{"thread":{"id":"63278","subject":"'safe.directory' setting ignored for some operations?","startedAt":"2025-04-10T13:21:39Z","lastAt":"2025-04-11T08:18:37Z","messageCount":6,"participants":["Nikolaus Rath","Jeff King","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"515958","messageId":"CAPzgaL1NH_GofMko6f2Auz4e1TjTJNH0w4-ph8np04QRfT_R7A@mail.gmail.com","threadId":"63278","inReplyTo":"CAPzgaL2Q4v0LMSek=osugTDCDww9D-Tg+tDsFhFvRSVXFR8g6Q@mail.gmail.com","subject":"'safe.directory' setting ignored for some operations?","fromName":"Nikolaus Rath","fromEmail":"nikolaus@quadrature.ai","sentAt":"2025-04-10T13:21:01Z","receivedAt":"2025-04-10T13:21:39Z","isPatch":false,"sender":{"key":"nikolaus@quadrature.ai","avatar":null},"body":"Hello,\n\nIt seems to me that the 'safe.directory = *' option is ignored for\nsome operations:\n\n---snip--\n$ git --version\ngit version 2.43.0\n\n$ git config --get-all --show-scope safe.directory\ncommand *\n\n$ git status -v --untracked=all --ignored\nHEAD detached at e116555\n[...]\nnothing to commit, working tree clean\n\n$ git clone -v --no-checkout --\n/builds/coreinfra/grafana_terraform/.git\n/builds/coreinfra/grafana_terraform/tmpus18hzbs\nCloning into '/builds/coreinfra/grafana_terraform/tmpus18hzbs'...\nfatal: detected dubious ownership in repository at\n'/builds/coreinfra/grafana_terraform/.git'\nTo add an exception for this directory, call:\n\ngit config --global --add safe.directory\n/builds/coreinfra/grafana_terraform/.git\nfatal: Could not read from remote repository.\n\nPlease make sure you have the correct access rights\nand the repository exists.\n---snip--\n\n\nIs this a known issue, or working as intended?\n\n(Without setting safe.directory, both `git status` and `git clone`\nfail as expected).\n\nBest,\n-Nikolaus\n\n-- \nnikolaus@quadrature.ai\nhttps://quadrature.ai\nDir: +44-20-8145-4726 Main: +44-20-3743-0400\nThe Leadenhall Building, 122 Leadenhall Street, London, EC3V 4AB\n"},{"id":"515969","messageId":"20250410213542.GA3168175@coredump.intra.peff.net","threadId":"63278","inReplyTo":"CAPzgaL1NH_GofMko6f2Auz4e1TjTJNH0w4-ph8np04QRfT_R7A@mail.gmail.com","subject":"Re: 'safe.directory' setting ignored for some operations?","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2025-04-10T21:35:42Z","receivedAt":"2025-04-10T21:35:49Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Thu, Apr 10, 2025 at 02:21:01PM +0100, Nikolaus Rath wrote:\n\n> It seems to me that the 'safe.directory = *' option is ignored for\n> some operations:\n> \n> ---snip--\n> $ git --version\n> git version 2.43.0\n> \n> $ git config --get-all --show-scope safe.directory\n> command *\n\nYou're getting \"command\" here, but I don't see any \"-c\". Presumably\nyou're setting GIT_CONFIG_* in the environment yourself?\n\n> $ git status -v --untracked=all --ignored\n> HEAD detached at e116555\n> [...]\n> nothing to commit, working tree clean\n\nYou don't show us the repo here, but presumably this is one you don't\nown, and the config is working as expected to allow the operation to\nproceed.\n\n> $ git clone -v --no-checkout --\n> /builds/coreinfra/grafana_terraform/.git\n> /builds/coreinfra/grafana_terraform/tmpus18hzbs\n> Cloning into '/builds/coreinfra/grafana_terraform/tmpus18hzbs'...\n> fatal: detected dubious ownership in repository at\n> '/builds/coreinfra/grafana_terraform/.git'\n> To add an exception for this directory, call:\n> \n> git config --global --add safe.directory\n> /builds/coreinfra/grafana_terraform/.git\n> fatal: Could not read from remote repository.