Adversary assumption: An attacker with the ability to rewrite Git history and update refs (compromised maintainer/CI key, malicious insider, or untrusted Git host).
main) and tags (v2.1.0) can be repointed at any time without leaving a trace.Like Certificate Transparency: Attacks (such as pushing a bad commit) are still possible — but they cannot be hidden afterwards.
Early git-ratchet required a bespoke Git-aware witness. Now, each repository keeps a single C2SP transparency log (refs/ratchet/log) inside the repo—operated via three CLI subcommands:
git-ratchet logAppends a ref-record/v1 entry (<ref> <hash>) to the in-repo log at refs/ratchet/log.
git-ratchet checkpointSigns the log head as a tlog-checkpoint and collects cosignatures from C2SP witnesses.
git-ratchet verifyVerifies the checkpoint against a tlog-policy and walks the logged ref history locally.
Log Entry (written by git-ratchet log under tile/entries/...):
Checkpoint (sent by git-ratchet checkpoint to tlog-witness — zero Git fields):
git-ratchet verifyStandard witnesses enforce append-only history; the client verifier enforces Git graph rules over that history:
Witnesses stay 100% Git-agnostic: they verify RFC 6962 consistency proofs so no logged ref entry can ever be erased or forked, and attach timestamped cosignatures.
git-ratchet verify: Git Fast-Forward & Tag RulesWalks every entry for the ref in the witnessed log [0, size) and checks the local commit graph to verify that branches only fast-forward and tags never move.
Once a commit is in the witnessed log, removing that commit from Git (via force-push or tag move) breaks git-ratchet verify's ancestry walk against the logged entry.
Because an attacker can also append arbitrary entries to the log itself (and witnesses will cosign them), git-ratchet verify walks the entire log history for the requested ref—not just the latest entry.
Logging typed entries to a t-log enables future recorded history rewrites (e.g. court-ordered removals) without changing witnesses. Not built yet—requires careful thought on the exact policy model.
log / witness / group / quorum policy grammar.tile/entries/<path> bundles + RFC 6962 hashing.refs/ratchet/log instead of an HTTP tile server; omits tile/<level>/... hash tiles since every clone holds all entries locally.ref-record/v1): Canonical 2-line entry payload inside the opaque tlog-tiles entry bundles (unrecognised entry types are ignored).git-ratchet verify): Walks the witnessed log prefix and checks Git commit DAG ancestry & tag immutability.github-issue:// Transport: Custom http.RoundTripper carrying standard message/http add-checkpoint requests/replies via GitHub Issues + Actions.