{"thread":{"id":"62858","subject":"\"dubious owner\" check not performed on linked worktrees","startedAt":"2025-01-26T23:53:19Z","lastAt":"2025-01-26T23:53:19Z","messageCount":1,"participants":["Antonio Russo"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"511217","messageId":"dbb37419-fad0-466b-b52a-bc1e3ad35506@aerusso.net","threadId":"62858","inReplyTo":null,"subject":"\"dubious owner\" check not performed on linked worktrees","fromName":"Antonio Russo","fromEmail":"aerusso@aerusso.net","sentAt":"2025-01-26T23:53:07Z","receivedAt":"2025-01-26T23:53:19Z","isPatch":false,"sender":{"key":"aerusso@aerusso.net","avatar":"https://avatars.githubusercontent.com/u/6502699?v=4"},"body":"Hello,\n\nRunning git 2.48.1 here. I just noticed that if you create a .git file\nreferencing another git repository, the ownership test is only performed\non the .git file, not the actual referenced git repository.\n\nE.g., put\n\ngitdir: /home/usera/gitrepo/.git/worktrees/another\n\nin /home/userb/gitrepo/.git\n\nThen git running as userb will happily accept usera's git repository\n(presumably exposing userb to whatever mischief that usera could inflict\nupon other users that motivated this restriction in the first place).\n\nAmusingly, git running as usera will refuse to look at its own repository,\nwhich I do believe make the most sense.\n\nThe presence of the a gitdir reference certifying the trustworthiness of\na targeted git repository sounds like it could be an interesting feature,\nbut I would prefer it be explicit, i.e., require the file to contents to be:\n\ngitdir: /home/usera/gitrepo/.git/worktrees/another\ntrust-other-user: <username>\n\nAt a minimum, I think probably more visibility of this behavior is warranted.\n\nBest,\nAntonio Russo\n"}]}