Re: [PATCH 1/1] mailmap: support hashed entries in mailmaps

[Phillip Wood <phillip.wood123@gmail.com>]

Hi Brian

On 13/12/2020 01:05, brian m. carlson wrote:
> Many people, through the course of their lives, will change either a
> name or an email address.  For this reason, we have the mailmap, to map
> from a user's former name or email address to their current, canonical
> forms.  Normally, this works well as it is.
> 
> However, sometimes people change a name or an email address and wish to
> wholly disassociate themselves from that former name or email address.
> For example, a person may have left a company which engaged in a deeply
> unethical act with which the person does not want to be associated, or
> they may have changed their name to disassociate themselves from an
> abusive family or partner.

I think we should be clear in the documentation that by adding a hashed 
.mailmap entry people are still publicly associating their old identity 
with their new identity it's just that the association is obscured. They 
should not rely on it for their safety. An abusive partner knows the old 
identity so all they have to do to find the new identity is hash the old 
identity and see if it is in the .mailmap file.

Having said that I think this is a useful step forward in may cases.

Best Wishes

Phillip

> In such a case, using the former name or
> address in any way may be undesirable and the person may wish to replace
> it as completely as possible.
> 
> For projects which wish to support this, introduce hashed forms into the
> mailmap.  These forms, which start with "@sha256:" followed by a SHA-256
> hash of the entry, can be used in place of the form used in the commit
> field.  This form is intentionally designed to be unlikely to conflict
> with legitimate use cases.  For example, this is not a valid email
> address according to RFC 5322.  In the unlikely event that a user has
> put such a form into the actual commit as their name, we will accept it.
> 
> While the form of the data is designed to accept multiple hash
> algorithms, we intentionally do not support SHA-1.  There is little
> reason to support such a weak algorithm in new use cases and no
> backwards compatibility to consider.  Moreover, SHA-256 is faster than
> the SHA1DC implementation we use, so this not only improves performance,
> but simplifies the current implementation somewhat as well.
> 
> Note that it is, of course, possible to perform a lookup on all commit
> objects to determine the actual entry which matches the hashed form of
> the data.  However, a project for which this feature is valuable may
> simply insert entries for many contributors in order to make discovery
> of "interesting" entries significantly less convenient.
> 
> Signed-off-by: brian m. carlson <sandals@crustytoothpaste.net>
> ---
>   mailmap.c          | 39 +++++++++++++++++++++++++++++++++++++--
>   t/t4203-mailmap.sh | 35 +++++++++++++++++++++++++++++++++++
>   2 files changed, 72 insertions(+), 2 deletions(-)
> 
> diff --git a/mailmap.c b/mailmap.c
> index 962fd86d6d..09d0ad7ca4 100644
> --- a/mailmap.c
> +++ b/mailmap.c
> @@ -313,6 +313,41 @@ static struct string_list_item *lookup_prefix(struct string_list *map,
>   	return NULL;
>   }
>   
> +/*
> + * Convert an email or name into a hashed form for comparison.  The hashed form
> + * will be created in the form
> + * @sha256:c68b7a430ac8dee9676ec77a387194e23f234d024e03d844050cf6c01775c8f6,
