013 — git 3.x：一個宣稱自己是任何人的 commit，跟真的是同一種物件

{
  "name": "013-git-authorship",
  "upstream": "git",
  "examined_version": "measured at run time",
  "license": "GPL-2.0-only (git itself; nothing of git's source is reproduced here)",
  "what_it_is": "The fields a commit carries about who made it, and which of them records an act rather than a claim.",

  "why_this_one": "On 2026-08-12 I built a consensus mechanism that read three identical files as three-party agreement; I had written all three. Example 013 the same day turns that into a measurement. This asks whether the most widely used provenance store in software has the distinction the example says is needed — and it is not CPython, because six consecutive entries from one standard library is a sampling habit rather than a finding.",

  "fields": {
    "author": {"kind": "claim", "set_by": "GIT_AUTHOR_NAME, a documented environment variable"},
    "committer": {"kind": "claim", "set_by": "GIT_COMMITTER_NAME, likewise"},
    "trailer": {"kind": "claim", "set_by": "typing a line in the commit message; nothing in git reads it back"},
    "signature": {"kind": "act", "set_by": "a cryptographic operation performed with a key"}
  },

  "the_finding": "A commit claiming to be anyone is the same kind of object as an honest one. `git log` prints them identically, the raw object contains nothing extra, and no exploit is involved. The only field that records an act rather than a claim is the signature — and when nobody signs, %G? reports N for the honest commit and the impersonation alike. A field that CAN be an act is not one until someone performs it.",

  "the_self_implication": "Every commit in this repository carries `Co-Authored-By: Claude Opus 5`. Measured here: nothing in git reads that line back. It is a claim in content, which is exactly the shape of the three branch files I wrote and then read as agreement.",

  "sets": {
    "FMS": "this file: the fields, what each records, and what the entry measures",
    "SCL": "which field this deployment would trust for identity",
    "SMS": "field resolution by id, the separation test, and the probes against a throwaway repository",
    "TMS": "one file per field — each declares claim or act, and reaches no sibling set",
    "DMS": "the log as git prints it, and which field could have told the difference"
  },

  "units": {"TMS/fields": ["author.py", "committer.py", "signature.py", "trailer.py"]},

  "non_goals": [
    "Saying git is wrong. A distributed VCS cannot have an authority that issues identities, and signing exists precisely because the author field is not one.",
    "Cryptography. No key is generated; the entry measures what the signature FIELD reports when unused, which is the finding.",
    "Any claim about commits in the wild. This measures what the fields can carry, not what they do carry."
  ]
}

{
  "field_trusted_for_identity": "signature",
  "a_claim_field_used_as_identity_is_fatal": true,
  "_note": "main.py measures every field regardless of what this says."
}

"""Which field this deployment would trust for identity."""
import json
import pathlib

_C = json.loads((pathlib.Path(__file__).parent / "policy.json").read_text(encoding="utf-8"))

trusted = lambda: _C["field_trusted_for_identity"]                                # noqa: E731
claim_as_identity_is_fatal = lambda: bool(_C["a_claim_field_used_as_identity_is_fatal"])  # noqa: E731

"""The re-cut: every field declares whether it records a CLAIM or an ACT.

git has no such distinction. A caller reading `%an` gets a string with the same
shape whether a person authored the commit or typed someone's name, and nothing
in the interface offers to say which.
"""
import importlib

FIELDS = ["author", "committer", "trailer", "signature"]


def load():
    loaded, problems = {}, []
    for name in FIELDS:
        try:
            module = importlib.import_module(f"TMS.fields.{name}")
        except ModuleNotFoundError:
            problems.append(f'field "{name}" has no module - fail closed')
            continue
        for attribute in ("NAME", "KIND", "WHAT_IT_RECORDS"):
            if not hasattr(module, attribute):
                problems.append(f"{name} does not declare {attribute}")
        if getattr(module, "KIND", None) not in {"claim", "act"}:
            problems.append(f"{name}: KIND must be claim or act, not {getattr(module, 'KIND', None)!r}")
        loaded[module.NAME] = module
    return loaded, problems


def resolve(name, loaded):
    module = loaded.get(name)
    if module is None:
        return None, f'field "{name}" has no implementation - fail closed (known: {", ".join(sorted(loaded))})'
    return module, None


def separates(rows, field):
    """Does this field take different values for the honest and the impersonating commit?"""
    honest, impersonating = rows[0], rows[1]
    return honest[field] != impersonating[field]

"""What real git records, measured in a throwaway repository.

