Use `git` directly to get branch or tag name
What the developer wrote
Authored by kdmukai
Use `git` directly to get branch or tag name
What changed, and why it matters
This commit removes a leftover debug print statement and changes how the software figures out its own version name by asking the Git tool directly instead of relying on a pre-existing file. The change itself is not a security fix, but it removes a minor information leak (the hostname) and avoids a build-time dependency on a generated file. There is no evidence this was reported as a security issue or credited to a researcher.
No urgent action is required. Reviewers may want to confirm that `os.popen` is replaced with `subprocess.run` with a fixed argument list for safer shell handling, and verify that the removed `print` was not relied upon for diagnostics.
Security signals we found
Removed debug print of Settings.HOSTNAME, reducing information disclosure
New os.popen call with hard-coded git command under __main__ block
No input from untrusted sources is passed to the shell command
Evidence from the diff
The diff removes print(f"{Settings.HOSTNAME=}") from Version._get_version() and adds a __main__ block that runs git branch --show-current (falling back to git describe --tags --abbrev=0) to populate version_name when writing version.json. The removed print could have exposed the configured hostname in logs or output during normal operation. The new code uses os.popen with a fixed, hard-coded Git command, so command-injection risk is minimal unless an attacker can already control the working directory’s Git metadata. The change is primarily a build/versioning robustness improvement, not a vulnerability patch.
Changed components
src/seedsigner/helpers/version.pyInspect captured patch +9 / −2
diff --git a/src/seedsigner/helpers/version.py b/src/seedsigner/helpers/version.py
index 834dc07..ee3c602 100644
--- a/src/seedsigner/helpers/version.py
+++ b/src/seedsigner/helpers/version.py
@@ -107,8 +107,6 @@ class Version:
if not version.startswith("v") and version.count(".") >= 1 and version.split(".")[0].isnumeric():
return f"v{version}"
return version
-
- print(f"{Settings.HOSTNAME=}")
if Settings.HOSTNAME == Settings.SEEDSIGNER_OS:
# The SeedSigner OS build process generates the version.json file for the tag,
@@ -206,6 +204,15 @@ if __name__ == "__main__":
except Exception as e:
raise Exception("Could not get last commit time from git log.") from e
+ try:
+ version_name = os.popen("git branch --show-current").read().strip()
+ if not version_name:
+ # If we're on a tag, there won't be a current branch. Instead, try to get the
+ # current tag.
+ version_name = os.popen("git describe --tags --abbrev=0").read().strip()
+ except Exception as e:
+ raise Exception("Could not get version name from git.") from e
+
version_file_path = Version._get_version_file_path()
with open(version_file_path, "w") as f:
json.dump(version_info, f, indent=4)
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.