> + * which would be the hashed form for "doe@example.com".
> + */
> +static char *hashed_form(struct strbuf *buf, const struct git_hash_algo *algop, const char *key, size_t keylen)
> +{
> +	git_hash_ctx ctx;
> +	unsigned char hashbuf[GIT_MAX_RAWSZ];
> +	char hexbuf[GIT_MAX_HEXSZ + 1];
> +
> +	algop->init_fn(&ctx);
> +	algop->update_fn(&ctx, key, keylen);
> +	algop->final_fn(hashbuf, &ctx);
> +	hash_to_hex_algop_r(hexbuf, hashbuf, algop);
> +
> +	strbuf_addf(buf, "@%s:%s", algop->name, hexbuf);
> +	return buf->buf;
> +}
> +
> +static struct string_list_item *lookup_one(struct string_list *map,
> +					   const char *string, size_t len)
> +{
> +	struct strbuf buf = STRBUF_INIT;
> +	struct string_list_item *item = lookup_prefix(map, string, len);
> +	if (item)
> +		return item;
> +
> +	hashed_form(&buf, &hash_algos[GIT_HASH_SHA256], string, len);
> +	item = lookup_prefix(map, buf.buf, buf.len);
> +	strbuf_release(&buf);
> +	return item;
> +}
> +
>   int map_user(struct string_list *map,
>   	     const char **email, size_t *emaillen,
>   	     const char **name, size_t *namelen)
> @@ -324,7 +359,7 @@ int map_user(struct string_list *map,
>   		 (int)*namelen, debug_str(*name),
>   		 (int)*emaillen, debug_str(*email));
>   
> -	item = lookup_prefix(map, *email, *emaillen);
> +	item = lookup_one(map, *email, *emaillen);
>   	if (item != NULL) {
>   		me = (struct mailmap_entry *)item->util;
>   		if (me->namemap.nr) {
> @@ -334,7 +369,7 @@ int map_user(struct string_list *map,
>   			 * simple entry.
>   			 */
>   			struct string_list_item *subitem;
> -			subitem = lookup_prefix(&me->namemap, *name, *namelen);
> +			subitem = lookup_one(&me->namemap, *name, *namelen);
>   			if (subitem)
>   				item = subitem;
>   		}
> diff --git a/t/t4203-mailmap.sh b/t/t4203-mailmap.sh
> index 586c3a86b1..794133ba5d 100755
> --- a/t/t4203-mailmap.sh
> +++ b/t/t4203-mailmap.sh
> @@ -62,6 +62,41 @@ test_expect_success 'check-mailmap --stdin arguments' '
>   	test_cmp expect actual
>   '
>   
> +test_expect_success 'hashed mailmap' '
> +	test_config mailmap.file ./hashed &&
> +	hashed_author_name="@sha256:$(printf "$GIT_AUTHOR_NAME" | test-tool sha256)" &&
> +	hashed_author_email="@sha256:$(printf "$GIT_AUTHOR_EMAIL" | test-tool sha256)" &&
> +	cat >expect <<-EOF &&
> +	$GIT_COMMITTER_NAME <$GIT_COMMITTER_EMAIL>
> +	EOF
> +
> +	cat >hashed <<-EOF &&
> +	$GIT_COMMITTER_NAME <$GIT_COMMITTER_EMAIL> $hashed_author_name <$GIT_AUTHOR_EMAIL>
> +	EOF
> +	git check-mailmap  "$GIT_AUTHOR_NAME <$GIT_AUTHOR_EMAIL>" >actual &&
> +	test_cmp expect actual &&
> +
> +	cat >hashed <<-EOF &&
> +	Wrong <wrong@example.org> $GIT_AUTHOR_NAME <$GIT_AUTHOR_EMAIL>
> +	$GIT_COMMITTER_NAME <$GIT_COMMITTER_EMAIL> $hashed_author_name <$GIT_AUTHOR_EMAIL>
> +	EOF
> +	# Check that we prefer literal matches over hashed names.
> +	git check-mailmap  "$hashed_author_name <$GIT_AUTHOR_EMAIL>" >actual &&
> +	test_cmp expect actual &&
> +
> +	cat >hashed <<-EOF &&
> +	$GIT_COMMITTER_NAME <$GIT_COMMITTER_EMAIL> $hashed_author_name <$hashed_author_email>
> +	EOF
> +	git check-mailmap  "$GIT_AUTHOR_NAME <$GIT_AUTHOR_EMAIL>" >actual &&
> +	test_cmp expect actual &&
> +
> +	cat >hashed <<-EOF &&
> +	$GIT_COMMITTER_NAME <$GIT_COMMITTER_EMAIL> <$hashed_author_email>
> +	EOF
> +	git check-mailmap  "$GIT_AUTHOR_NAME <$GIT_AUTHOR_EMAIL>" >actual &&
> +	test_cmp expect actual
> +'
> +
>   test_expect_success 'check-mailmap bogus contact' '
>   	test_must_fail git check-mailmap bogus
>   '
>