Git records the local timezone when a commit is made [1]. Knowledge of the timezone in which a commit was made could be used as a bit of identifying information to de-anonymize the committer.
Setting one's timezone to UTC can help mitigate this issue [2][3] (though, ofc, one must still be wary of time-of-day commit patterns being used to deduce a timezone).
References
- Git documentation. git-commit. "Date Formats: Git internal format". Accessed: 2024-08-31T07:52Z. https://git-scm.com/docs/git-commit#Documentation/git-commit.txt-Gitinternalformat.
It is
<unix-timestamp> <time-zone-offset>, where<unix-timestamp>is the number of seconds since the UNIX epoch.<time-zone-offset>is a positive or negative offset from UTC. For example CET (which is 1 hour ahead of UTC) is+0100. - jthill. "How can I ignore committing timezone information in my commit?". Stack Overflow. Published: 2014-05-26T16:57:37Z. (Accessed: 2024-08-31T08:27Z). https://stackoverflow.com/questions/23874208/how-can-i-ignore-committing-timezone-information-in-my-commit#comment36750060_23874208.
to set the timezone for a specific command, say e.g.
TZ=UTC git commit - Oliver. "How can I ignore committing timezone information in my commit?". Stack Overflow. Published: 2022-05-22T08:56:38Z (Accessed: 2024-08-31T08:30Z). https://stackoverflow.com/a/72336094/7934600
each commit Git stores a author date and a commit date. So you have to omit the timezone for both dates.
I solved this for my self with the help of the following Git alias:
[alias] co = "!f() { \ export GIT_AUTHOR_DATE=\"$(date -u +%Y-%m-%dT%H:%M:%S%z)\"; \ export GIT_COMMITTER_DATE=\"$(date -u +%Y-%m-%dT%H:%M:%S%z)\"; \ git commit $@; \ git log -n 1 --pretty=\"Autor: %an <%ae> (%ai)\"; \ git log -n 1 --pretty=\"Committer: %cn <%ce> (%ci)\"; \ }; f"
Cross-posts:
The only time I came across this subject was when there were malicious commits in a code base. When else would this matter? The commit contains your name and email address. Who cares about time zone? Just as anything in a commit, these metadata can be freely manipulated and serve purely as information for other developers. Who are you scared of seeing your time zone in a commit on a seemingly public code repository? This is such a pointless non-discovery
That is a bit of identifying, yes, but, arguably, not as personally identifying as a timezone. Furthermore, the manual nature of entering a username and email puts the agency on the person to choose how they wish that commit to be identified, but the time is generally chosen automatically. Unless one is paying close attention to the commit log, it's likely that many wouldn't notice the timezone. It's also possible, and completely forgivable, imo, for one to assume that the timezone is only shown client-side, and isn't actually recorded; it is only when one looks at the documentation that they will see that the timezone is indeed recorded.
This is essentially what I am advocating for if one is trying to improve the privacy of their Git contributions.
Be careful about forming arguments from ignorance.