{"thread":{"id":"61543","subject":"dubious permissions on shared repositorys as of 2.45.1","startedAt":"2024-05-24T17:06:30Z","lastAt":"2024-05-24T17:06:30Z","messageCount":1,"participants":["John Heidemann"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"495578","messageId":"924426.1716570031@dash.ant.isi.edu","threadId":"61543","inReplyTo":null,"subject":"dubious permissions on shared repositorys as of 2.45.1","fromName":"John Heidemann","fromEmail":"johnh@isi.edu","sentAt":"2024-05-24T17:00:31Z","receivedAt":"2024-05-24T17:06:30Z","isPatch":false,"sender":{"key":"johnh@isi.edu","avatar":null},"body":"Since upgrading to git-core-2.45.1-1.fc39 (in Fedora 39),\npushing to a remote server (so one is on another computer,\nin a copy shecked out with\nssh://server.example.com/home/commonuser/bare_repo.git )\nwhere the repo is shared (core.sharedRepo 1)\nand owned by someone else (say, the user is \"me\", but the directory is\nowned by \"originalauthor\") throws the error:\n\n    fatal: detected dubious ownership in repository at '/home/commonuser/bare_repo.git'\n    To add an exception for this directory, call:\n    \n    \tgit config --global --add safe.directory /home/commonuser/bare_repo.git\n    fatal: Could not read from remote repository.\n    \n    Please make sure you have the correct access rights\n    and the repository exists.\n\nOn one hand, this message is correct:\nthe directory IS owned by someone else (\"originalauthor\", not \"me\").\nAnd the suggested fix works, when it is run on the server.\n\n\nBut this error is new... it didn't happen last week, when the server was\nrunning, I think  git-core-2.44.1-1.fc39.  It definitely didn't happen\nwith the git that shipped with Fedora 39, which was git-core-2.41.0-2.fc39\n\nAnd since it's a shared repo (the server side git is config'ed\ncore.sharedRepo 1), we *intend* to have multiple people writing it,\nusing unix accounts and groups for access control.\n\nBecause multiple people write to it cannot be the case that all users\nown the git repo on the server.  That's the intended behavior!\n\nBut now, to push to it, each user has to run the safe.directory config\n(a new requirement).\n\nTo make matters worse, they have to run it on the server (not just\ntheir laptop, since there they are already owner of all the files and\ndirectories).  It's not very obvious where one should run it.  (Most\nother server-side messages, such as those from hooks on the server,\nhave the prefix \"remote:\"  on the client.)\n\n\nI suspect this problem occurs for my use case and not for other people\nbecause often git users pushing to a remote repo push to a single user\n(say, gitlab or gitea or something) and use ssh to map from the\nclient-side user to the common user.  In this case, the remote git repo\nis owned by one userid, and is probably not marked core.sharedRepo).\n\nI suggest that the check for \"does user own the repo directory\" be\nskipped if the repo is marked core.sharedRepo.\n\nI suggest this is a bug and not just tigher security because (a) this\nwarning is new.  I think since 2.44.) and (b) how else is a sharedRepo\nsupposed to work?!?\n\nIf you disagree and want to keep the current behavior, it would be great\nif the warning message could indicate it needs to run on the remote\nside.\n\n(I tried looking at diff from 2.44.1 vs. 2.45.1, and from 2.41.1\nvs. 2.45.1.  I found the checks for \"dubious ownership\", but it was not\nobvious what had changed.)\n\nThanks,\n   -John Heidemann\n\n\n\n"}]}