{"thread":{"id":"53746","subject":"[PATCH 0/2] bugreport: report configs from safelist","startedAt":"2020-06-24T01:28:41Z","lastAt":"2020-06-24T18:37:19Z","messageCount":5,"participants":["Emily Shaffer","Junio C Hamano"],"isPatch":true,"patchVersion":1,"patchTotal":2},"messages":[{"id":"400482","messageId":"20200624012827.34126-1-emilyshaffer@google.com","threadId":"53746","inReplyTo":null,"subject":"[PATCH 0/2] bugreport: report configs from safelist","fromName":"Emily Shaffer","fromEmail":"emilyshaffer@google.com","sentAt":"2020-06-24T01:28:25Z","receivedAt":"2020-06-24T01:28:41Z","isPatch":true,"sender":{"key":"nasamuffin@google.com","avatar":"https://avatars.githubusercontent.com/u/1606826?v=4"},"body":"Some configs are useful to know when trying to diagnose or reproduce an\nissue. However, other configs are sensitive and should not be shared\nwith others. Finally, many tools which wrap or augment Git also use\nGit's config system, and so may store sensitive information which Git\nis not aware of. Therefore, it makes sense for git-bugreport to gather\nconfigs which Git developers have decided are safe and useful - a\nsafelist - but no other configs which the user may have. This list of\nsafe configs can be expanded over time and is generated from\ndocumentation.\n\nThis series is based on 'master' but was cherry-picked from quite some\ntime ago, so it's possible there's some anachronism I missed reviewing\nit myself :)\n\n - Emily\n\nEmily Shaffer (2):\n  bugreport: generate config safelist based on docs\n  bugreport: add config values from safelist\n\n .gitignore                              |  1 +\n Documentation/asciidoc.conf             |  9 ++++\n Documentation/asciidoctor-extensions.rb |  7 ++++\n Documentation/config/sendemail.txt      | 56 ++++++++++++-------------\n Documentation/git-bugreport.txt         |  1 +\n Makefile                                |  9 ++++\n bugreport.c                             | 28 +++++++++++++\n generate-bugreport-config-safelist.sh   | 18 ++++++++\n 8 files changed, 101 insertions(+), 28 deletions(-)\n create mode 100755 generate-bugreport-config-safelist.sh\n\n-- \n2.27.0.111.gc72c7da667-goog\n\n"},{"id":"400483","messageId":"20200624012827.34126-2-emilyshaffer@google.com","threadId":"53746","inReplyTo":"20200624012827.34126-1-emilyshaffer@google.com","subject":"[PATCH 1/2] bugreport: generate config safelist based on docs","fromName":"Emily Shaffer","fromEmail":"emilyshaffer@google.com","sentAt":"2020-06-24T01:28:26Z","receivedAt":"2020-06-24T01:28:43Z","isPatch":true,"sender":{"key":"nasamuffin@google.com","avatar":"https://avatars.githubusercontent.com/u/1606826?v=4"},"body":"Add a new step to the build to generate a safelist of git-config\nvariables which are appropriate to include in the output of\ngit-bugreport. New variables can be added to the safelist by annotating\ntheir documentation in Documentation/config with the \"annotate\" macro,\nwhich is a no-op in AsciiDoc and AsciiDoctor.\n\nSome configs are private in nature, and can contain remote URLs,\npasswords, or other sensitive information. In the event that a user\ndoesn't notice their information while reviewing a bugreport, that user\nmay leak their credentials to other individuals, mailing lists, or bug\ntracking tools inadvertently. Heuristic blocklisting of configuration\nkeys is imperfect and prone to false negatives; given the nature of the\ninformation which can be leaked, a safelist is more reliable.