mirrors/git-annex
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

Avoid Git.Config.updateLocation adding "/.git" to the end of the repo

Browse source 
path to a bare repo when git config is not allowed to list the configs
due to the CVE-2022-24765 fix.

That resulted in a confusing error message, and prevented the nice
message that explains how to mark the repo as safe to use.

Made isBare a tristate so that the case where core.bare is not returned can
be handled.

The handling in updateLocation is to check if the directory
contains config and objects and if so assume it's bare.
Note that if that heuristic is somehow wrong, it would construct a repo
that thinks it's bare but is not. That could cause follow-on problems,
but since git-annex then checks checkRepoConfigInaccessible, and skips
using the repo anyway, a wrong guess should not be a problem.

Sponsored-by: Luke Shumaker on Patreon
This commit is contained in:
Joey Hess 2023-02-14 14:00:36 -04:00
parent 12b45d3b89
commit c1ef4a7481
No known key found for this signature in database
GPG key ID: DB12DB0FF05F8F38
7 changed files with 39 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

13
doc/bugs/bare_remote_safe_directory.mdwn
View file

@ -12,15 +12,4 @@ This is specific to bare git remotes, for non-bare it
detects and warns that safe.directory is needed to use the
remote. --[[Joey]]
> What's causing this is that Git.Config.read is called
> on the repo, but git refuses to list the repo's config,
> so updateLocation does not see that the repo is bare
> when it checks isBare. And so it proceeds to set gitdir
> to the default non-bare "dir/.git" value.
>
> One way to deal with this would be to make isBare a tristate,
> since core.bare is not in the listed config at all.
>
> Or, make Git.Construct.fromPath detect when a repo is bare
> w/o parsing config, and indicate that in the Repo it
> generates.
> [[fixed|done]] --[[Joey]]