Module git_oracle 

Stock git as the arbiter, inside a repository. Test support only — nothing on a serving, storing or indexing path may call it, because it forks git. It is pub because tests/concurrent_push.rs compiles against the library, and it exists because git index-pack --strict segfaults outside a repository, which is how an oracle came to be incapable of failing. Stock git as the arbiter for a pack this crate emitted — inside a repository, and never as a segfault mistaken for a verdict.

🔴 Why this module exists at all

git index-pack --strict crashes with SIGSEGV when it is run outside a git repository and its strictness has anything to say. Measured on oden with git 2.53.0, 2026-08-11:

pack holding one tree whose blob is absent
  in a bare repo   → exit 128  fatal: did not receive expected object ce013625…
  outside a repo   → exit 139  (SIGSEGV, and NOT ONE BYTE of output)

It is not specific to --check-self-contained-and-connected; plain --strict does it too, because both reach the same fsck_walk and it needs a repository under it. The pack has to be rejectable for the crash to happen — a good pack indexes fine outside a repo — so the failure appears only when the oracle was about to be useful.

That is not a hypothetical. It is why the bug 8c2679d fixed shipped: the subset test in crate::store ran the oracle in a plain temporary directory, hit the crash, and was narrowed to three objects until it stopped crashing — the comment on that line read // see the ignore note: larger subsets segfault git. With three objects there was no tree naming an absent child, the oracle had nothing to say, and a narrowed clone shipped broken for four sessions. A test whose oracle segfaults is a test that cannot fail, and the reflex that shrinks the input until the crash goes away removes the coverage rather than the crash.

So every call goes through here, and here does two things nothing did before: it runs git inside a freshly initialised bare repository, and it treats a death by signal as an oracle failure in its own right rather than as a non-zero exit code with an empty message.

Not a production path

Nothing in this crate’s serving, storing or indexing paths calls any of this, and nothing may: it forks git. It is pub only because tests/concurrent_push.rs is an integration test and compiles against the library rather than into it, and one shared oracle beats four copies of the same twenty lines (LAW 5). The caller supplies the scratch directory, so this needs no tempfile and stays out of the dependency graph.

Enums

Strictness

How hard git should look at the pack.

Functions

assert_git_accepts

The same, as an assertion, because that is what a test wants.

empty_bare_repo

A freshly initialised bare repository under scratch, named name.

git_accepts

Hand pack to stock git, inside a repository, and return its verdict.

git_reads_back

What stock git reads back out of a pack this crate emitted: every object in it, by oid, as (kind, bytes).