\n\nHowever, it's possible that in some situations, an organization may be\nless concerned with privacy of things like remote URLs and branch names,\nand more concerned with ease of diagnosis for their support staff. In\nthose cases, it may make more sense for that organization to modify the\ncode to use a blocklist. To that end, we should try to mark configs which\nare definitely safe, and configs which are definitely unsafe, and leave\nblank configs which are somewhere in between. To mark a config as safe,\nadd \"annotate:bugreport[include]\" to the corresponding line in the\nconfig documentation; to mark it as unsafe, add\n\"annotate:bugreport[exclude]\" instead.\n\nGenerating bugreport-config-safelist.h at build time by grepping the\ndocumentation for this new macro helps us prevent staleness. The macro\nitself is a no-op and should not alter the appearance of the\ndocumentation in either AsciiDoc or AsciiDoctor, confirmable by running:\n\n  cd Documentation\n  ./doc-diff --asciidoctor HEAD^ HEAD\n  ./doc-diff --asciidoc HEAD^ HEAD\n\nDiffing the rendered HTML shows that only inline comments were added,\nwhich shouldn't be a problem.\n\nAdditionally, add annotations to the sendemail config documentation in\norder to demonstrate a proof of concept.\n\nHelped-by: Martin Ågren <martin.agren@gmail.com>\nHelped-by: Johannes Schindelin <Johannes.Schindelin@gmx.de>\nSigned-off-by: Emily Shaffer <emilyshaffer@google.com>\n---\n .gitignore                              |  1 +\n Documentation/asciidoc.conf             |  9 ++++\n Documentation/asciidoctor-extensions.rb |  7 ++++\n Documentation/config/sendemail.txt      | 56 ++++++++++++-------------\n Makefile                                |  7 ++++\n generate-bugreport-config-safelist.sh   | 18 ++++++++\n 6 files changed, 70 insertions(+), 28 deletions(-)\n create mode 100755 generate-bugreport-config-safelist.sh\n\ndiff --git a/.gitignore b/.gitignore\nindex ee509a2ad2..0177839ae8 100644\n--- a/.gitignore\n+++ b/.gitignore\n@@ -191,6 +191,7 @@\n /gitweb/static/gitweb.min.*\n /config-list.h\n /command-list.h\n+/bugreport-config-safelist.h\n *.tar.gz\n *.dsc\n *.deb\ndiff --git a/Documentation/asciidoc.conf b/Documentation/asciidoc.conf\nindex 3e4c13971b..fd225e30cc 100644\n--- a/Documentation/asciidoc.conf\n+++ b/Documentation/asciidoc.conf\n@@ -6,9 +6,14 @@\n #\n # Show Git link as: <command>(<section>); if section is defined, else just show\n # the command.\n+#\n+# The annotate macro does nothing as far as rendering is\n+# concerned -- we just grep for it in the sources to populate\n+# things like the bugreport safelist.\n \n [macros]\n (?su)[\\\\]?(?P<name>linkgit):(?P<target>\\S*?)\\[(?P<attrlist>.*?)\\]=\n+(?su)[\\\\]?(?P<name>annotate):(?P<target>\\S*?)\\[(?P<attrlist>.*?)\\]=\n \n [attributes]\n asterisk=&#42;\n@@ -28,6 +33,8 @@ ifdef::backend-docbook[]\n {0#<citerefentry>}\n {0#<refentrytitle>{target}</refentrytitle><manvolnum>{0}</manvolnum>}\n {0#</citerefentry>}\n+[annotate-inlinemacro]\n+{0#}\n endif::backend-docbook[]\n \n ifdef::backend-docbook[]\n@@ -75,4 +82,6 @@ ifdef::backend-xhtml11[]\n git-relative-html-prefix=\n [linkgit-inlinemacro]\n <a href=\"{git-relative-html-prefix}{target}.html\">{target}{0?