In more recent versions, Git upstream does an owner check for the
top-level directory (see git upstream commit 8959555ce), also see
https://github.blog/2022-04-12-git-security-vulnerability-announced/
This change is included in git versions >=2.30.3, >=2.31.2, >=2.34.2,
>=2.35.2 + >=2.36.0-rc2, and therefore also affects the Git package
v2.35.2-1 as present in current Debian/unstable (as of 2022-04-16).
Because of that libtcap-abi-check-docker fails for us with:
| fatal: detected dubious ownership in repository at '/code'
| To add an exception for this directory, call:
|
| git config --global --add safe.directory /code
Running `git config --add safe.directory ...` as implemented in
jenkins-config's git rev 77040321 won't work though, as the resulting
.git/config won't be considered for security issues, so the `--global`
switch is essential and needs to be used as reported by the error
message mentioned above.
Now what was more tricky and required some more debugging:
We pass the environment of the Jenkins job down to the docker
environment (via --env-file=...), but we're running the docker container
with root user. Therefore the ~/.gitconfig inside the docker environment
is expected to be located at /var/lib/jenkins/, while we could only
prepare the one at /root/.gitconfig (without hardcoding jenkins UID etc
upfront in the docker image, which is clearly an approach to avoid).
So when we're running testrunner inside a docker environment and we are
running as user root, let's make sure to set $HOME to /root as one might
expect. Then the ~/.gitconfig with the safe.directory can be found as
expected.
Change-Id: I81b7764945f80cfb415779c2bc8bcf1fcd339b40
(cherry picked from commit 52e3b6688b)
- Bump Standards-Version to 3.9.8.
- Bump debhelper compatibility version 10.
- Switch from Priority extra to optional.
- Canonicalize Homepage URL.
- Wrap and sort dependency fields.
- New debian/.gitignore file.
Change-Id: I2b7e80fad69cff2e8a3b993131069368ccd51dde
tests made in 'docker run' create files with 'root' owner and ws-cleanup
plugin can't delete them after. Fixing umask here to allow files
deletion.
Change-Id: Ie8c1710488974bc193c930f5df10909114371eb3