in-memory representation of merged config (user + repo + defaults). All fields default to empty / documented defaults; readers that want a known-good default file should call read_or_default.

Fields

user_identity: String

Hex-encoded Identity: [kind:u8][len:u16 LE][bytes]. Empty = derive from the signing key’s public key at commit time.

user_name: String

Git-compatibility alias user.name. Non-authoritative: stored and round-tripped for parity with git config user.name, but it NEVER feeds the cryptographic commit author (which is user_identity / the signing key). Repo-safe. mkit config warns on stderr the first time this or user_email is set while user_identity is still empty (MKIT-12), since a user coming from git might otherwise expect it to control authorship.

user_email: String

Git-compatibility alias user.email. Non-authoritative, exactly like user_name — never feeds the signed author, and shares its first-set-without-user_identity warning.

trusted_remote_endpoint: String

Exact remote endpoint the user has explicitly trusted for ambient HTTP/S3 environment credentials. User-scoped only.

admission_helper: String

Absolute executable path for the user-scoped admission helper.

remote_admission_headers: BTreeMap<String, String>

Per-remote extra header allowlists, separate from endpoint listings.

signing_key: String

default_branch: String

remote_endpoint: String

remote_bucket: String

remote_type: String

ssh_strict_host_key_checking: String

ssh_user_known_hosts_file: String

ssh_identity_file: String

http_ssl_ca_info: String

Extra PEM certificate authorities for native HTTPS remote connections. MKIT_SSL_CA_FILE overrides this normally layered http.sslCAInfo key.

transport_auth: String

Write-auth scheme for mkit+https:// / mkit+http:// remotes (mkit-transport-connect::ConnectTransport). Empty/"bearer" (default) sends MKIT_API_TOKEN as a Bearer token, unchanged from #700/#701. "envelope" ADDITIONALLY signs every write RPC (UpdateRef/AdvanceRefs/UploadPack) with an Ed25519 write envelope, reusing the exact SAME signer resolution as commit signing — Self::signer / Self::signing_key / KeyConfig::ed25519_ref — see remote_dispatch::envelope_signer_from_config. User-scoped only: request authorization is a separate use of the ambient identity. Destination trust is checked before loading a signing key.

grant_webauthn_rp: Vec<String>

grant.webauthn_rp: the WebAuthn relying parties whose assertions mkit grant create --webauthn-assertion and the grant store accept (SPEC-WRITE-GRANTS §4.3). Each entry is <rp_id> <origin>...; the key may repeat and one value may hold several entries separated by |. User-scoped only (a repository must not choose which relying party vouches for an owner).

signer: String

Commit-signing selector. User-scoped only.

pull_require_signed: String

pull.require_signed — gates whether clone/pull/fetch verify every newly-fetched commit/remix/tag’s Ed25519 signature before publishing the remote-tracking ref (issue #692). Empty (the documented default) and any value except "false"/"0"/"no"/ "off" mean “verify, fail closed”; see Config::pull_require_signed_or_default. User-scoped only — a hostile repo config must not be able to silently disable the check that protects the clone against exactly that repo (see REPO_FORBIDDEN_KEYS).

key: KeyConfig

[key] section. User-scoped keystore selectors.

attest: AttestConfig

[attest] section. Separate struct so new attest knobs don’t balloon the flat Config.

remotes: BTreeMap<String, RemoteEntry>

Named remotes keyed by name (remote.<name>.url / remote.<name>.type). Repo-safe — addresses, same class as the flat remote_endpoint. The legacy flat remote_endpoint / remote_type act as the implicit default remote.

branch_upstreams: BTreeMap<String, Upstream>

Per-branch upstream tracking keyed by local branch name (branch.<branch>.remote / branch.<branch>.merge). Repo-safe.

durability_objects: String

Object-store durability schedule: empty/batch (default) = batched commit-time flushes; per-object = strict historical full-flush-per-object schedule (SPEC-OBJECTS §10.1’s stricter conforming option). Repo-safe: the non-default value only STRENGTHENS durability (and slows writes); it cannot weaken anything.

core: BTreeMap<String, String>

Allowlisted, inert core.* git-compat keys (see CORE_ALLOWED_KEYS). Accepted and round-tripped for parity but not honored by mkit — they are cosmetic settings git stores per-repo. Dangerous core.* keys (CORE_DENIED_KEYS) are rejected rather than stored. Keyed by the bare suffix (e.g. autocrlf).

Implementations

impl Config

pub fn with_defaults() -> Self

Return a Config with documented defaults filled in.

impl Config

Validate that a key-file path (signing_key, attest.*_key_path, ssh.*_file) cannot escape via .. traversal. Empty strings pass — callers fall back to the documented default.

pub fn ssl_ca_file_path( &self, layout: &RepoLayout, ) -> Result<Option<PathBuf>, ConfigError>

Resolve http.sslCAInfo for a native HTTPS connection. Relative paths start at the worktree root; ~ and ~/ use the process’s home directory. The stored config value remains unchanged for normal config roundtrips.

Errors

A tilde path without a home directory, or unsupported ~user syntax.

pub fn object_sync_policy(&self) -> SyncPolicy

Map durability.objects onto the object-store sync policy. Unknown values fall back to the batched default rather than erroring — config load must not brick the repo.

pub fn pull_require_signed_or_default(&self) -> bool

Effective pull.require_signed (issue #692): true unless the user-scoped config explicitly disabled it. Empty (unset, the documented default) and any unrecognized value are treated as “verify” — only an explicit falsy spelling opts out, so a typo in the config file fails closed rather than silently disabling the check.

pub fn transport_auth_envelope(&self) -> bool

true iff Self::transport_auth selects the Ed25519 write-envelope auth mode (case-insensitive "envelope"). Empty (the default) and any other value mean the unchanged bearer-token-only behavior.

Trait Implementations

impl Clone for Config

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Config

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Config

fn default() -> Self

Returns the “default value” for a type.

impl Eq for Config

impl PartialEq for Config

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Config