Data and privacy
This page describes what the code running at amber-git.stackwell.tech does
with data today. Where something is missing, it says “Not yet”.
What amber-git stores
| Data | Contents |
|---|---|
| Git objects | Every object of every push: commits (with their author and committer names and emails), trees, files and tags. Stored as git packs. |
| Refs | Each branch and tag, and the commit it points to. |
| Repository settings | The owner’s ChirpAuth id, the ids of the people and clients granted access, and where the repository mirrors. |
| Queued updates | For each force-push or delete waiting on approval: the ref, old and new commits, who pushed it, its handle and its Granite request. |
Logs. Each accepted ref update is logged with the repository, ref, old and new commits and who pushed it. Logs are kept for 30 days.
amber-git runs on AWS in the us-east-1 region (United States).
Where data goes
- Granite. A queued force-push or delete is filed with Granite for the repository’s owner. The request names the repository, the ref, the commits and who pushed it: a person’s ChirpAuth id, or an agent’s ChirpAuth id and client id. See Granite for what it keeps.
- GitHub. For a repository set up to mirror, every branch and tag and the objects they reach are pushed to a GitHub repository. A mirror amber-git creates is private.
- Stackwell’s CI. Each accepted branch or tag update other than a delete (repository, ref, old and new commit) is sent to Stackwell’s CI service. For a repository registered with it, CI then reads the repository to run its checks.
Who sees what
- People and clients granted on a repository can fetch every branch and tag in it and every commit they reach.
- The repository’s owner sees, in Granite, each queued force-push or delete and who asked for it.
- Anyone with access to a repository’s GitHub mirror sees what it holds.
- Stackwell, which runs the service, can read all of it.
Objects that no branch or tag reaches, such as those of a refused push, can’t be fetched or read through amber-git.
How long, and what deleting does
amber-git deletes nothing on a schedule, and it never deletes a pushed object.
- Deleting a branch or tag (with the owner’s approval) removes the ref. The commits and files it pointed to stay stored.
- A refused push still stores the objects it carried.
- Retiring a repository stops it serving, accepting pushes and mirroring. It erases nothing.
- A force-push moves the branch; the commits it replaced stay stored.
Not yet:
- Removing contents. There is no way to remove a pushed object or a repository’s contents. If you push a secret, treat it as exposed and rotate it; deleting or rewriting the branch does not remove it from storage.
- The GitHub mirror is not cleaned up. When a repository stops mirroring, is renamed or is retired, its GitHub copy is left as it was.