Module hardened 

Hardened git subprocess constructors.

Pod repositories live in user-writable data trees, so a repository’s own .git/config and .git/hooks are attacker-influenced. Every production git spawn in the workspace goes through hardened_git (std) or hardened_git_async (tokio) so that:

• repo-local hooks never run (core.hooksPath=/dev/null),
• core.fsmonitor cannot name a program (core.fsmonitor=false),
• core.sshCommand and commit.gpgSign cannot spawn helpers,
• system and global config are ignored (GIT_CONFIG_NOSYSTEM=1, GIT_CONFIG_GLOBAL=/dev/null),
• git never blocks on a credential prompt (GIT_TERMINAL_PROMPT=0).

Example

let mut cmd = solid_pod_rs_git::hardened_git();
cmd.arg("--version");

Constants

HARDENED_CONFIG

-c key=value overrides applied before any caller arguments.

HARDENED_ENV

Environment variables applied to every hardened invocation.

Functions

hardened_cgi_env

Environment entries that harden an externally-spawned git program (the git-http-backend CGI) whose environment is built by hand. Uses git’s GIT_CONFIG_COUNT mechanism because the CGI cannot take -c flags.

hardened_git

Build a git std::process::Command with hooks, fsmonitor, ssh/gpg helpers and ambient config disabled. Append the subcommand and arguments as usual.

hardened_git_async

Tokio flavour of hardened_git.