Re: git safe.directory

[Mark Wielaard <mark@klomp.org>]

Hi,

On Sun, 2023-05-21 at 19:21 +0200, Mark Wielaard via Overseers wrote:
> Earlier this week git got upgraded on sourceware to include support
> for safe.directory. Joel noticed an issue with the gdbadmin cron job
> for the binutils-gdb.git repo. It would complain with:
> 
> fatal: detected dubious ownership in repository at
> '/sourceware1/projects/src-home/binutils-gdb.git'
> 
> Given this repo is shared between different projects and users it is
> "expected" that the git directory/config might be writable by someone
> else in this case. We believe that doing the following for the
> gdbadmin user is the appropriate workaround for now:
> 
>   git config --global --add safe.directory \
>     /sourceware1/projects/src-home/binutils-gdb.git
> 
> I looked over other repos, cron jobs and hooks, but couldn't find any
> other issue with this new "feature". The git operations executed on
> them either don't use the config file or the operations are only
> executed by the actual user "owning" the git repo config file.

I missed the gcc-wwwdocs post-receive hook.
Tobias noticed that commits don't update the website anymore.
And the /www/gcc/update.log do indeed contains:
fatal: detected dubious ownership in repository at
'/sourceware1/www/gcc/wwwdocs-checkout'

For now I have added as a workaround to /etc/gitconfig:

[safe]
	directory = /sourceware1/www/gcc/wwwdocs-checkout

Which should make it possible for anybody to run the post-receive hook
again. But I think it would be better if we change things so that only
gccadmin (who owns the wwwdocs-checkout repo) would do the updates
(from a cronjob?)

Note, I didn't try to replay the last few failing commits, so someone
should still do that to get the gcc.gnu.org website updated.

> But if you notice any 'detected dubious ownership' of any git
> operations please report and/or check the dir/config file ownership
> and/or add a 'safe.directory' workaround for the affected user.
> 
> Of course you can also move some operations to the separate
> snapshots.sourceware.org server if it doesn't require access to the
> repo directly.

Cheers,

Mark