Audit of 627319a

internal/git/git.go

@@ -236,22 +236,23 @@ func SquashCommit(repo, worktree, target, message string, env []string, sign fun
 }
 
 func signCommit(repo, commit string, sign func(payload []byte) ([]byte, error)) (string, error) {
-	cmd := exec.Command("git", "cat-file", "commit", commit)
-	cmd.Dir = repo
-	payload, err := cmd.Output()
+	payload, stderr, code, err := runCodeInput(context.Background(), repo, nil, nil, "cat-file", "commit", commit)
 	if err != nil {
-		return "", fmt.Errorf("git cat-file commit %s: %w", commit, err)
+		return "", err
 	}
-	sig, err := sign(payload)
+	if code != 0 {
+		return "", fmt.Errorf("git cat-file commit %s: exit status %d: %s", commit, code, stderr)
+	}
+	sig, err := sign([]byte(payload))
 	if err != nil {
 		return "", fmt.Errorf("signing the commit: %w", err)
 	}
-	eoh := strings.Index(string(payload), "\n\n")
+	eoh := strings.Index(payload, "\n\n")
 	if eoh < 0 {
 		return "", fmt.Errorf("commit %s has no message", commit)
 	}
 	header := "gpgsig " + strings.ReplaceAll(strings.TrimSuffix(string(sig), "\n"), "\n", "\n ") + "\n"
-	signed := string(payload[:eoh+1]) + header + string(payload[eoh+1:])
+	signed := payload[:eoh+1] + header + payload[eoh+1:]
 	return runInput(repo, nil, signed, "hash-object", "-t", "commit", "-w", "--stdin")
 }
 
@@ -418,17 +419,19 @@ func runInput(dir string, env []string, input string, args ...string) (string, e
 	if code != 0 {
 		return "", fmt.Errorf("git %s: exit status %d: %s", strings.Join(args, " "), code, stderr)
 	}
-	return out, nil
+	return strings.TrimSpace(out), nil
 }
 
 func runCode(dir string, env []string, args ...string) (string, string, int, error) {
-	return runCodeInput(context.Background(), dir, env, nil, args...)
+	out, stderr, code, err := runCodeInput(context.Background(), dir, env, nil, args...)
+	return strings.TrimSpace(out), stderr, code, err
 }
 
 func runNetwork(ctx context.Context, dir string, args ...string) (string, string, int, error) {
 	ctx, cancel := context.WithTimeout(ctx, networkTimeout)
 	defer cancel()
-	return runCodeInput(ctx, dir, networkEnv, nil, args...)
+	out, stderr, code, err := runCodeInput(ctx, dir, networkEnv, nil, args...)
+	return strings.TrimSpace(out), stderr, code, err
 }
 
 func runCodeInput(ctx context.Context, dir string, env []string, stdin io.Reader, args ...string) (string, string, int, error) {
@@ -449,10 +452,10 @@ func runCodeInput(ctx context.Context, dir string, env []string, stdin io.Reader
 	}
 	exit := &exec.ExitError{}
 	if errors.As(err, &exit) {
-		return strings.TrimSpace(string(out)), strings.TrimSpace(stderr.String()), exit.ExitCode(), nil
+		return string(out), strings.TrimSpace(stderr.String()), exit.ExitCode(), nil
 	}
 	if err != nil {
 		return "", "", 0, fmt.Errorf("git %s: %w", strings.Join(args, " "), err)
 	}
-	return strings.TrimSpace(string(out)), strings.TrimSpace(stderr.String()), 0, nil
+	return string(out), strings.TrimSpace(stderr.String()), 0, nil
 }