Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generated lockfiles header has the full path location of pants exposing personal data #15740

Closed
jbasila-orca opened this issue Jun 3, 2022 · 2 comments
Labels

Comments

@jbasila-orca
Copy link
Contributor

This is more a privacy matter and security. The generated lock file contains in the header the location of the pants wrapper script that was used exposing the username and also the repository name

2.11.1rc2
but I think it has been like this for a long time

This was run on MacOS, but I think the same will happen on other platforms

@Eric-Arellano Eric-Arellano self-assigned this Jun 3, 2022
@Eric-Arellano
Copy link
Contributor

Hey @jbasila-orca , do you remember if you were using the standard ./pants script at the time, or a custom script like ./v2? I'm wondering if the option PANTS_BIN_NAME was set. By default, it should only say ./pants generate-lockfiles --resolve=<name>, and not include the full path.

asherf added a commit to asherf/pants that referenced this issue Aug 18, 2022
asherf added a commit to asherf/pants that referenced this issue Aug 18, 2022
asherf added a commit to asherf/pants that referenced this issue Aug 19, 2022
asherf added a commit to asherf/pants that referenced this issue Aug 19, 2022
asherf added a commit to asherf/pants that referenced this issue Aug 19, 2022
asherf added a commit to asherf/pants that referenced this issue Aug 19, 2022
@Eric-Arellano Eric-Arellano removed their assignment Dec 29, 2022
@jsirois
Copy link
Contributor

jsirois commented Feb 9, 2023

Although this was the original, I'll close as a duplicate of #18202 since it has more and more modern context.

@jsirois jsirois closed this as completed Feb 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants