git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1

From
DRDavid C. Rankin <drankinatty@gmail.com>
Date
Jun 17, 2024, 00:36 UTC
Message-ID
<d9a83e5b-5075-47c6-85c8-e0b550cf859b@gmail.com>
All,
   Security enhancement in 2.45.1 have broken ability to serve git over https 
and ssh from local git server running Apache. (web server runs as http:http on 
Archlinux)
   The fix of adding the following to gitconfig (system-wide and per-user in 
~/.gitconfig) does not solve the problem:
[safe]
	directory = *
(* or the actual /srv/git/reponame.git makes no difference)
   On Archlinux, all repos are served from /srv/git. This has worked well for 
both https and ssh allowing repos under /srv/git to be owned by the user with 
public-private ssh key. (they are members of group owning /srv/git with write 
privileges)
   After 2.45.1,
   - git will not allow https unless the repositories are OWNED by http.
   - git will not allow ssh   unless the repositories are OWNED by user.
   A catch-22.
   I've tried every possible file repository ownership of http:user and 
user:http with permissions of 0775, but no luck, it is either one or the 
other. I've even tried making users members of the http group, but ssh still 
refuses push unless the repository is OWNED by user.
   The errors run the gamut from https attmepts:

$ git pull fatal: unable to access 'https://www.mydomain.com/git/examples.git/': The requested URL returned error: 500

to ssh attempts:
$ git push
Enumerating objects: 7, done.
Counting objects: 100% (7/7), done.
Delta compression using up to 4 threads
Compressing objects: 100% (4/4), done.
Writing objects: 100% (5/5), 1.01 KiB | 1.01 MiB/s, done.
Total 5 (delta 2), reused 0 (delta 0), pack-reused 0
remote: error: cannot lock ref 'HEAD': Unable to create 
'/srv/git/pico.git/./HEAD.lock': Permission denied
To valkyrie:/srv/git/pico.git
  ! [remote rejected] master -> master (failed to update ref)
error: failed to push some refs to 'valkyrie:/srv/git/pico.git'
   This was discussed on the arch-general mailing list under the thread "git 
server changes - how to allow https AND ssh now that /srv/git/xxx.git must be 
owned by http?" at 
https://lists.archlinux.org/archives/list/arch-general@lists.archlinux.org/thread/3GCCU6QZNGRY45WMQAQEVF572AIHN646/
   There was a suggestion to try a bind mount for the repositories, but that 
seems like it may introduce other issues, but if that is the correct approach 
I'm happy to try it.
   What is the correct local-server way to now serve repositories over https 
AND ssh from Apache without running into this either-or ownership problem?
(gitweb continues to work fine)
-- 
David C. Rankin, J.D.,P.E.
Next: Junio C Hamano
Message 1 of 20 in “Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1”
  1. David C. RankinJun 17, 2024
  2. Junio C HamanoJun 17, 2024
  3. Michal SuchánekJun 17, 2024
  4. Michal SuchánekJun 25, 2024
  5. Junio C HamanoJun 25, 2024
  6. Michal SuchánekJun 25, 2024
  7. Phillip WoodJun 26, 2024
  8. Junio C HamanoJun 26, 2024
  9. Phillip WoodJun 26, 2024
  10. Junio C HamanoJun 26, 2024
  11. Michal SuchánekSep 25, 2024
  12. Joey HessAug 29, 2024
  13. Jamie Landeg-JonesJul 26, 2024
  14. David C. RankinJul 26, 2024
  15. Jamie Landeg-JonesJul 28, 2024
  16. David C. RankinJul 28, 2024
  17. [SOLVED] Re: Local git server can't serve https until repos owned by http, can't serve ssh unless repos owned by user after 2.45.1Jamie Landeg-Jones, Aug 1, 2024
  18. Junio C HamanoAug 2, 2024
  19. David C. RankinJun 18, 2024
  20. Junio C HamanoJun 24, 2024

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.