xGit: Protected Code Distribution

The Problem

Code distributed via git and npm is readable. Every npm install delivers plaintext source. Every git clone copies your IP. Obfuscation is reversible. License keys are shareable. Your algorithm becomes someone else's the moment you publish.

SDK vendors, open-core companies, and AI model distributors face the same dilemma: distribute code to customers (and accept piracy, reverse engineering, and license violations) or keep it server-side only (and accept latency, connectivity requirements, and architectural constraints).

Current approaches fail at the distribution layer:

The Distribution Gap

The Solution

xGit integrates XorIDA splitting into the code distribution workflow. A pre-push hook or CI action splits your code into shares before it leaves your machine. What gets pushed to the registry is cryptographic noise. Share 2 auto-uploads to your heartbeat server.

Customers npm install your package and get Share 1 — noise that reveals zero information about your code. Not obfuscated code. Not minified code. Actual cryptographic noise. Information-theoretically. At runtime, xGhost handles per-call reconstruction.

The developer workflow is transparent: git push and npm publish work exactly as before. xGit hooks into the pipeline and splits automatically. No changes to your build process. No changes to your customer's install process.

The xGit Way

How It Works

xGit adds a protection layer between your source code and the distribution channel. Four steps: init, protect, push, install. Each step is automated — no manual cryptography.

Developer Workflow

xGit provides a CLI and CI/CD integrations that make protecting your code as simple as pushing to git. Four commands cover the entire lifecycle.

CLI Commands

# Initialize xGit in your repository
xgit init --server https://heartbeat.yourcompany.com
  → Installs pre-push hook
  → Creates .xgit/config.json
  → Configures heartbeat server endpoint

# Mark files and exports for protection
xgit protect --source src/algorithm.ts --exports "score,classify,predict"
  → Adds protection manifest entry
  → Configures XorIDA threshold (default 2-of-2)

# Check protection status
xgit status
  → Protected files: 3
  → Exports: score, classify, predict
  → Heartbeat: https://heartbeat.yourcompany.com (connected)
  → Last split: 2026-04-03T10:30:00Z

# Revoke access for a customer DID
xgit revoke --did "did:key:z6Mk..."
  → Removes DID from heartbeat server license list
  → Customer's next heartbeat fails → code stops within 30s

GitHub Actions Integration

name: xGit Protected Publish
on:
  push:
    tags: ['v*']

jobs:
  publish:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm ci && npm run build
      # xGit splits before publish
      - run: npx xgit protect --ci
        env:
          XGIT_SERVER: ${{ secrets.HEARTBEAT_URL }}
          XGIT_API_KEY: ${{ secrets.HEARTBEAT_KEY }}
      # Publish noise to npm
      - run: npm publish
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

GitLab CI Integration

xgit-publish:
  stage: deploy
  script:
    - npm ci && npm run build
    - npx xgit protect --ci
    - npm publish
  only:
    - tags

Self-Protection: We Eat Our Own Dogfood

PRIVATE.ME uses xGit + xGhost + xPass to distribute its own ACIs. Every npm install @private.me/* delivers noise. This is the double-lock distribution model.

Use Cases

Integration

// Initialize xGit in your project
$ xgit init --server https://heartbeat.yourcompany.com

// Mark exports for protection
$ xgit protect --source src/engine.ts \
    --exports "score,classify,predict,optimize"

// Push normally — hook handles the split
$ git add . && git commit -m "feat: new scoring model"
$ git push origin main
  → [xgit] Splitting 4 protected exports...
  → [xgit] Share 1 → dist/ (noise)
  → [xgit] Share 2 → heartbeat.yourcompany.com (uploaded)
  → [xgit] Manifest → dist/xgit-manifest.json
  → Push complete.

// Customer installs your package normally
$ npm install @yourcompany/scoring-engine

// Usage — identical to a normal import
import { score, classify } from '@yourcompany/scoring-engine';

// Under the hood: xGhost fetches Share 2, reconstructs, executes, purges
const result = await score(inputData);
// result is the output — the algorithm existed for ~50µs

Enhanced Identity with Xid

xGit can optionally integrate with Xid to enable unlinkable commit attribution — verifiable within each repository context, but uncorrelatable across projects or time.

Three Identity Modes

How Ephemeral DIDs Work

// Initialize xGit with Xid integration
$ xgit init --identity-mode ephemeral

// Commit as usual — xGit derives ephemeral DID automatically
$ git commit -m "feat: Add new feature"
  → [xGit] Deriving ephemeral DID from master seed...
  → [xGit] DID: did:key:z6MkA... (unique to this commit + repo + epoch)
  → [xGit] Signed commit with ephemeral key (~50µs)
  → [xGit] Key purged (<1ms exposure)

// Commit is signed with unlinkable DID
// Verification works within repo, but cross-repo correlation fails

