d3bc868e84
Split up signed references into its read and write components. On the write side: - Preserve the old behavior of writing references to the blob `/refs` and sign over the blob. - Ensure `refs/rad/root` is contained in the `/refs` blob. - Ensure `refs/rad/sigrefs` is *not* contained in the `/refs` blob. - Introduce a new (internal) reference `refs/rad/sigrefs-parent` so that no two `/refs` blob are equal, even if they contain the same set of (non-internal) refs. On the read side: - Preserve the verification of the signature in `/signature` and the reference `refs/rad/root` (if present). - Fail verification of `refs/rad/root` is not present. - Protect against replay attacks by walking the history of the head of `refs/rad/sigrefs`, skipping interpretation of `/refs` blobs in case they are identical to a previous `/refs` blob. This is achieved by searching for repeated contents of the `/signature` blob. The reference `refs/rad/sigrefs-parent` is never read from or written to the Git repository in storage. The pre-existing implementation of signed references did not include a nonce, thus duplicate but legitimate sets of references could not be distinguished from maliciously replayed sets of references. The new implementation uses `radicle-git-metadata` which is moved from `dev-dependencies` to `dependencies`. |
||
|---|---|---|
| .cargo | ||
| .config | ||
| .github | ||
| .radicle | ||
| build | ||
| crates | ||
| debian | ||
| scripts | ||
| systemd | ||
| windows | ||
| .codespellrc | ||
| .dockerignore | ||
| .env.seed | ||
| .envrc | ||
| .git-blame-ignore-revs | ||
| .gitignore | ||
| .gitsigners | ||
| .rustfmt.toml | ||
| .typos.toml | ||
| ARCHITECTURE.md | ||
| CHANGELOG.md | ||
| CONTRIBUTING.md | ||
| Cargo.lock | ||
| Cargo.toml | ||
| DCO | ||
| HACKING.md | ||
| LICENSE-APACHE | ||
| LICENSE-MIT | ||
| README.md | ||
| RELEASE.md | ||
| VERSIONING.md | ||
| build.rs | ||
| deny.toml | ||
| flake.lock | ||
| flake.nix | ||
| git-remote-rad.1.adoc | ||
| rad-id.1.adoc | ||
| rad-patch.1.adoc | ||
| rad.1.adoc | ||
| radicle-node.1.adoc | ||
| rust-toolchain.toml | ||
README.md
❤️🪵
Radicle Heartwood Protocol & Stack
Heartwood is the third iteration of the Radicle Protocol, a powerful
peer-to-peer code collaboration and publishing stack. The repository contains a
full implementation of Heartwood, complete with a user-friendly command-line
interface (rad) and network daemon (radicle-node).
Radicle was designed to be a secure, decentralized and powerful alternative to code forges such as GitHub and GitLab that preserves user sovereignty and freedom.
See the Radicle home page for general information, and the Zulip chat to talk to the project.
See the Protocol Guide for an in-depth description of how Radicle works.
Installation
Requirements
- Linux or Unix based operating system.
- Git 2.34 or later
- OpenSSH 9.1 or later with
ssh-agent
📀 From binaries
Requires
curlandtar.
Run the following command to install the latest binary release:
curl -sSf https://radicle.xyz/install | sh
Or visit our download page.
📦 From source
Requires the Rust toolchain.
You can install the Radicle stack from source, by running the following commands from inside this repository:
cargo install --path crates/radicle-cli --force --locked --root ~/.radicle
cargo install --path crates/radicle-node --force --locked --root ~/.radicle
cargo install --path crates/radicle-remote-helper --force --locked --root ~/.radicle
Or directly from our seed node:
cargo install --force --locked --root ~/.radicle \
--git https://seed.radicle.xyz/z3gqcJUoA1n9HaHKufZs5FCSGazv5.git \
crates/radicle-cli crates/radicle-node crates/radicle-remote-helper
Running
Systemd unit files are provided for the node under the /systemd folder.
They can be used as a starting point for further customization.
For running in debug mode, see HACKING.md.
Feedback
If you have feedback, feel free to create issues using rad issue, join
our Zulip, or email feedback@radicle.xyz.
Emails sent to this address are automatically posted to
our public #feedback channel on Zulip, revealing the
From header (which usually contains your name and email
address). This allows us to discuss your feedback on Zulip, and, if necessary,
respond to you via email.
Contributing
See CONTRIBUTING.md and HACKING.md for an introduction to contributing to Radicle.
License
Radicle is distributed under the terms of both the MIT license and the Apache License (Version 2.0).
See LICENSE-APACHE and LICENSE-MIT for details.