{"thread":{"id":"63385","subject":"bugreport - cannot clone repo over ssh which I don't own","startedAt":"2025-05-02T22:07:53Z","lastAt":"2025-05-03T00:49:09Z","messageCount":2,"participants":["Matthias vom Bruch","brian m. carlson"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"517135","messageId":"dcf355a7-cbeb-4162-82a9-5486d3ce3166@gmx.de","threadId":"63385","inReplyTo":null,"subject":"bugreport - cannot clone repo over ssh which I don't own","fromName":"Matthias vom Bruch","fromEmail":"matthias.vombruch@gmx.de","sentAt":"2025-05-02T22:07:51Z","receivedAt":"2025-05-02T22:07:53Z","isPatch":false,"sender":{"key":"matthias.vombruch@gmx.de","avatar":null},"body":"Thank you for filling out a Git bug report!\nPlease answer the following questions to help us understand your issue.\n\nWhat did you do before the bug happened? (Steps to reproduce your issue)\n\nCreate a repository, rsync it to my homelab server, place into a \ndirectory that is owned by a:a_and_b and has -R file mod of 770. Then \ncloned that\ninto a new, bare repository with the same name, say on \n/path/to/bare_repo. Then I prepared ssh auth via key on new machine, so \nthat user b can lo\ng in to homelab without password. Then tried to clone the repository \nwith `git clone b@local-name:/path/to/bare_repo` and variations \nprepending `s\nsh://` and appending `/.git`. Got error\n\nfatal: detected dubious ownership in repository at '/path/to/bare_repo'\nTo add an exception for this directory, call:\n    git config --global --add safe.directory /path/to/bare_repo\n[The following is a rough translation, as the machine is in German and \nso was this message]\nfatal: could not read from remote repository\n\nPlease ensure that you have the correct access rights\nand the repository exists\n\nI then execute the command it suggests and confirm that the appropriate \nline has been added to my git config\n\nRetry - same error\n\nTest if there is actually a problem with access rights by copying the \nrepository with `rsync -r b@local-name:/path/to/bare_repo ./`. No issue, eve\nrything gets copied\n\nWhat did you expect to happen? (Expected behavior)\n\nFirstly, no issue at all, as cloning from a remote (bare) repository \nthat _isn't owned by me_ seems like standard usage of git. People are \nbound t\no run into this in projects of more than one person, unless they use the \nmore elaborate implementations of vendors like github. My understanding w\nould be that this is how git should \"naturally\" work.\n\nThen, the error being fixed after I apply the command it suggested.\n\nWhat happened instead? (Actual behavior)\nUnable to interact with repository unless I change ownership of the \nremote to exactly the user that is used for cloning over ssh.\n\nWhat's different between what you expected and what actually happened?\nIt cannot be made to work\n\nAnything else you want to add:\nThis report is made from a different machine that runs a very similar OS \n(NixOS 25.11).\n\nPlease review the rest of the bug report below.\nYou can delete any lines you don't wish to share.\n\n\n[System Info]\ngit version:\ngit version 2.47.2\ncpu: x86_64\nno commit associated with this build\nsizeof-long: 8\nsizeof-size_t: 8\nshell-path: \n/nix/store/gwgqdl0242ymlikq9s9s62gkp5cvyal3-bash-5.2p37/bin/bash\nlibcurl: 8.11.1\nOpenSSL: OpenSSL 3.3.2 3 Sep 2024\nzlib: 1.3.1\nuname: Linux 6.6.32 #1-NixOS SMP PREEMPT_DYNAMIC Sat May 25 14:22:56 UTC \n2024 x86_64\ncompiler info: gnuc: 13.3\nlibc info: glibc: 2.40\n$SHELL (typically, interactive shell): /run/current-system/sw/bin/fish\n\n\n[Enabled Hooks]\nnot run from a git repository - no hooks to show\n"},{"id":"517147","messageId":"aBVn_abDjpZFk41p@tapette.crustytoothpaste.net","threadId":"63385","inReplyTo":"dcf355a7-cbeb-4162-82a9-5486d3ce3166@gmx.de","subject":"Re: bugreport - cannot clone repo over ssh which I don't own","fromName":"brian m. carlson","fromEmail":"sandals@crustytoothpaste.net","sentAt":"2025-05-03T00:49:01Z","receivedAt":"2025-05-03T00:49:09Z","isPatch":false,"sender":{"key":"sandals@crustytoothpaste.net","avatar":"https://avatars.githubusercontent.com/u/497054?v=4"},"body":"On 2025-05-02 at 22:07:51, Matthias vom Bruch wrote:\n> Thank you for filling out a Git bug report!\n> Please answer the following questions to help us understand your issue.\n> \n> What did you do before the bug happened? (Steps to reproduce your issue)\n> \n> Create a repository, rsync it to my homelab server, place into a directory\n> that is owned by a:a_and_b and has -R file mod of 770. Then cloned that\n> into a new, bare repository with the same name, say on /path/to/bare_repo.\n> Then I prepared ssh auth via key on new machine, so that user b can lo\n> g in to homelab without password. Then tried to clone the repository with\n> `git clone b@local-name:/path/to/bare_repo` and variations prepending `s\n> sh://` and appending `/.git`. Got error\n> \n> fatal: detected dubious ownership in repository at '/path/to/bare_repo'\n> To add an exception for this directory, call:\n>    git config --global --add safe.directory /path/to/bare_repo\n> [The following is a rough translation, as the machine is in German and so\n> was this message]\n> fatal: could not read from remote repository\n> \n> Please ensure that you have the correct access rights\n> and the repository exists\n> \n> I then execute the command it suggests and confirm that the appropriate line\n> has been added to my git config\n> \n> Retry - same error\n> \n> Test if there is actually a problem with access rights by copying the\n> repository with `rsync -r b@local-name:/path/to/bare_repo ./`. No issue, eve\n> rything gets copied\n> \n> What did you expect to happen? (Expected behavior)\n> \n> Firstly, no issue at all, as cloning from a remote (bare) repository that\n> _isn't owned by me_ seems like standard usage of git. People are bound t\n> o run into this in projects of more than one person, unless they use the\n> more elaborate implementations of vendors like github. My understanding w\n> ould be that this is how git should \"naturally\" work.\n> \n> Then, the error being fixed after I apply the command it suggested.\n\nCan you retry this with Git 2.48 or newer on the server?  There's a\npatch in that version that should allow cloning from an untrusted\nrepository.\n\nNote that if you're cloning on the local system, you will need to use\n`--no-local`, as documented in that version.  That isn't necessary over\nthe network, though.\n-- \nbrian m. carlson (they/them)\nToronto, Ontario, CA\n"}]}