Development record
The redaction probe scanner.ProbeIdentity (internal/adapter/scanner/identity.go) builds the set of identities to redact from user.name/user.email plus GIT_AUTHOR_*/GIT_COMMITTER_* only. It never reads author.name/author.email or committer.name/committer.email, which git ranks above user.* for the identity it stamps, and it reads under gitutil.ScrubbedEnv, so a git -c user.name persona (GIT_CONFIG_PARAMETERS or the GIT_CONFIG_COUNT form) is never seen either. An identity that authors or commits the caller's work through any of those sources is missing from the matcher set and would be stored in clear. The fix folds them in as additional names to redact, the way the GIT_AUTHOR_* values are, so nothing displaces the configured identity. It is the same blind spot the identity gate had (iss-2609261454332615, iss-2609261614306830), on the redaction side.
The redaction probe scanner.ProbeIdentity (internal/adapter/scanner/identity.go) builds the set of identities to redact from user.name/user.email plus GIT_AUTHOR_/GIT_COMMITTER_ only. It never reads author.name/author.email or committer.name/committer.email, which git ranks above user.* for the identity it stamps, and it reads under gitutil.ScrubbedEnv, so a git -c user.name persona (GIT_CONFIG_PARAMETERS or the GIT_CONFIG_COUNT form) is never seen either. An identity that authors or commits the caller's work through any of those sources is missing from the matcher set and would be stored in clear. The fix folds them in as additional names to redact, the way the GIT_AUTHOR_* values are, so nothing displaces the configured identity. It is the same blind spot the identity gate had (iss-2609261454332615, iss-2609261614306830), on the redaction side.
Grounds
- pursued: an author./committer. key or a -c persona configured for the repository is redacted from scanned text while the configured identity stays effective; a probe that leaves such a value in clear, or lets an injected value displace GitUserName/GitUserEmail, would show it wrong
Frontmatter
| id | iss-2609261614450166 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2609261614450166-the-redaction-probe-scanner.md
open on GitHub ↗ · commit history ↗
mentions2
- iss-2609261454332615The identity gate reads the author as GIT_AUTHOR_* then user.name/user.email, but git gives the role-specific author.name/author.email config keys precedence over user.* (git 2.22+). A repo-local author.name = Test User therefore authors every commit as Test User while identity.EffectiveIdentity, ahoy's git_identity gaps, abcd ahoy --identity and the self-contained .githooks/pre-commit guard all report the pinned identity as matching. Reproduced with git 2.52: user.name Pin Human plus author.name Test User commits as Test User <pin@example.com>. The same precedence applies to the committer (GIT_COMMITTER_* then committer.name/committer.email then user.*).
- iss-2609261614306830The Go identity reader (internal/core/identity/identity.go gitConfig) runs git config under gitutil.ScrubbedEnv, which drops GIT_CONFIG_PARAMETERS and the GIT_CONFIG_COUNT/KEY_n/VALUE_n form. git commit honours both, so under git -c committer.name=X (or author.name=X when abcd is not run from a hook) abcd ahoy --identity reports the configured identity as ok while git stamps X. This is the hook use commands/ahoy.md documents. The reader must see the configuration git commits with. The scrub's stated reason, stopping an injected GIT_CONFIG_* from forging the identity, does not hold for this reader: it already honours GIT_AUTHOR_*/GIT_COMMITTER_* from the same environment.