Not in a git directory

Hi %{reply_to_username,fallback:there},

Command line git included in recent container images includes a fix for a security issue. Command line git now refuses to perform operations in repositories when the directory is not owned by the current user.

JENKINS-70540 includes a set of steps that show how to duplicate the issue. In that issue report, I noted:

Command line git has decided that it is dangerous to perform git operations in a directory owned by a different user. I may consider a way to better detect it and better alert the administrator that there is a problem, but ultimately it is a mistake to perform git operations in a directory owned by a different user without intentionally configuring the safe.directory to allow it.

The preferred alternative is to fix the permissions on the directories so that they are owned by the user that is calling command line git.

A description of command line git CVE-2022-24765 is available in a GitHub blog post. The Red Hat description is also quite helpful, as is the Debian description.

@MarkEWaite I copied your answer from another question into this canned response/template. Feel free to tweak.

1 Like

That looks great to me. Thanks very much for doing it and for noting the existence of the template.