Re: [RCF] Secure git against involuntary arb. code execution without feature loss

From: Taylor Blau <me@ttaylorr.com>
Date: Oct 8, 2025, 21:30 UTC
Message-ID: <aObX4C7lMHRnjbYq@nand.local>
In-Reply-To: <72F10412-8B0F-4F66-8674-FE194D016DF9@lohmann.sh>

On Wed, Oct 08, 2025 at 11:02:03PM +0200, Michael Lohmann wrote:

Show 6 quoted lines

> * Proposed solution (keeping all existing features):
> - On first use, git generates a secret "token" (e.g. a random string in
>   ~/.gitsecret)
> - On calling `git init` or `git clone`, the secret is copied into the
>   new .git directory and serves as proof that this clone was created by
>   this user

Sure, but the problem is not with direct clones (at least, not using the --local optimization), but with clones that recursively clone other submodules.

If I clone a repository with --recurse-submodules, I imagine that this proposal would *not* suggest copying this token into the recursively cloned submodules, right? proposal improves the experience

> - Editors would no longer need to prompt the user for "Do you trust this
>   repository?" in most cases, because git could prove the clone is user
>   generated.

If the above is true (that Git would not copy the token into recursively cloned submodules), then I admit to struggling a bit to see how this proposal would remove the need to consult the user in this case. Instead of the editor doing it, the user would need to do it themselves?

Thanks, Taylor