Git

2899 readers

1 users here now

Git is a free and open source distributed version control system designed to handle everything from small to very large projects with speed and efficiency.

Resources

Rules

Follow programming.dev rules
Be excellent to each other, no hostility towards users for any reason
No spam of tools/companies/advertisements. It’s OK to post your own stuff part of the time, but the primary use of the community should not be self-promotion.

Git Logo by Jason Long is licensed under the Creative Commons Attribution 3.0 Unported License.

founded 1 year ago

MODERATORS

[email protected]

PSA: Git exposes timezone metadata (self.git)

submitted 2 months ago* (last edited 2 months ago) by Kalcifer to c/[email protected]

10 comments fedilink hide all child comments

Git records the local timezone when a commit is made [1]. Knowledge of the timezone in which a commit was made could be used as a bit of identifying information to de-anonymize the committer.

Setting one's timezone to UTC can help mitigate this issue [2][3] (though, ofc, one must still be wary of time-of-day commit patterns being used to deduce a timezone).

References

Git documentation. git-commit. "Date Formats: Git internal format". Accessed: 2024-08-31T07:52Z. https://git-scm.com/docs/git-commit#Documentation/git-commit.txt-Gitinternalformat.

It is <unix-timestamp> <time-zone-offset>, where <unix-timestamp> is the number of seconds since the UNIX epoch. <time-zone-offset> is a positive or negative offset from UTC. For example CET (which is 1 hour ahead of UTC) is +0100.
jthill. "How can I ignore committing timezone information in my commit?". Stack Overflow. Published: 2014-05-26T16:57:37Z. (Accessed: 2024-08-31T08:27Z). https://stackoverflow.com/questions/23874208/how-can-i-ignore-committing-timezone-information-in-my-commit#comment36750060_23874208.

to set the timezone for a specific command, say e.g. TZ=UTC git commit
Oliver. "How can I ignore committing timezone information in my commit?". Stack Overflow. Published: 2022-05-22T08:56:38Z (Accessed: 2024-08-31T08:30Z). https://stackoverflow.com/a/72336094/7934600
each commit Git stores a author date and a commit date. So you have to omit the timezone for both dates.

I solved this for my self with the help of the following Git alias:
```
[alias]
co = "!f() { \
    export GIT_AUTHOR_DATE=\"$(date -u +%Y-%m-%dT%H:%M:%S%z)\"; \
    export GIT_COMMITTER_DATE=\"$(date -u +%Y-%m-%dT%H:%M:%S%z)\"; \
    git commit $@; \
    git log -n 1 --pretty=\"Autor: %an <%ae> (%ai)\"; \
    git log -n 1 --pretty=\"Committer: %cn <%ce> (%ci)\"; \
}; f"
```

Cross-posts:

you are viewing a single comment's thread
view the rest of the comments

[–] Kalcifer 1 points 2 months ago

I can’t see any real reason for it to record this information

Considering what Git actually does from a technical standpoint (version control), other features like recording the times of commits, commit messages, commiter name, commiter email, etc. are all QoL additions to what I would view as the actual core protocol — version control. Tracking changes does not require any of this extra metadata.

your rough timezone is probably going to leak just from the fact that people generally don’t make commits in the middle of the night

Yeah, I did mention this.

If you want HN paranoia levels of anonymity you need to schedule your commits to be automatically pushed at exactly midnight UTC every day.

You could also schedule all commits to occur evenly spread out throughout the day. You'd probably also need some script to automatically update all of the dates of each commit when a new commit is made to ensure that they are spread evenly.