Development record
The Go identity reader (internal/core/identity/identity.go gitConfig) runs git config under gitutil.ScrubbedEnv, which drops GIT_CONFIG_PARAMETERS and the GIT_CONFIG_COUNT/KEY_n/VALUE_n form. git commit honours both, so under git -c committer.name=X (or author.name=X when abcd is not run from a hook) abcd ahoy --identity reports the configured identity as ok while git stamps X. This is the hook use commands/ahoy.md documents. The reader must see the configuration git commits with. The scrub's stated reason, stopping an injected GIT_CONFIG_* from forging the identity, does not hold for this reader: it already honours GIT_AUTHOR_*/GIT_COMMITTER_* from the same environment.
The Go identity reader (internal/core/identity/identity.go gitConfig) runs git config under gitutil.ScrubbedEnv, which drops GIT_CONFIG_PARAMETERS and the GIT_CONFIG_COUNT/KEY_n/VALUE_n form. git commit honours both, so under git -c committer.name=X (or author.name=X when abcd is not run from a hook) abcd ahoy --identity reports the configured identity as ok while git stamps X. This is the hook use commands/ahoy.md documents. The reader must see the configuration git commits with. The scrub's stated reason, stopping an injected GIT_CONFIG_* from forging the identity, does not hold for this reader: it already honours GIT_AUTHOR_/GIT_COMMITTER_ from the same environment.
Grounds
- pursued: under git -c committer.name=X commit, a hook running abcd ahoy --identity refuses in a pinned repo, and the reader agrees with git var for every command-line form while GIT_DIR and GIT_CONFIG still change nothing. TestIdentityReadsTheCommandLineConfigGitCommitsWith, TestCheckHoldsTheCommitterGitCommitsWith and TestIdentityReadIgnoresWhatGitCommitDoesNot would show it wrong.
Frontmatter
| id | iss-2609261614306830 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2609261614306830-the-go-identity-reader-internal-core.md
open on GitHub ↗ · commit history ↗
mentions1
- iss-2609261614450166The redaction probe scanner.ProbeIdentity (internal/adapter/scanner/identity.go) builds the set of identities to redact from user.name/user.email plus GIT_AUTHOR_*/GIT_COMMITTER_* only. It never reads author.name/author.email or committer.name/committer.email, which git ranks above user.* for the identity it stamps, and it reads under gitutil.ScrubbedEnv, so a git -c user.name persona (GIT_CONFIG_PARAMETERS or the GIT_CONFIG_COUNT form) is never seen either. An identity that authors or commits the caller's work through any of those sources is missing from the matcher set and would be stored in clear. The fix folds them in as additional names to redact, the way the GIT_AUTHOR_* values are, so nothing displaces the configured identity. It is the same blind spot the identity gate had (iss-2609261454332615, iss-2609261614306830), on the redaction side.