The source-ledger flip was refused only under the program name abcd

The source-ledger flip was refused only under the program name abcd

Published as security advisory GHSA-36j9-hjfc-mhc9; the advisory is the public account of this finding.

Summary

The guard refuses an agent's attempt to flip a source-ledger line to public citation (abcd library ledger --flip, and the retired abcd source ledger --flip), because recording that a human chose to cite a source is the person's own act. Before 0.16.0 that refusal matched only when the program was named abcd (or go run of the module). The same verb run through any other name for the same binary, such as a cross-compiled build under bin/, the source-checkout wrapper script, or a renamed copy, was not refused.

Impact

An agent working in a repository could flip a source-ledger line itself, leaving a record that a person had decided to cite the source when none had. No data leaves the machine, and the agent needs the same access it already has to run commands in the checkout.

Patches

Fixed in 0.16.0: each act only the person takes is now also refused under any program whose words carry that act's verbs and flags, with the same reason as the named entry.

Workarounds

Update to 0.16.0. Before updating, review source-ledger history (abcd library ledger) for flips no person made.