It occurred to me that cvs might be running as "bernie", but I can find nothing which would execute /usr/bin/cvs as "bernie". I checked file ownerships, setuid, /etc/pam.d, etc.

Even stranger getpwuid($<) returns the correct UID, and so does $ENV{USER}. I added a statemt to print to a log below, which produces output like this:

user = bartonbf, pwuid = john01, ENV{USER} = john01

sub attach {
    boundary(@_);
    # Get the date (UTC).
    my @gm = gmtime;
    $gm[5] += 1900;
    $gm[4] += 1;

    # Get the username.
    my $user = getlogin || getpwuid($<) || "unknown";


my $pwuid = getpwuid($<);
open LOG, ">>/tmp/bblog";
print LOG "user = $user, pwuid = $pwuid, ENV{USER} = $ENV{USER}\n";
close LOG;

    # Return the attachment headers.
    local $" = '';
    return qq{

--$opt_a
Content-Disposition: attachment; filename=$user-@gm[5,4,3,2,1,0]-diff.
+txt
Content-Transfer-Encoding: 8bit
Content-Type: text/plain; charset=$opt_C

};
}
[download]