({0})}</a>\n+[annotate-inlinemacro]\n+<!-- -->\n endif::backend-xhtml11[]\ndiff --git a/Documentation/asciidoctor-extensions.rb b/Documentation/asciidoctor-extensions.rb\nindex d906a00803..03c80af0e5 100644\n--- a/Documentation/asciidoctor-extensions.rb\n+++ b/Documentation/asciidoctor-extensions.rb\n@@ -39,10 +39,17 @@ module Git\n         output\n       end\n     end\n+\n+    class AnnotateProcessor < Asciidoctor::Extensions::InlineMacroProcessor\n+      def process(parent, target, attrs)\n+        \"\"\n+      end\n+    end\n   end\n end\n \n Asciidoctor::Extensions.register do\n   inline_macro Git::Documentation::LinkGitProcessor, :linkgit\n   postprocessor Git::Documentation::DocumentPostProcessor\n+  inline_macro Git::Documentation::AnnotateProcessor, :annotate\n end\ndiff --git a/Documentation/config/sendemail.txt b/Documentation/config/sendemail.txt\nindex 0006faf800..fe27473e44 100644\n--- a/Documentation/config/sendemail.txt\n+++ b/Documentation/config/sendemail.txt\n@@ -4,7 +4,7 @@ sendemail.identity::\n \tvalues in the 'sendemail' section. The default identity is\n \tthe value of `sendemail.identity`.\n \n-sendemail.smtpEncryption::\n+sendemail.smtpEncryption annotate:bugreport[include] ::\n \tSee linkgit:git-send-email[1] for description.  Note that this\n \tsetting is not subject to the 'identity' mechanism.\n \n@@ -15,7 +15,7 @@ sendemail.smtpsslcertpath::\n \tPath to ca-certificates (either a directory or a single file).\n \tSet it to an empty string to disable certificate verification.\n \n-sendemail.<identity>.*::\n+sendemail.<identity>.* annotate:bugreport[exclude] ::\n \tIdentity-specific versions of the 'sendemail.*' parameters\n \tfound below, taking precedence over those when this\n \tidentity is selected, through either the command-line or\n@@ -23,41 +23,41 @@ sendemail.<identity>.*::\n \n sendemail.aliasesFile::\n sendemail.aliasFileType::\n-sendemail.annotate::\n-sendemail.bcc::\n-sendemail.cc::\n-sendemail.ccCmd::\n-sendemail.chainReplyTo::\n-sendemail.confirm::\n-sendemail.envelopeSender::\n-sendemail.from::\n-sendemail.multiEdit::\n-sendemail.signedoffbycc::\n-sendemail.smtpPass::\n-sendemail.suppresscc::\n-sendemail.suppressFrom::\n-sendemail.to::\n-sendemail.tocmd::\n-sendemail.smtpDomain::\n-sendemail.smtpServer::\n-sendemail.smtpServerPort::\n-sendemail.smtpServerOption::\n-sendemail.smtpUser::\n-sendemail.thread::\n-sendemail.transferEncoding::\n-sendemail.validate::\n-sendemail.xmailer::\n+sendemail.annotate annotate:bugreport[include] ::\n+sendemail.bcc annotate:bugreport[include] ::\n+sendemail.cc annotate:bugreport[include] ::\n+sendemail.ccCmd annotate:bugreport[include] ::\n+sendemail.chainReplyTo annotate:bugreport[include] ::\n+sendemail.confirm annotate:bugreport[include] ::\n+sendemail.envelopeSender annotate:bugreport[include] ::\n+sendemail.from annotate:bugreport[include] ::\n+sendemail.multiEdit annotate:bugreport[include] ::\n+sendemail.signedoffbycc annotate:bugreport[include] ::\n+sendemail.smtpPass annotate:bugreport[exclude] ::\n+sendemail.suppresscc annotate:bugreport[include] ::\n+sendemail.suppressFrom annotate:bugreport[include] ::\n+sendemail.to annotate:bugreport[include] ::\n+sendemail.tocmd annotate:bugreport[include] ::\n+sendemail.smtpDomain