\n> \n> Please make sure you have the correct access rights\n> and the repository exists.\n\nHere you are running afoul of the environment-clearing that happens when\nGit internally \"switches\" to another repo. The \"clone\" command is run in\nyour newly-made repo (which is \"safe\"), but it would then run\n\"git-upload-pack\" in the remote repo to act as the server side. We clear\nout many Git-related environment variables when switching between\nvariables, including GIT_CONFIG_*.\n\n  Side note: clearing out the config has been a subject of debate over\n  the years, but one of the main reasons we do it is to be consistent\n  with non-local transports, which do not pass environment variables at\n  all. Which is good for some config, but can be annoying for others, as\n  seen here.\n\nSo I think things are working as intended. You can get around it with\neither of these:\n\n  - set the config in your user ~/.gitconfig, which will be read by the\n    child upload-pack command\n\n  - tell clone to pass the config to upload-pack, like:\n\n     git clone -u 'git -c safe.directory=\"*\" upload-pack' ...\n\n-Peff\n"},{"id":"515972","messageId":"Z_hCjfoRUIDZoBfP@tapette.crustytoothpaste.net","threadId":"63278","inReplyTo":"20250410213542.GA3168175@coredump.intra.peff.net","subject":"Re: 'safe.directory' setting ignored for some operations?","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2025-04-10T22:13:33Z","receivedAt":"2025-04-10T22:13:35Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2025-04-10 at 21:35:42, Jeff King wrote:\n> So I think things are working as intended. You can get around it with\n> either of these:\n> \n>   - set the config in your user ~/.gitconfig, which will be read by the\n>     child upload-pack command\n> \n>   - tell clone to pass the config to upload-pack, like:\n> \n>      git clone -u 'git -c safe.directory=\"*\" upload-pack' ...\n\nI think you can also use `git clone --no-local` in a more recent version\nand the normal clone-from-untrusted-repository semantics will kick in\nand things will work.\n-- \nbrian m. carlson (they/them)\nToronto, Ontario, CA\n"},{"id":"515973","messageId":"20250410224223.GA3191424@coredump.intra.peff.net","threadId":"63278","inReplyTo":"Z_hCjfoRUIDZoBfP@tapette.crustytoothpaste.net","subject":"Re: 'safe.directory' setting ignored for some operations?","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2025-04-10T22:42:23Z","receivedAt":"2025-04-10T22:42:24Z","isPatch":false,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Thu, Apr 10, 2025 at 10:13:33PM +0000, brian m. carlson wrote:\n\n> On 2025-04-10 at 21:35:42, Jeff King wrote:\n> > So I think things are working as intended. You can get around it with\n> > either of these:\n> > \n> >   - set the config in your user ~/.gitconfig, which will be read by the\n> >     child upload-pack command\n> > \n> >   - tell clone to pass the config to upload-pack, like:\n> > \n> >      git clone -u 'git -c safe.directory=\"*\" upload-pack' ...\n> \n> I think you can also use `git clone --no-local` in a more recent version\n> and the normal clone-from-untrusted-repository semantics will kick in\n> and things will work.\n\nYeah, that's true in v2.48.0 and later. (I tried it after writing the\nearlier email and was a little puzzled that it works with --no-local but\nnot otherwise, but it sounds like that's known).