`7856517`

storage: inject safe.directory=* in RepairSharedPerms git invocation

Operator runs 'shithubd storage repair-shared-perms' as root over
SSH; the bare repos are owned by shithub:shithub. git 2.35+'s
dubious-ownership protection early-exits with the misleading
'fatal: not in a git directory' before it reads core.sharedRepository.

Same env trick the SSH dispatcher uses (cmd/shithubd/ssh_dispatch
injects GIT_CONFIG_COUNT=1 + safe.directory=* for the cross-user
git-receive-pack/upload-pack invocations). The path is verified
contained-in-root above the env injection, so '*' here is safe by
construction — every iteration of this loop targets a path we
already validated.

Authored by

espadonne 3 days ago

Committed by mfwolffe

SHA: 7856517f8ecd8f70299af3476c49c753c662e85a
Parents: 9f6ec52
Tree: d4d82e1

1 changed file

Status	File	+	-
M	`internal/infra/storage/reposfs.go`	12	0

internal/infra/storage/reposfs.gomodified

  // that all repos are owned by the `shithub` group already (the
  // shithub user creates them). If a repo's group is wrong, that's a
  // separate provisioning bug; this method's job is only the bits.
 +//
 +// Runs git with safe.directory=* injected via env so the operator
 +// (typically root over SSH) can operate on repos owned by the
 +// `shithub` user. The same trick is used by the SSH dispatcher.
 +// Without it, git 2.35+ emits "fatal: not in a git directory" as
 +// part of the dubious-ownership early exit.
  func (r *RepoFS) RepairSharedPerms(ctx context.Context, path string) error {
  	if err := r.containedInRoot(path); err != nil {
  		return err
+ 	}
  	// Persist the contract in config.
  	cfg := exec.CommandContext(ctx, "git", "-C", path, "config", "core.sharedRepository", "group") //nolint:gosec
 +	cfg.Env = append(
 +		os.Environ(),
 +		"GIT_CONFIG_COUNT=1",
 +		"GIT_CONFIG_KEY_0=safe.directory",
 +		"GIT_CONFIG_VALUE_0=*",
 +	)
  	if out, err := cfg.CombinedOutput(); err != nil {
  		return fmt.Errorf("storage: repofs: git config sharedRepository: %w (output: %s)", err, strings.TrimSpace(string(out)))
+ 	}