Post #3914345

2026-07-18 15:58 UTC

So git-remote-iroh works, but it's basically a toy demoware. I mean, you can push and pull over iroh, which is cool, but it's not this hub-breaking new thing that changes development workflows and defeats corporate hegemony over open-source software. The server mode is still a centralized hub. I've been thinking this week about where to take it next, if I should at all. Where my head is at: All repository clones could be remote peers that you can pull from. It should be easy to do this from a background process that spawns and stays running in the background. Could be on-demand, like how podman and gpg-agent do. Because it's pull-only, it should be safe to serve this up from a clone with a working tree. Hubs allow pushes, but don't attempt to force a single history. They are a synchronization point for blobs, tracking who has what blobs. All remote refs. What this does, is remove the need for everyone being online all the time. Who decides what is the true timeline then? Up to a peer that decides to act as a publisher, and who follows it. What's nice about this, is you can have a primary and following replicas. You could even have multiple such primaries, possibly with different policies. #git #iroh #p2p #nohubsjustspokes 1/

Replies (2)

@cmars@infosec.exchange 2026-07-18 16:03

What keeps this from degrading into total chaos, is some notion of identity. If I start a project, I'm signing my commits with an SSH key and publishing them with an iroh key. These public key identities can be bound with an attestation; I sign my iroh key, which determines my network endpoint, with a well-known SSH key that is at least pinned to the content I'm producing. What's neat about these attestations in a public-key based networking system like #iroh, is peers can attest to each other. I could sign an attestation that I know another developer -- or sign a revocation if that developer becomes compromised, or leaves the project. Attestations linked to public key infrastructure we already use like published GPG and SSH keys, bootstraps some trust into the system. This is as much a social experiment as a technical exploration. I'm using git because it's a system I kind of know, but I'm also thinking about how other collaborative apps might work at the back of my mind. 2/

Open ##3914344
@FenTiger@mastodon.social 2026-07-18 16:02

@cmars@infosec.exchange This sounds a bit like Radicle: https://radicle.dev/

Open ##3914687