The build day we were tired of losing

Every Git library in every language eventually asks you to install the same four things: OpenSSL, libssh2, libcurl, and perl to build them. Not because your program needs them, but because libgit2's transports do.

What was removed

libgit2 is still there — it is a good implementation of objects, refs and the index, and rewriting that would be vanity. What is gone is its networking: it is vendored and built with GIT_HTTPS=0 GIT_SSH=0, so the parts that pull in the C dependency chain are simply not compiled.

HTTPS is reqwest over rustls. SSH is russh over aws-lc-rs. Both are Rust, both come in through cargo, and neither needs a system package.

What that buys

Building torii from source needs a C compiler and nothing else. No openssl-dev, no libssh2-dev, no pkg-config, no perl. On the musl target with the static feature the result links no runtime library at all, which is what lets it run on Alpine, on scratch, and on a busybox image where nothing else is installed.

The prebuilt binaries inherit the same property: zero runtime dependencies is not a marketing number on the front page, it is the consequence of this decision.

What it cost

Two transport implementations that the world has not been hammering on for fifteen years, and it would be dishonest to pretend that is free.

The SSH authentication chain is agent, then ed25519, then RSA, with host keys verified against known_hosts and a trust-on-first-use prompt for an unknown one. Two gaps remain and are worth stating plainly: an encrypted private key needs an agent, because there is no passphrase prompt yet, and ~/.ssh/config aliases are not parsed, so the real hostname is the one that works.

Push validation against Bitbucket, Gitea, Forgejo and Sourcehut is still reasoned rather than tested end-to-end. They speak the same Smart HTTP and SSH protocols, so it should work; "should" is doing real work in that sentence, and integration tests against a local git server are on the list.

The one it did not solve

There is a failure this change made more likely, not less. The crypto chain russh pulls in has a deep generic tree, and monomorphising it can overflow rustc's default 8 MB thread stack:

error: rustc interrupted by SIGSEGV, printing backtrace
... LlvmCodegenBackend ... compile_codegen_unit ...

That is not a bug in the crate, and it is not something the crate can fix. The workaround is to give rustc more stack and less parallelism:

RUST_MIN_STACK=67108864 cargo install gitorii --locked -j 1

The project's own CI hit it too, on a self-hosted Arch runner, and spent an afternoon on it before settling at a 32 MB stack. When a build environment fights you this specifically, write down the number that ended it — the comment at the top of .gitlab-ci.yml is that note.