What This Enables

• Cross-repo unlinkability — Can't track developers across projects
• Per-verifier derivation — Same developer has different DIDs per repo
• Epoch rotation — DIDs automatically rotate daily/weekly/monthly
• Split-protected derivation — Master seed is XorIDA-split, never reconstructed
• eIDAS 2.0 ARF compliance — Meets EU unlinkability requirements

Integration Tiers

Target Markets

• Software vendors (anti-piracy) — Ship protected npm packages to customer data centers. Unlinkable commit attribution prevents piracy tracking while maintaining developer accountability. Enterprise customers install cryptographic noise—runtime reconstructs via licensed keys. Revocation window: 30 seconds.
• Defense contractors — Classified repos with IAL3 commits, cross-context unlinkability for compartmentalized projects
• Financial services — SOX/SEC compliance with verifiable but unlinkable attribution for algorithmic trading code
• Healthcare/Pharma — HIPAA-compliant repos, unlinkable commits protect researcher identity across trials

Security Properties

Competitive Comparison

Contributor Access Model

External developers need to read, modify, and submit changes to protected code — without permanently exposing plaintext. xGit provides session-gated, per-file, watermarked access with automatic revocation.

Three Contributor Tiers

Session-Gated Share Delivery

Contributors never clone the full repository. Instead, they start a time-limited session that delivers Share 2 per-file on demand. Every file access is logged, quota-checked, and bound to the contributor’s DID.

DID-Based Watermarking

Every file reconstruction embeds a steganographic watermark derived from the contributor’s DID. The fingerprint is encoded as trailing whitespace patterns (invisible in editors) and is deterministic: same source + DID = same watermark. If leaked code surfaces, extractWatermark() identifies the contributor.

Server-Side Code Review

Reviewers never see full source. The server reconstructs both base and PR versions, computes a unified diff, then zero-fills both buffers. Reviewers see only the changed lines — never the surrounding context beyond a 3-line window.

Push & PR Workflow

When a contributor pushes, xGit automatically:

1. Strips the watermark from modified files.
2. Re-splits via ghostBuild() (2-of-2 XorIDA).
3. Stores the new vendor share (encrypted at rest, AES-256-GCM).
4. Returns the customer share (noise) for the git commit.
5. Signs the commit hash with the contributor’s Ed25519 identity.

Pull requests follow the same merge model: maintainers merge the noise branch in git, and xGit promotes the PR’s vendor shares to the main branch.

Access Control

Enforced via xPass: createConnectionId(orgDID, contributorDID, scope). Revocation takes effect within 30 seconds.

CLI Toolkit

The @private.me/xgit-cli package provides a complete command-line interface for managing protected repositories. Eight commands cover the full lifecycle: initialization, file protection, server operation, contributor management, audit queries, and key generation.

Commands

Quick Start

# Generate encryption keys
$ xgit keygen

# Initialize a protected repository
$ xgit init --repo my-project

# Protect source files (split into noise + vendor shares)
$ xgit protect "src/**/*.ts" --repo my-project

# Start the contributor access server
$ xgit serve --port 3200

# Add a contributor
$ xgit add-contributor --did did:key:z6Mk... --tier contributor --repo my-project

# Check status
$ xgit status --repo my-project

Deployment

Includes Dockerfile (multi-stage Alpine, non-root, read-only filesystem), docker-compose.yml, and a 10-section deployment guide covering architecture, configuration, backup, monitoring, and emergency procedures. Health check at /health. Structured JSON logging for SIEM integration.

Admin Control Panel

A web-based dashboard for managing protected repositories, contributors, sessions, and audit trails. Available at private.me/admin with SSO authentication. Six tabs provide full operational visibility.

Dashboard

Real-time server health, active sessions, protected file count, and contributor totals. Auto-refreshes every 30 seconds.

Contributors

View, add, and revoke contributor access. Three permission tiers — reviewer (read-only), contributor (read + write), and maintainer (full access). Each row shows the contributor's DID, repository, tier badge, status, and granted scopes.

Sessions & Files

The Sessions tab shows all active, expired, and revoked sessions with status indicators, time remaining, and files accessed. Filter by status or repository. Auto-refreshes every 15 seconds.

The Files tab lists every protected file path for a selected repository with a client-side search filter and total count.

Audit Trail

Every action — session start, file access, heartbeat, expiration — is logged with DID, repository, action type, authorization status, and timestamp. Paginated view with DID, action, and time range filters. Integrate with SIEM via structured JSON logging.

Benchmarks

Performance characteristics measured on Node.js 22, Apple M2. xGit protects source code with sub-100ms overhead for typical repository operations.

Source Code Protection Comparison

Honest Limitations

Six known limitations documented transparently. xGit’s security model trades some git workflow flexibility for source code protection.

Verifiable Code Distribution

Every xGit split and every xGhost reconstruction produces a verifiable audit trail via xProve. HMAC-chained integrity proofs confirm that code was split correctly at publish, reconstructed faithfully at runtime, and purged completely after execution.

Ready to push noise?

Talk to Sol, our AI platform engineer, or book a live demo with our team.