Do-the-work Git hosting 0.2

The next alpha version, 0.2, of my "do-the-work" Git repository viewer is now available; you can try it out on git.legoktm.com.

My previous post explained the rationale behind it; in short: this viewer is entirely client-side, which means it takes very minimal server resources to host. The clickbait version of this headline would call it scraper-proof.

You can obtain the newly rebranded "gib" 0.2 (aka git-in-browser) from git.legoktm.com. A signed build for WEBCAT (more on this later) can be downloaded from GitHub.

What's new#

I've written up a mostly complete changelog, the highlights are:

• Render markdown files and images
• Support downloading snapshots (tarballs)
• Support downloading patches of commits
• Display git notes
• Rewrite names and email addresses per .mailmap
• Support blame
• Potentially faster git log lookups
• Options to control how a diff looks

It's still nowhere near feature completion, but a lot closer to cgit. There was a lot of internal refactoring and in general just testing to verify behavior is as close to git as possible.

Performance#

There is a little bit of performance work in this release, such as support for commit-graph, but for a number of operations it's quite bad on what I'd consider to be a medium-sized repository. For a personal git host with mostly small projects, it's efficient enough!

I would like for 0.3 to spend a lot more time on performance.

xdiff#

Git uses a forked version of the xdiff algorithm for diffs, patches, blame, etc.; a standalone build is available as part of the libgit2 project.

Best I can tell, no one has actually done a 1:1 port to Rust. GitOxide uses a forked version of imara-diff (which AIUI is slightly different but pretty close), and there's a separate crate that statically links to xdiff.

Turns out it was relatively straightforward to compile the C code to WebAssembly, so I too punted on a Rust port. Never thought I'd be so happy to use C code instead of Rust.

WEBCAT#

WEBCAT is a project by Freedom of the Press Foundation (where I work!) to verify the integrity of in-browser, client-side applications to ensure they haven't been tampered with by the host. For example, CryptPad would sign their build, so you could be confident that the random hosting provider you're using hasn't tampered with it.

This is intended to be used by a future version of SecureDrop, so I wanted to get more familiar with it. In theory gib is fully compliant with what WEBCAT needs, but it's still a little buggy.

But if someone else did set up another gib instance, and properly registered the domain with WEBCAT, you could automatically verify they haven't tampered with it. There isn't that much practical advantage to doing so, since the hoster could merely tamper with the Git repositories themselves, but hey, it's cool!

Vibecoding#

gib is currently ~38k lines of code; probably 10% of it (and shrinking) was written by hand. I would've never been able to build something like this by myself in such a short amount of time.

I've largely used this as my "how far can I push LLMs" experimentation project; it's been interesting and just a little bit addicting. I think it certainly helps that I'm trying to reimplement well known functionality in a very different backend stack, rather than coming up with something novel.

I spot check the code and ocassionally tweak things by hand; I think the code quality is not terrible? The comments I missed rewriting/cleaning up are usually quite bad.

What's next#

Nothing, most likely. I worked on gib solely during vacation time, and now that school is starting up again, I would expect the project to go on hiatus.