Use SeedSigner OS env var; enforce utc time
What the developer wrote
Authored by kdmukai
Use SeedSigner OS env var; enforce utc time
What changed, and why it matters
This commit changes how SeedSigner records its software version and build timestamp. It now reads a version name from an environment variable used by SeedSigner OS and forces the last-edit timestamp to UTC. These are build-process improvements, not fixes for an active security vulnerability. The only security-relevant aspect is a small hardening of how external shell commands and environment input are handled.
No urgent action. Treat as routine build-hardening. If reviewing further, verify that SEEDSIGNER_VERSION_NAME is set only by a trusted build environment and that the value is sanitized before being written to the version JSON file.
Security signals we found
Build metadata now normalized to UTC, reducing timezone ambiguity in version files
Version name can now be injected via SEEDSIGNER_VERSION_NAME environment variable
Continued use of os.popen with git commands, though input is read-only and not user-controlled in the shown path
Evidence from the diff
The patch modifies src/seedsigner/helpers/version.py. It imports timezone and converts the git commit timestamp to UTC before stripping the timezone offset. It also changes version-name detection to prefer the SEEDSIGNER_VERSION_NAME environment variable, falling back to git branch/tag detection. The code still uses os.popen for shell commands. There is no direct memory-safety, cryptographic, or authentication bug visible in the diff.
Changed components
src/seedsigner/helpers/version.pyInspect captured patch +14 / −7
diff --git a/src/seedsigner/helpers/version.py b/src/seedsigner/helpers/version.py
index ee3c602..6e65ca8 100644
--- a/src/seedsigner/helpers/version.py
+++ b/src/seedsigner/helpers/version.py
@@ -1,7 +1,7 @@
import json
import logging
import os
-from datetime import datetime
+from datetime import datetime, timezone
from seedsigner.models.settings import Settings
@@ -200,18 +200,25 @@ if __name__ == "__main__":
# Run `git log` in the shell to get the last commit time
try:
last_commit = os.popen("git log -1 --format=%cI").read().strip()
- version_info["last_src_edit"] = last_commit
+ # Parse the timestamp, ensure that it's in UTC, and omit tz info
+ version_info["last_src_edit"] = datetime.fromisoformat(last_commit).astimezone(timezone.utc).replace(tzinfo=None).isoformat()
except Exception as e:
raise Exception("Could not get last commit time from git log.") from e
try:
- version_name = os.popen("git branch --show-current").read().strip()
+ version_name = None
+
+ # If we're currently building SeedSigner OS, check the env var
+ version_name = os.getenv("SEEDSIGNER_VERSION_NAME")
+
if not version_name:
- # If we're on a tag, there won't be a current branch. Instead, try to get the
- # current tag.
- version_name = os.popen("git describe --tags --abbrev=0").read().strip()
+ version_name = os.popen("git branch --show-current").read().strip()
+ if not version_name:
+ # If we're on a tag, there won't be a current branch. Instead, try to get the
+ # current tag.
+ version_name = os.popen("git describe --tags --abbrev=0").read().strip()
except Exception as e:
- raise Exception("Could not get version name from git.") from e
+ raise Exception("Could not get version name from SeedSigner OS env var nor git.") from e
version_file_path = Version._get_version_file_path()
with open(version_file_path, "w") as f:
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.