worklyn / zukapublic
Agent-first git hosting. One Rust binary: git over HTTP and SSH, a REST API, MCP, CI, and multi-tenant isolation.
Get a copy:
git clone https://zuka.worklyn.com/worklyn/zuka.git
ZChallenge instead of 404 when an anonymous git read is refusedzuka · 3 hr ago1f641cf1
The live suite caught it: making everything default to private turned an
unauthenticated clone of a private repository into 'not found'. git only runs
its credential helper on a 401 challenge, so a user whose credentials were
configured would never be asked and would see a bare failure.
It answers 401 whether the repository is private or absent, so existence is
still not disclosed. The browser surface keeps 404 — a challenge there would
raise a login dialog nobody can satisfy.
Adds eight live tests over the new surface: anonymous clone of a public
repository, anonymous write refused at both the advertisement and the pack
endpoint, private hidden from the browser, an owner's credential still
working, a rejected credential not degrading to anonymous, visibility
reversible, and a hostile README failing to smuggle script into the page.