Improving support for name changes in git

[Bran Hagger <brhagger@microsoft.com>]

Hello Git community,

I'm interested in volunteering to help improve the process for users changing their name in Git.

I've seen the notes from the Git summit[1] and the old proposal to change the .mailmap to use hashes instead of plaintext names[2]. The problem with both approaches is that it is easy for other users to figure out the old name, which is a privacy concern for many people who change their names. Since the reverse of the hashes in the second case can be easily brute-forced, using hashes in the .mailmap provides no additional protection.

A system that prevents people from reverse-engineering the old name of a user who changes their name would require two key components:

1. The method of determining the current name of the author of a git commit can not rely on any information derived from their old name.
2. The mapping to the current name of the author of a git commit can not contain any history.

Solving the first problem seems reasonably doable. Instead of each commit having an author name and email, the author section could contain a hash that is used for the mapping. To maintain compatibility with older versions of git, the format could look something like:
Author: Hash #user.idHash <email@lookIn.newMailmap>​
With the user.idHash is a randomly generated number set in the .gitconfig the same way user.name and user.email currently are. A .newMailmap file (or whatever name we choose to give it) would then map from user id hashes to user names and emails.

The second problem of how to maintain a mapping of user.idHash without history is a radical departure from how git currently works. While handling such a file on the client side is probably not too technically complicated, it raises several questions:

* How can a git repository accept changes and protect against malicious actors modifying the .newMailmap file (or however we choose to name it)? Making pull requests to modify the file and keeping those pull requests around recreates the old issue of having a record of every name change.
* How are merge conflicts handled?
* How do we ensure users can only set the name and email for their own hashes? If the commits are signed this could be done via signing verification, but my understanding is that signing commits is relatively rare.

Has there been any further work done on supporting git name changes that I missed? Are there any existing files without git history that face similar issues?

[1] https://code.googlesource.com/git/summit/2020/+/main/notes.md
[2] https://lore.kernel.org/git/20210103211849.2691287-1-sandals@crustytoothpaste.net/

Thank you,
Bran (he/him)

P.S. Apologies for potentially double-sending this. My email client accidentally added HTML to the first copy.