Nothing here is an exploit. GIT_AUTHOR_NAME and GIT_COMMITTER_NAME are
documented environment variables, and a Co-Authored-By trailer is a line of the
commit message.
"""
import os
import subprocess
import tempfile

IMPERSONATED = ("Linus Torvalds", "torvalds@linux-foundation.org")


def _git(cwd, *args, env=None):
    return subprocess.run(("git",) + args, cwd=cwd, env=env,
                          capture_output=True, text=True).stdout


def build_repository():
    """Three commits: honest, impersonating, and one with an unchecked trailer."""
    directory = tempfile.mkdtemp()
    _git(directory, "init", "-q")
    _git(directory, "config", "user.name", "Real Person")
    _git(directory, "config", "user.email", "real@example.com")
    _git(directory, "config", "commit.gpgsign", "false")

    open(os.path.join(directory, "a.txt"), "w").write("one\n")
    _git(directory, "add", "-A")
    _git(directory, "commit", "-q", "-m", "an ordinary commit")

    open(os.path.join(directory, "b.txt"), "w").write("two\n")
    _git(directory, "add", "-A")
    env = dict(os.environ, GIT_AUTHOR_NAME=IMPERSONATED[0], GIT_AUTHOR_EMAIL=IMPERSONATED[1],
               GIT_COMMITTER_NAME=IMPERSONATED[0], GIT_COMMITTER_EMAIL=IMPERSONATED[1])
    _git(directory, "commit", "-q", "-m", "a commit by someone who was not there", env=env)

    open(os.path.join(directory, "c.txt"), "w").write("three\n")
    _git(directory, "add", "-A")
    _git(directory, "commit", "-q", "-m",
         "work\n\nCo-Authored-By: Someone Who Never Saw This <nobody@example.com>")
    return directory


def commits(directory):
    rows = []
    for line in _git(directory, "log", "--reverse",
                     "--format=%h\t%an\t%cn\t%G?\t%s").strip().splitlines():
        short, author, committer, sig, subject = (line.split("\t") + [""] * 5)[:5]
        rows.append({"commit": short, "author": author, "committer": committer,
                     "signature_status": sig, "subject": subject})
    return rows


def raw_object(directory, index=1):
    sha = _git(directory, "log", "--reverse", "--format=%H").split()[index]
    return _git(directory, "cat-file", "-p", sha)


def trailer(directory):
    return _git(directory, "log", "-1", "--format=%(trailers)").strip()


def version():
    return _git(tempfile.mkdtemp(), "--version").strip().split()[-1]

"""git's `author` field.

whoever ran the command, or whatever GIT_AUTHOR_NAME said
"""
NAME = "author"
KIND = "claim"
WHAT_IT_RECORDS = "whoever ran the command, or whatever GIT_AUTHOR_NAME said"

"""git's `committer` field.

whoever ran the command, or whatever GIT_COMMITTER_NAME said
"""
NAME = "committer"
KIND = "claim"
WHAT_IT_RECORDS = "whoever ran the command, or whatever GIT_COMMITTER_NAME said"

"""git's `signature` field.

a cryptographic operation someone had to perform with a key
"""
NAME = "signature"
KIND = "act"
WHAT_IT_RECORDS = "a cryptographic operation someone had to perform with a key"

# The ceiling, and it is the finding of the entry: when nobody signs, %G? reports
# N for an honest commit and for an impersonation alike. A field that CAN be an
# act is not one until someone performs it.
UNIFORM_WHEN_UNUSED = "N"

"""git's `trailer` field.

a line of the commit message; nothing in git reads it back
"""
NAME = "trailer"
KIND = "claim"
WHAT_IT_RECORDS = "a line of the commit message; nothing in git reads it back"

"""The log as git prints it, and which field could have told the difference."""


def log(rows, out):
    out(f"\n  {'commit':<9} {'author':<16} {'committer':<16} {'%G?':<5} subject")
    for row in rows:
        out(f"  {row['commit']:<9} {row['author']:<16} {row['committer']:<16} "
            f"{row['signature_status']:<5} {row['subject']}")


def fields(loaded, rows, separates, out):
    out(f"\n  {'field':<11} {'records':<7} {'separates honest from impersonating?':<38} value on both")
    for name, module in sorted(loaded.items()):
        if name in ("author", "committer"):
            # It differs, of course - but the difference is whatever the
            # impersonator typed. A field that varies is not a field that tells.
            answer = "it differs, and the difference is what was typed" if separates(rows, name) else "no"
            value = f"{rows[0][name]} vs {rows[1][name]}"
        elif name == "signature":
            answer = "no - both report N" if not separates(rows, "signature_status") else "yes"
            value = rows[0]["signature_status"]
        else:
            answer = "nothing in git reads it back"
            value = "-"
        out(f"  {module.NAME:<11} {module.KIND:<7} {answer:<38} {value}")


def gaps(out):
    out("\n  measurable, not measured here:")
    out("    - how many commits in a real repository carry a good signature")
    out("    - what fraction of Co-Authored-By trailers name someone who touched the branch")
    out("\n  not measurable by this entry at all:")
    out("    - whether git is wrong to work this way. A distributed VCS cannot")
    out("      have an authority that issues identities, and signing is offered")
    out("      precisely because the author field cannot be one.")
    out("    - whether any particular commit anywhere is honest. This measures")
    out("      what the fields CAN carry, not what they do carry.")

"""The island test.

    python src/island_test.py

Section 2 is the finding: the field that CAN record an act reports the same
value for the honest commit and the impersonation, because nobody signed.
"""
import json
import pathlib
import re
import sys

HERE = pathlib.Path(__file__).parent
sys.path.insert(0, str(HERE))

from SCL import policy  # noqa: E402
from SMS import fields, upstream  # noqa: E402

ARCH = json.loads((HERE / "FMS" / "architecture.json").read_text(encoding="utf-8"))
FAILURES = []


def check(label, ok, detail=""):
    print(f"  {'PASS' if ok else 'FAIL'}  {label}{' - ' + detail if detail else ''}")
    if not ok:
        FAILURES.append(label)


LOADED, PROBLEMS = fields.load()
DIRECTORY = upstream.build_repository()
ROWS = upstream.commits(DIRECTORY)

print("\n== 1. every field is an island, declares claim or act, and FMS matches the tree")
check("all four fields loaded with no problems", not PROBLEMS, "; ".join(PROBLEMS))
field_dir = HERE / "TMS" / "fields"
files = sorted(f.name for f in field_dir.iterdir() if f.suffix == ".py" and f.name != "__init__.py")
for name in files:
    reaches = re.findall(r"^\s*(?:from|import)\s+(\S+)", (field_dir / name).read_text(encoding="utf-8"), re.M)
    check(f"{name} reaches no sibling set", not reaches, ", ".join(reaches) or "no imports at all")
for where, expected in ARCH["units"].items():
    on_disk = sorted(f.name for f in (HERE / where).iterdir()
                     if f.suffix == ".py" and f.name != "__init__.py")
    check(f"{where}: FMS declares {len(expected)}, on disk {len(on_disk)}",
          on_disk == sorted(expected), ", ".join(on_disk))
check("exactly one field declares itself an act",
      sum(1 for m in LOADED.values() if m.KIND == "act") == 1,
      ", ".join(f"{m.NAME}={m.KIND}" for m in sorted(LOADED.values(), key=lambda m: m.NAME)))

print("\n== 2. the impersonating commit is the same kind of object")
honest, impersonating = ROWS[0], ROWS[1]
check("git reports a different author for it", honest["author"] != impersonating["author"],
      f"{honest['author']} vs {impersonating['author']}")
check("and that is the whole of what git knows - the raw object carries no signature",
      "gpgsig" not in upstream.raw_object(DIRECTORY))
check("the one field that could tell them apart reports the SAME value",
      honest["signature_status"] == impersonating["signature_status"],
      f"%G? = {honest['signature_status']} for both")
check("so a field that CAN be an act is not one until someone performs it",
      LOADED["signature"].KIND == "act"
      and honest["signature_status"] == LOADED["signature"].UNIFORM_WHEN_UNUSED)

print("\n== 3. the trailer is a line of the message")
check("a Co-Authored-By naming someone who never saw the branch is stored verbatim",
      "Someone Who Never Saw This" in upstream.trailer(DIRECTORY), upstream.trailer(DIRECTORY))
check("and it is declared a claim, not an act", LOADED["trailer"].KIND == "claim")

print("\n== 4. fail closed")
_, problem = fields.resolve("gpg-web-of-trust", LOADED)
check("an unresolvable field stops the run", problem is not None, problem or "resolved anyway")
check("SCL names a field that exists", policy.trusted() in LOADED, policy.trusted())
check("and the field it trusts is the one declared an act",
      LOADED[policy.trusted()].KIND == "act", f"{policy.trusted()} = {LOADED[policy.trusted()].KIND}")

print("\n== 5. what this entry cannot see")
print("        MEASURABLE, NOT MEASURED")
print("          - how many commits in a real repository carry a good signature")
print("          - what fraction of Co-Authored-By trailers name someone who was there")
print("        NOT MEASURABLE HERE")
print("          - whether git is wrong to work this way. A distributed VCS has no")
print("            authority to issue identities, and signing exists because the")
print("            author field is not one.")
print("          - whether any commit anywhere is honest. This measures what the")
print("            fields CAN carry, not what they do.")

print(f"\n{len(FAILURES)} failure(s)" if FAILURES else "\nall checks passed")
for f in FAILURES:
    print(f"  - {f}")
sys.exit(1 if FAILURES else 0)

"""git's fields about who made a commit, measured against a throwaway repository.

    python src/main.py            the log, the fields, and which one separates
    python src/main.py --strict   exit 1 if the trusted field is a claim
"""
import json
import pathlib
import sys

HERE = pathlib.Path(__file__).parent
sys.path.insert(0, str(HERE))

from DMS import report  # noqa: E402
from SCL import policy  # noqa: E402
from SMS import fields, upstream  # noqa: E402

ARCH = json.loads((HERE / "FMS" / "architecture.json").read_text(encoding="utf-8"))


def main(argv):
    out = lambda line="": sys.stdout.write(line + "\n")  # noqa: E731
    loaded, problems = fields.load()
    if problems:
        for problem in problems:
            out(f"  !! {problem}")
        return 1

    directory = upstream.build_repository()
    rows = upstream.commits(directory)

    out(f"\n== three commits, one of which was not made by who it says  [git {upstream.version()}]")
    report.log(rows, out)
    report.fields(loaded, rows, fields.separates, out)

    out("\n== the raw object of the impersonating commit")
    for line in upstream.raw_object(directory).splitlines()[:5]:
        out(f"    {line}")
    out(f"    contains a signature block: {'gpgsig' in upstream.raw_object(directory)}")

    out("\n== the trailer, and what reads it")
    out(f"    stored:  {upstream.trailer(directory)}")
    out("    read by: nothing in git. It is a line of the message.")
    out(f"    note:    {ARCH['self_implication'] if 'self_implication' in ARCH else ARCH['the_self_implication']}")

    trusted, problem = fields.resolve(policy.trusted(), loaded)
    if problem:
        out(f"\n  !! {problem}")
        return 1
    out(f"\n== this deployment would trust `{trusted.NAME}` for identity, which records {"an act" if trusted.KIND == "act" else "a claim"}")

    report.gaps(out)

    if "--strict" in argv and trusted.KIND == "claim" and policy.claim_as_identity_is_fatal():
        return 1
    return 0


if __name__ == "__main__":
    sys.exit(main(sys.argv[1:]))