\n\n-Peff\n"},{"id":"515974","messageId":"Z_hmnPoPjXQm6lyP@tapette.crustytoothpaste.net","threadId":"63278","inReplyTo":"20250410224223.GA3191424@coredump.intra.peff.net","subject":"Re: 'safe.directory' setting ignored for some operations?","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2025-04-11T00:47:24Z","receivedAt":"2025-04-11T00:47:32Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2025-04-10 at 22:42:23, Jeff King wrote:\n> Yeah, that's true in v2.48.0 and later. (I tried it after writing the\n> earlier email and was a little puzzled that it works with --no-local but\n> not otherwise, but it sounds like that's known).\n\nIt is.  The reason for that is that we try to hardlink if `--no-local`\nis not provided, which has all the normal security concerns across\nownership boundaries.  However, `--no-local` uses the normal\n`git-upload-pack` mechanism, which we know is secure on untrusted\nrepositories.\n\nOne thing we could do to improve things is detect if the repository is\nowned by another user and just set `--no-local` automatically, but\nthat's a #leftoverbits for someone.\n-- \nbrian m. carlson (they/them)\nToronto, Ontario, CA\n"},{"id":"515975","messageId":"CAPzgaL3tYJay9P_VvuqSKRuta8FFgn=xc7P=2t3MFukbobiFOw@mail.gmail.com","threadId":"63278","inReplyTo":"20250410213542.GA3168175@coredump.intra.peff.net","subject":"Re: 'safe.directory' setting ignored for some operations?","fromName":"Nikolaus Rath","fromEmail":"nikolaus@quadrature.ai","sentAt":"2025-04-11T08:17:59Z","receivedAt":"2025-04-11T08:18:37Z","isPatch":false,"sender":{"key":"nikolaus@quadrature.ai","avatar":null},"body":"On Thu, 10 Apr 2025 at 22:35, Jeff King <peff@peff.net> wrote:\n>\n> On Thu, Apr 10, 2025 at 02:21:01PM +0100, Nikolaus Rath wrote:\n>\n> > It seems to me that the 'safe.directory = *' option is ignored for\n> > some operations:\n> >\n> > ---snip--\n> > $ git --version\n> > git version 2.43.0\n> >\n> > $ git config --get-all --show-scope safe.directory\n> > command *\n>\n> You're getting \"command\" here, but I don't see any \"-c\". Presumably\n> you're setting GIT_CONFIG_* in the environment yourself?\n\n\nYes.\n\n>\n> > $ git status -v --untracked=all --ignored\n> > HEAD detached at e116555\n> > [...]\n> > nothing to commit, working tree clean\n>\n> You don't show us the repo here, but presumably this is one you don't\n> own, and the config is working as expected to allow the operation to\n> proceed.\n\n\nExactly.\n\n>\n> > $ git clone -v --no-checkout --\n> > /builds/coreinfra/grafana_terraform/.git\n> > /builds/coreinfra/grafana_terraform/tmpus18hzbs\n> > Cloning into '/builds/coreinfra/grafana_terraform/tmpus18hzbs'...\n> > fatal: detected dubious ownership in repository at\n> > '/builds/coreinfra/grafana_terraform/.git'\n> > To add an exception for this directory, call:\n> >\n> > git config --global --add safe.directory\n> > /builds/coreinfra/grafana_terraform/.git\n> > fatal: Could not read from remote repository.\n> >\n> > Please make sure you have the correct access rights\n> > and the repository exists.\n>\n> Here you are running afoul of the environment-clearing that happens when\n> Git internally \"switches\" to another repo. The \"clone\" command is run in\n> your newly-made repo (which is \"safe\"), but it would then run\n> \"git-upload-pack\" in the remote repo to act as the server side. We clear\n> out many Git-related environment variables when switching between\n> variables, including GIT_CONFIG_*.\n\n\nAh, that explains it indeed. Thank you very much! And apologies for\nnot being fully clear about the context.\n\nBest,\n-Nikolaus\n\n-- \nnikolaus@quadrature.ai\n\nhttps://quadrature.ai\nDir: +44-20-8145-4726 Main: +44-20-3743-0400\nThe Leadenhall Building, 122 Leadenhall Street, London, EC3V 4AB\n"}]}