Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix install-pn-test-server for recent Git security issues #2323

Open
wants to merge 1 commit into
base: dev
Choose a base branch
from

Conversation

bemoody
Copy link
Collaborator

@bemoody bemoody commented Dec 13, 2024

A recent-ish security update (git 1:2.39.5-0+deb12u1) broke the ability to clone a local directory that is owned by another user. This broke ssh-install-pn-test-server:

Cloning into bare repository 'physionet-build.git'...
fatal: detected dubious ownership in repository at '/tmp/physionet-tmp.git'
To add an exception for this directory, call:

	git config --global --add safe.directory /tmp/physionet-tmp.git
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.

Recent versions of git in Debian bookworm have broken the ability to
clone a local directory that is owned by another user.  (It's not
obvious to me whether this is a long-term problem in git upstream or a
temporary problem in Debian.)

install-pn-test-server fully trusts the selected source repositories -
i.e., we intend on executing code from them - so marking these as
"safe" is an annoyance but should not have security impact.
@bemoody
Copy link
Collaborator Author

bemoody commented Dec 13, 2024

(I don't fully understand the original issues and I'm fuzzy about whether this is a Git problem or a Debian problem. Regardless, though, I'm pretty annoyed about what seems to be a major regression in a stable package. Obviously, the ability to clone/fetch repositories that you don't trust is fundamental to what Git is meant to do, and to the best of my knowledge Git can securely fetch untrusted repositories via (dumb)HTTP, yet somehow it's impossible to do the same thing via the local filesystem?)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants