Git Intern Week 7: Some Rethinking.

It has been over seven weeks since I started my Outreachy internship at Git under the mentorship of Christian Couder. My internship focuses on adding the os-version capability to the Git v2 protocol, allowing the OS name to be shared between the Git Client and Server for statistical analysis, security, and debugging purposes.

So far, I have implemented two key features. By default, the os-version capability shares only the OS name. To address privacy concerns, I added the transfer.advertiseOSVersion config option to disable this feature. I also implemented the osVersion.command config option, which allows specifying a command to determine the shared value instead of the OS name. You can learn about all these and my internship on my previous posts here.

In my blog post last week, I mentioned that I had sent the second iteration of my patch series to the Git mailing list and received some comments. In fact, after my blog post, I received more comments, and one of them suggested dropping the patch that implemented the osVersion.command.

For a sensitive feature like the os-version capability, it makes sense to be cautious about what to implement and its implications. Having multiple ways to customize this feature could lead to abuse, as people might insert random values. Adding a config option like osVersion.command means there would be concerns about the security implications it could cause. Additionally, it introduces a mechanism that allows users to spawn arbitrary commands while Git is running. For all these reasons, I will not be adding any other configurations as initially planned. We will only have the os-version capability sharing the OS name (e.g., Linux) and the transfer.advertiseOSVersion config option to disable it.

Also, Another discussion is ongoing about whether to introduce a separate os-version capability or include the OS name within the existing agent capability something similar to the User-Agent in browsers. Both approaches have pros and cons, but I will cover this part in next week's blog, as no conclusion has been reached yet. You can follow along with my patch series here.

Optimistically, I should complete the feature before the end of my internship. Therefore, I have started looking into other tasks I could work on. One of them is the ongoing effort to reduce the use of the global variable the_repository in the Git codebase, and the other is the ongoing effort to start compiling the Git codebase with -Wsign-compare. Pending the discussion about my current patches and hopefully after they have been accepted, I will be working on either one of these two tasks or both. I have also started reviewing previous patch series on these two tasks. I will be discussing this more in my upcoming blog next week. Thank you, and see you next week.