annotate:bugreport[include] ::\n+sendemail.smtpServer annotate:bugreport[include] ::\n+sendemail.smtpServerPort annotate:bugreport[include] ::\n+sendemail.smtpServerOption annotate:bugreport[include] ::\n+sendemail.smtpUser annotate:bugreport[exclude] ::\n+sendemail.thread annotate:bugreport[include] ::\n+sendemail.transferEncoding annotate:bugreport[include] ::\n+sendemail.validate annotate:bugreport[include] ::\n+sendemail.xmailer annotate:bugreport[include] ::\n \tSee linkgit:git-send-email[1] for description.\n \n sendemail.signedoffcc (deprecated)::\n \tDeprecated alias for `sendemail.signedoffbycc`.\n \n-sendemail.smtpBatchSize::\n+sendemail.smtpBatchSize annotate:bugreport[include] ::\n \tNumber of messages to be sent per connection, after that a relogin\n \twill happen.  If the value is 0 or undefined, send all messages in\n \tone connection.\n \tSee also the `--batch-size` option of linkgit:git-send-email[1].\n \n-sendemail.smtpReloginDelay::\n+sendemail.smtpReloginDelay annotate:bugreport[include] ::\n \tSeconds wait before reconnecting to smtp server.\n \tSee also the `--relogin-delay` option of linkgit:git-send-email[1].\ndiff --git a/Makefile b/Makefile\nindex 372139f1f2..11d4029003 100644\n--- a/Makefile\n+++ b/Makefile\n@@ -810,6 +810,7 @@ VCSSVN_LIB = vcs-svn/lib.a\n \n GENERATED_H += config-list.h\n GENERATED_H += command-list.h\n+GENERATED_H += bugreport-config-safelist.h\n \n LIB_H := $(sort $(patsubst ./%,%,$(shell git ls-files '*.h' ':!t/' ':!Documentation/' 2>/dev/null || \\\n \t$(FIND) . \\\n@@ -2164,6 +2165,12 @@ command-list.h: $(wildcard Documentation/git*.txt) Documentation/*config.txt Doc\n \t\t$(patsubst %,--exclude-program %,$(EXCLUDED_PROGRAMS)) \\\n \t\tcommand-list.txt >$@+ && mv $@+ $@\n \n+bugreport-config-safelist.h: generate-bugreport-config-safelist.sh\n+\n+bugreport-config-safelist.h: Documentation/config/*.txt\n+\t$(QUIET_GEN)$(SHELL_PATH) ./generate-bugreport-config-safelist.sh \\\n+\t\t>$@+ && mv $@+ $@\n+\n SCRIPT_DEFINES = $(SHELL_PATH_SQ):$(DIFF_SQ):$(GIT_VERSION):\\\n \t$(localedir_SQ):$(NO_CURL):$(USE_GETTEXT_SCHEME):$(SANE_TOOL_PATH_SQ):\\\n \t$(gitwebdir_SQ):$(PERL_PATH_SQ):$(SANE_TEXT_GREP):$(PAGER_ENV):\\\ndiff --git a/generate-bugreport-config-safelist.sh b/generate-bugreport-config-safelist.sh\nnew file mode 100755\nindex 0000000000..5bf1f4ad82\n--- /dev/null\n+++ b/generate-bugreport-config-safelist.sh\n@@ -0,0 +1,18 @@\n+#!/bin/sh\n+\n+cat <<\"EOF\"\n+/* Automatically generated by bugreport-generate-config-safelist.sh */\n+\n+\n+static const char *bugreport_config_safelist[] = {\n+EOF\n+\n+# cat all regular files in Documentation/config\n+find Documentation/config -type f -exec cat {} \\; |\n+# print the command name which matches the annotate-bugreport macro\n+sed -n 's/^\\([^ ]*\\)  *annotate:bugreport\\[include\\].* ::$/  \"\\1\",/p' |\n+\tsort\n+\n+cat <<\"EOF\"\n+};\n+EOF\n-- \n2.27.0.111.gc72c7da667-goog\n\n"},{"id":"400484","messageId":"20200624012827.34126-3-emilyshaffer@google.com","threadId":"53746","inReplyTo":"20200624012827.34126-1-emilyshaffer@google.com","subject":"[PATCH 2/2] bugreport: add config values from safelist","fromName":"Emily Shaffer","fromEmail":"emilyshaffer@google.com","sentAt":"2020-06-24T01:28:27Z","receivedAt":"2020-06-24T01:28:46Z","isPatch":true,"sender":{"key":"nasamuffin@google.com","avatar":"https://avatars.githubusercontent.com/u/1606826?v=4"},"body":"Teach bugreport to gather the values of config options which are present\nin 'bugreport-config-safelist.h', and show their origin scope.