lfs

Documentation

Overview

Package lfs implements Git LFS server storage and authorization.

The protocol surface lives in httpd (batch API + basic transfers) and sshd (git-lfs-authenticate); this package owns the pieces both need: content-addressed blob storage behind a small interface, and the short-lived tokens that bridge SSH authentication to the HTTP endpoints.

BlobStore is deliberately minimal so an S3-compatible backend is a drop-in: implement the four methods against a bucket and the batch and transfer handlers work unchanged (the server streams as a proxy). Handing clients presigned URLs instead is a later optimization to the batch handler, not a rewrite.

Index

• Constants
• Variables
• func NewSecret() string
• func Sign(secret []byte, repoID int64, op string, now time.Time) string
• func Verify(secret []byte, token string, now time.Time) (repoID int64, op string, ok bool)
• type BlobStore
• type LocalStore
  • func (s LocalStore) Delete(oid string) error
  • func (s LocalStore) Exists(oid string) (int64, bool)
  • func (s LocalStore) Get(oid string) (io.ReadCloser, int64, error)
  • func (s LocalStore) Put(oid string, r io.Reader, size int64) error

Constants

const TokenTTL = time.Hour

Variables

var OIDPat = regexp.MustCompile(`^[a-f0-9]{64}$`)

OIDPat is a lowercase sha256 hex digest — the only object name LFS uses.

Functions

func NewSecret

func NewSecret() string

NewSecret returns 32 random bytes, hex-encoded for the settings table.

func Sign

func Sign(secret []byte, repoID int64, op string, now time.Time) string

Sign mints a token for op ("download" or "upload") on repoID.

func Verify

func Verify(secret []byte, token string, now time.Time) (repoID int64, op string, ok bool)

Verify checks a token and returns the repo and operation it authorizes.

Types

type BlobStore

type BlobStore interface {
	// Put stores the reader's content as oid, verifying both size and
	// digest; a mismatch stores nothing.
	Put(oid string, r io.Reader, size int64) error
	Get(oid string) (io.ReadCloser, int64, error)
	Exists(oid string) (int64, bool)
	Delete(oid string) error
}

BlobStore holds LFS objects by their sha256 content address.

type LocalStore

type LocalStore struct {
	Root string
}

LocalStore is the on-disk backend: <root>/<aa>/<bb>/<oid>, written via a temp file and renamed only after the digest checks out.

func (LocalStore) Delete

func (s LocalStore) Delete(oid string) error

func (LocalStore) Exists

func (s LocalStore) Exists(oid string) (int64, bool)

func (LocalStore) Get

func (s LocalStore) Get(oid string) (io.ReadCloser, int64, error)

func (LocalStore) Put

func (s LocalStore) Put(oid string, r io.Reader, size int64) error