Features & organization

Gitrust brings together the building blocks of a modern Git around six pillars: memory security, regulatory compliance, self-hosting, collaboration, observability and integration. Each function is designed to remain simple, auditable and without external dependencies.

mindmap
  root((Gitrust))
    Securite memoire
      Rust memory safe
      Zeroize des secrets
      SSH RSA 4096 bits
    Conformite ANSSI
      PA-074
      Audit fournisseurs
      SBOM CycloneDX
    Self-hosting
      Zero cloud
      Zero telemetrie
      Bare-metal ou VPS
    Integration
      HTTP natif
      SSH natif
      Clients Git standards
    Collaboration
      Multi-team
      Roles hierarchiques
      Permissions fines
    Observabilite
      SBOM exportable
      Dependency-Track
      Audit CVE

Glossary of features

Memory security

Rust memory-safe
100% Rust base with #![forbid(unsafe_code)] on critical crates. No undefined behavior, no exploitable memory leaks.
Strict Lints
deny(unwrap_used, expect_used, panic, indexing_slicing) applied to the entire code. Errors are managed, never avoided.
Zeroize
The secrets (tokens, hashes) implement the trait Zeroize : the memory is automatically erased upon destruction.
Hardened SSH
RSA keys >= 4096 bits imposed, weak algorithms rejected, SHA256 fingerprints verified at each connection.

ANSSI PA-074 compliance

Supplier audit
Each dependency is traced, versioned and auditable via the Cargo manifest and the integrated SBOM CycloneDX.
Traversal path blocked
Systematic validation of disk paths (owner + slug): rejection of .., / And \.
Logging
Audit traces on sensitive operations: creation, sharing, deletion of deposit, key rotation, change of permission.

Self-hosting

Sovereign deployment
A Rust archive, a PostgreSQL, a disk volume. No third-party services, no external network calls.
Zero CDN
All assets (CSS, JS, fonts) are served locally. Strict CSP blocking external domains.
Zero telemetry
No data is reported anywhere other than your own logs. The metrics stay with you.

Collaboration

Hierarchical roles
Four clear roles: Reader, Developer, Maintainer, Owner. Effective permissions = max(individual, team).
Shared deposits
Individual or team sharing, with or without inheritance. Rights combine, never circumvent each other.
Organizations
Multi-team structure with namespace and SSH key isolation.

Integration

Native HTTP Git
Full Smart HTTP (clone, fetch, push) without proxy layer. Compatible with all standard Git clients.
Native Git SSH
Integrated SSH server (port 2222 by default), public key authentication, fine hook management.
Extendable hooks
Expansion Points pre-receive, post-receive, update to connect your CI pipelines, your scanners, your notifications.
Dagger CI optional
Native triggering of Dagger CI pipelines on each push via the hook post-receive. Reproducible, portable and versioned builds on the repository.
Cohesive API
REST endpoints for automation (repository creation, key management, user invitation).

Observability and quality

SBOM CycloneDX
Automatic generation of the software nomenclature in CycloneDX 1.5 format, exportable to Dependency-Track.
Vulnerability analysis
Continuous integration with Dependency-Track: detection and monitoring of CVEs on all dependencies.
Structured logs
JSON logs usable by any aggregator (ELK, Loki, Graylog) without adapting a parser.

Developer workflow

flowchart LR
    Dev["Developpeur
git, SSH, HTTPS"]
    Gitrust["Gitrust
axum, HTMX, Rust"]
    PG[("PostgreSQL
metadata, permissions")]
    Repos[("Bare repos
disque local")]
    Dagger["Dagger CI
pipelines, post-receive"]
    DTrack["Dependency-Track
SBOM, CVE"]

    Dev -->|"git push"| Gitrust
    Gitrust -->|"core data"| PG
    Gitrust -->|"core data"| Repos
    Gitrust -.->|"hooks CI"| Dagger
    Gitrust -.->|"hooks CI"| DTrack

Ready to take back control of your code?

Gitrust is in gradual deployment. To access a demo, ask your questions or receive support on ANSSI-compliant integration, contact the team.

Be contacted