\n\nMany config options are sensitive, and many Git add-ons use config\noptions which git-core does not know about; it is better only to gather\nconfig options which we know to be safe, rather than excluding options\nwhich we know to be unsafe.\n\nRather than including the path to someone's config, which can reveal\nfilesystem layout and project names, just name the scope (e.g. system,\nglobal, local) of the config source.\n\nSigned-off-by: Emily Shaffer <emilyshaffer@google.com>\n---\n Documentation/git-bugreport.txt |  1 +\n Makefile                        |  2 ++\n bugreport.c                     | 28 ++++++++++++++++++++++++++++\n 3 files changed, 31 insertions(+)\n\ndiff --git a/Documentation/git-bugreport.txt b/Documentation/git-bugreport.txt\nindex 66e88c2e31..827063d69b 100644\n--- a/Documentation/git-bugreport.txt\n+++ b/Documentation/git-bugreport.txt\n@@ -30,6 +30,7 @@ The following information is captured automatically:\n  - Compiler-specific info string\n  - A list of enabled hooks\n  - $SHELL\n+ - Selected config values\n \n This tool is invoked via the typical Git setup process, which means that in some\n cases, it might not be able to launch - for example, if a relevant config file\ndiff --git a/Makefile b/Makefile\nindex 11d4029003..a88f918c77 100644\n--- a/Makefile\n+++ b/Makefile\n@@ -2132,6 +2132,8 @@ git$X: git.o GIT-LDFLAGS $(BUILTIN_OBJS) $(GITLIBS)\n \n help.sp help.s help.o: command-list.h\n \n+bugreport.sp bugreport.s bugreport.o: bugreport-config-safelist.h\n+\n builtin/help.sp builtin/help.s builtin/help.o: config-list.h GIT-PREFIX\n builtin/help.sp builtin/help.s builtin/help.o: EXTRA_CPPFLAGS = \\\n \t'-DGIT_HTML_PATH=\"$(htmldir_relative_SQ)\"' \\\ndiff --git a/bugreport.c b/bugreport.c\nindex 28f4568b01..f988939bba 100644\n--- a/bugreport.c\n+++ b/bugreport.c\n@@ -4,6 +4,8 @@\n #include \"help.h\"\n #include \"compat/compiler.h\"\n #include \"run-command.h\"\n+#include \"config.h\"\n+#include \"bugreport-config-safelist.h\"\n \n \n static void get_system_info(struct strbuf *sys_info)\n@@ -86,6 +88,29 @@ static void get_populated_hooks(struct strbuf *hook_info, int nongit)\n \t\t\tstrbuf_addf(hook_info, \"%s\\n\", hook[i]);\n }\n \n+static void get_safelisted_config(struct strbuf *config_info)\n+{\n+\tsize_t idx;\n+\tstruct string_list_item *it = NULL;\n+\tstruct key_value_info *kv_info = NULL;\n+\n+\tfor (idx = 0; idx < ARRAY_SIZE(bugreport_config_safelist); idx++) {\n+\t\tconst struct string_list *list =\n+\t\t\tgit_config_get_value_multi(bugreport_config_safelist[idx]);\n+\n+\t\tif (!list)\n+\t\t\tcontinue;\n+\n+\t\tstrbuf_addf(config_info, \"%s:\\n\", bugreport_config_safelist[idx]);\n+\t\tfor_each_string_list_item(it, list) {\n+\t\t\tkv_info = it->util;\n+\t\t\tstrbuf_addf(config_info, \"  %s (%s)\\n\", it->string,\n+\t\t\t\t    kv_info ? config_scope_name(kv_info->scope)\n+\t\t\t\t\t    : _(\"source unknown\"));\n+\t\t}\n+\t}\n+}\n+\n static const char * const bugreport_usage[] = {\n \tN_(\"git bugreport [-o|--output-directory <file>] [-s|--suffix <format>]\"),\n \tNULL\n@@ -172,6 +197,9 @@ int cmd_main(int argc, const char **argv)\n \tget_header(&buffer, _(\"Enabled Hooks\"));\n \tget_populated_hooks(&buffer, nongit_ok);\n \n+\tget_header(&buffer, _(\"Safelisted Config Info\"));\n+\tget_safelisted_config(&buffer);\n+\n \t/* fopen doesn't offer us an O_EXCL alternative, except with glibc. */\n \treport = open(report_path.buf, O_CREAT | O_EXCL | O_WRONLY, 0666);\n \n-- \n2.27.0.111.gc72c7da667-goog\n\n"},{"id":"400488","messageId":"xmqq4kr19j3w.fsf@gitster.c.googlers.com","threadId":"53746","inReplyTo":"20200624012827.34126-2-emilyshaffer@google.com","subject":"Re: [PATCH 1/2] bugreport: generate config safelist based on docs","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2020-06-24T04:35:15Z","receivedAt":"2020-06-24T04:35:24Z","isPatch":true,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Emily Shaffer <emilyshaffer@google.com> writes:\n\n> ... To mark a config as safe,\n> add \"annotate:bugreport[include]\" to the corresponding line in the\n> config documentation; to mark it as unsafe, add\n> \"annotate:bugreport[exclude]\" instead.\n\nHmph,...\n\n> -sendemail.smtpEncryption::\n> +sendemail.smtpEncryption annotate:bugreport[include] ::\n>  \tSee linkgit:git-send-email[1] for description.  Note that this\n>  \tsetting is not subject to the 'identity' mechanism.\n>  \n> @@ -15,7 +15,7 @@ sendemail.smtpsslcertpath::\n>  \tPath to ca-certificates (either a directory or a single file).\n>  \tSet it to an empty string to disable certificate verification.\n>  \n> -sendemail.<identity>.*::\n> +sendemail.<identity>.* annotate:bugreport[exclude] ::\n\nSo \"sendemail.git-devel.cc\" is not included due to [exclude] here,\nbut ...\n\n> +sendemail.annotate annotate:bugreport[include] ::\n> +sendemail.bcc annotate:bugreport[include] ::\n> +sendemail.cc annotate:bugreport[include] ::\n\n... \"sendemail.cc\" that is a fallback value for other \"sendemail.*.cc\"\nis included?  \n\n> +++ b/generate-bugreport-config-safelist.sh\n> @@ -0,0 +1,18 @@\n> +#!/bin/sh\n> +\n> +cat <<\"EOF\"\n> +/* Automatically generated by bugreport-generate-config-safelist.sh */\n> +\n> +\n> +static const char *bugreport_config_safelist[] = {\n> +EOF\n> +\n> +# cat all regular files in Documentation/config\n> +find Documentation/config -type f -exec cat {} \\; |\n> +# print the command name which matches the annotate-bugreport macro\n> +sed -n 's/^\\([^ ]*\\)  *annotate:bugreport\\[include\\].* ::$/  \"\\1\",/p' |\n> +\tsort\n\nWe just care about \"include\" entries, so it does not matter whether\nwe mark entries with [exclude] or not anyway?\n\nPuzzled...\n"},{"id":"400550","messageId":"20200624183711.GA165490@google.com","threadId":"53746","inReplyTo":"xmqq4kr19j3w.fsf@gitster.c.googlers.com","subject":"Re: [PATCH 1/2] bugreport: generate config safelist based on docs","fromName":"Emily Shaffer","fromEmail":"emilyshaffer@google.com","sentAt":"2020-06-24T18:37:11Z","receivedAt":"2020-06-24T18:37:19Z","isPatch":true,"sender":{"key":"nasamuffin@google.com","avatar":"https://avatars.githubusercontent.com/u/1606826?v=4"},"body":"On Tue, Jun 23, 2020 at 09:35:15PM -0700, Junio C Hamano wrote:\n> \n> Emily Shaffer <emilyshaffer@google.com> writes:\n> \n> > ... To mark a config as safe,\n> > add \"annotate:bugreport[include]\" to the corresponding line in the\n> > config documentation; to mark it as unsafe, add\n> > \"annotate:bugreport[exclude]\" instead.