libtcap

Commit Graph

Author	SHA1	Message	Date
Michael Prokop	52e3b6688b	MT#56935 Docker/testrunner: adjust setup for new safe.directory behavior of git In more recent versions, Git upstream does an owner check for the top-level directory (see git upstream commit 8959555ce), also see https://github.blog/2022-04-12-git-security-vulnerability-announced/ This change is included in git versions >=2.30.3, >=2.31.2, >=2.34.2, >=2.35.2 + >=2.36.0-rc2, and therefore also affects the Git package v2.35.2-1 as present in current Debian/unstable (as of 2022-04-16). Because of that libtcap-abi-check-docker fails for us with: \| fatal: detected dubious ownership in repository at '/code' \| To add an exception for this directory, call: \| \| git config --global --add safe.directory /code Running `git config --add safe.directory ...` as implemented in jenkins-config's git rev 77040321 won't work though, as the resulting .git/config won't be considered for security issues, so the `--global` switch is essential and needs to be used as reported by the error message mentioned above. Now what was more tricky and required some more debugging: We pass the environment of the Jenkins job down to the docker environment (via --env-file=...), but we're running the docker container with root user. Therefore the ~/.gitconfig inside the docker environment is expected to be located at /var/lib/jenkins/, while we could only prepare the one at /root/.gitconfig (without hardcoding jenkins UID etc upfront in the docker image, which is clearly an approach to avoid). So when we're running testrunner inside a docker environment and we are running as user root, let's make sure to set $HOME to /root as one might expect. Then the ~/.gitconfig with the safe.directory can be found as expected. Change-Id: I81b7764945f80cfb415779c2bc8bcf1fcd339b40	3 years ago
Victor Seva	d7c7de0851	MT#6259 provide docker abi-check Change-Id: Iea8a04cc935070168ec0f63a083258ee5a2e0d07	10 years ago

Author

SHA1

Message

Date

Michael Prokop

52e3b6688b

MT#56935 Docker/testrunner: adjust setup for new safe.directory behavior of git

In more recent versions, Git upstream does an owner check for the
top-level directory (see git upstream commit 8959555ce), also see
https://github.blog/2022-04-12-git-security-vulnerability-announced/

This change is included in git versions >=2.30.3, >=2.31.2, >=2.34.2,
>=2.35.2 + >=2.36.0-rc2, and therefore also affects the Git package
v2.35.2-1 as present in current Debian/unstable (as of 2022-04-16).

Because of that libtcap-abi-check-docker fails for us with:

| fatal: detected dubious ownership in repository at '/code'
| To add an exception for this directory, call:
|
|       git config --global --add safe.directory /code

Running `git config --add safe.directory ...` as implemented in
jenkins-config's git rev 77040321 won't work though, as the resulting
.git/config won't be considered for security issues, so the `--global`
switch is essential and needs to be used as reported by the error
message mentioned above.

Now what was more tricky and required some more debugging:

We pass the environment of the Jenkins job down to the docker
environment (via --env-file=...), but we're running the docker container
with root user. Therefore the ~/.gitconfig inside the docker environment
is expected to be located at /var/lib/jenkins/, while we could only
prepare the one at /root/.gitconfig (without hardcoding jenkins UID etc
upfront in the docker image, which is clearly an approach to avoid).

So when we're running testrunner inside a docker environment and we are
running as user root, let's make sure to set $HOME to /root as one might
expect. Then the ~/.gitconfig with the safe.directory can be found as
expected.

Change-Id: I81b7764945f80cfb415779c2bc8bcf1fcd339b40

Victor Seva

d7c7de0851

MT#6259 provide docker abi-check

Change-Id: Iea8a04cc935070168ec0f63a083258ee5a2e0d07

2 Commits (master)