Harden release source execution

tools/release/govoplan_release/publisher.py

@@ -1024,11 +1024,18 @@ def publication_runtime_trust_issues() -> tuple[str, ...]:
         ancestor_issue = _operator_controlled_ancestor_issue(path)
         if ancestor_issue:
             return (f"{label}: {ancestor_issue}",)
-    executable_issue = _trusted_runtime_executable_issue(
-        Path(sys.executable), permitted_owners=runtime_owners
-    )
-    if executable_issue:
-        return (executable_issue,)
+    for executable, label in (
+        (Path(sys.executable), "Python executable"),
+        (Path("/usr/bin/git"), "Git executable"),
+        (Path("/usr/bin/ssh"), "SSH executable"),
+    ):
+        executable_issue = _trusted_runtime_executable_issue(
+            executable,
+            permitted_owners=runtime_owners,
+            label=label,
+        )
+        if executable_issue:
+            return (executable_issue,)
     required = (
         (META_ROOT, True, "meta repository root"),
         (META_ROOT / "repositories.json", False, "repository registry"),
@@ -1093,32 +1100,32 @@ def _loaded_package_root(module: object, *, label: str) -> Path:
 
 
 def _trusted_runtime_executable_issue(
-    path: Path, *, permitted_owners: set[int]
+    path: Path, *, permitted_owners: set[int], label: str = "Python executable"
 ) -> str | None:
     executable = path.absolute()
     ancestor_issue = _operator_controlled_ancestor_issue(executable.parent)
     if ancestor_issue:
-        return f"Python executable: {ancestor_issue}"
+        return f"{label}: {ancestor_issue}"
     try:
         link_metadata = executable.lstat()
     except OSError:
-        return f"Python executable cannot be inspected safely: {executable}"
+        return f"{label} cannot be inspected safely: {executable}"
     if stat.S_ISLNK(link_metadata.st_mode):
         if link_metadata.st_uid not in permitted_owners:
-            return f"Python executable symlink has an untrusted owner: {executable}"
+            return f"{label} symlink has an untrusted owner: {executable}"
         try:
             target = executable.resolve(strict=True)
         except OSError:
-            return f"Python executable symlink cannot be resolved safely: {executable}"
+            return f"{label} symlink cannot be resolved safely: {executable}"
     else:
         target = executable
     ancestor_issue = _operator_controlled_ancestor_issue(target.parent)
     if ancestor_issue:
-        return f"Python executable target: {ancestor_issue}"
+        return f"{label} target: {ancestor_issue}"
     return _operator_control_issue(
         target,
         directory=False,
-        label="Python executable target",
+        label=f"{label} target",
         permitted_owners=permitted_owners,
     )
 
@@ -1866,7 +1873,9 @@ def _sanitized_git_environment(
 
     source = base if base is not None else os.environ
     environment = {
-        key: value for key, value in source.items() if not key.startswith("GIT_")
+        key: source[key]
+        for key in ("HOME", "LANG", "LC_ALL", "LC_CTYPE", "SSH_AUTH_SOCK")
+        if source.get(key)
     }
     environment.update(
         {
@@ -1875,7 +1884,9 @@ def _sanitized_git_environment(
             "GIT_CONFIG_NOSYSTEM": "1",
             "GIT_NO_REPLACE_OBJECTS": "1",
             "GIT_PAGER": "cat",
+            "GIT_SSH_COMMAND": "/usr/bin/ssh -o BatchMode=yes -o ConnectTimeout=8",
             "GIT_TERMINAL_PROMPT": "0",
+            "PATH": "/usr/bin:/bin",
         }
     )
     if isolate_config:
@@ -1911,7 +1922,7 @@ def _git_bytes(
     )
     result = subprocess.run(
         [
-            "git",
+            "/usr/bin/git",
             "-C",
             str(path),
             "-c",