\n> \n> Hmph,...\n> \n> > -sendemail.smtpEncryption::\n> > +sendemail.smtpEncryption annotate:bugreport[include] ::\n> >  \tSee linkgit:git-send-email[1] for description.  Note that this\n> >  \tsetting is not subject to the 'identity' mechanism.\n> >  \n> > @@ -15,7 +15,7 @@ sendemail.smtpsslcertpath::\n> >  \tPath to ca-certificates (either a directory or a single file).\n> >  \tSet it to an empty string to disable certificate verification.\n> >  \n> > -sendemail.<identity>.*::\n> > +sendemail.<identity>.* annotate:bugreport[exclude] ::\n> \n> So \"sendemail.git-devel.cc\" is not included due to [exclude] here,\n> but ...\n\nHm, I can change this for the example, but I think it may still not be\nincluded correctly because of the wildcard.  We had talked about whether\nto include wildcarded options like this in the past too - I think that's\npart of why I removed these couple patches from the initial bugreport\nseries.\n\nIf this line becomes included, then what we're really searching for is\nanything matching \"sendemail.*.*\"; is this syntax regular enough to\ncount on in the generator script? Could the generator script do some\nmagic to turn <foo> and * into valid regex in the generated header and\nthen use that regex during the config parse?\n\nMaybe using regex is overkill and I should just check for \"*\" during the\nparse. Or maybe there's already a library to use. I'll dig into this\nsome today. Thanks for pointing it out.\n\n> \n> > +sendemail.annotate annotate:bugreport[include] ::\n> > +sendemail.bcc annotate:bugreport[include] ::\n> > +sendemail.cc annotate:bugreport[include] ::\n> \n> ... \"sendemail.cc\" that is a fallback value for other \"sendemail.*.cc\"\n> is included?  \n> \n> > +++ b/generate-bugreport-config-safelist.sh\n> > @@ -0,0 +1,18 @@\n> > +#!/bin/sh\n> > +\n> > +cat <<\"EOF\"\n> > +/* Automatically generated by bugreport-generate-config-safelist.sh */\n> > +\n> > +\n> > +static const char *bugreport_config_safelist[] = {\n> > +EOF\n> > +\n> > +# cat all regular files in Documentation/config\n> > +find Documentation/config -type f -exec cat {} \\; |\n> > +# print the command name which matches the annotate-bugreport macro\n> > +sed -n 's/^\\([^ ]*\\)  *annotate:bugreport\\[include\\].* ::$/  \"\\1\",/p' |\n> > +\tsort\n> \n> We just care about \"include\" entries, so it does not matter whether\n> we mark entries with [exclude] or not anyway?\n> \n> Puzzled...\n\nI wonder where I forgot to include the context for encouraging\n\"exclude\". My thinking was that some organizations might have a lower\nexpectation of employee privacy, and therefore opt to use a blocklist\nrather than a safelist for bug reports included internally. I suppose I\nwas thinking then that organization only needs to carry a patch to\ninvert the generator script, and not have to comb through all the\nconfigs they care or don't care about themselves.\n\nBut as I'm revisiting this, it seems like that means a user who works\nfor Big Brother Corp but is told to \"file that bug upstream\" could then\nleak their confidential info by accident, not realizing their\ngit-bugreport is using a wider net than upstream wants.\n\nWhat do others think?\n\n - Emily\n"}]}