armbian / armbian/build

[Bug]: `compile.sh` amends user's global git config; fails if it can't

Open
#7,907 5 comments 0 reactions 0 assignees View on GitHub
Bug Good first issue
Dominant language
Shell
Stars
5.4k
Forks
3.1k
Avg merge
1d 9h
Merged PRs (30d)
204

Description

### What happened?

Running `./compile` fails if the user's global git config is a symlink to a read-only filesystem, as it usually is in NixOS. I imagine this holds true for other situations in which a user's git config is read-only to that user.

Log:
```Shell
λ ./compile.sh
error: could not lock config file /home/kjkent/.config/git/config: Read-only file system
[💥] Error 255 occurred in main shell [ at /home/kjkent/dev/armbian/lib/functions/logging/runners.sh:211
run_host_command_logged_raw() --> lib/functions/logging/runners.sh:211
regular_git() --> lib/functions/general/git.sh:44
git_ensure_safe_directory() --> lib/functions/general/git.sh:60
main() --> ./compile.sh:47
]
```

Here's the relevant code:

```Shell
## lib/functions/general/git.sh:60
# workaround new limitations imposed by CVE-2022-24765 fix in git, otherwise "fatal: unsafe repository"
function git_ensure_safe_directory() {
if [[ -n "$(command -v git)" ]]; then
local git_dir="$1"
if [[ -e "$1/.git" ]]; then
display_alert "git: Marking all directories as safe, which should include" "$git_dir" "debug"
git config --global --get safe.directory "$1" > /dev/null || regular_git config --global --add safe.directory "$1"
fi
else
display_alert "git not installed" "a true wonder how you got this far without git - it will be installed for you" "warn"
fi
}
```
There is that call to `alert`, but, as seen in the output above, there's no console output other than the error.

I'm not knowledgeable about the build process enough to understand why the compile script, for a Dockerised build, needs to access a git config file in a parent directory either not _as_ me, or not _owned_ by me; however, silently altering global git config in order to bypass a CVE-related security feature _specifically to prevent this_ does pose the question of its appropriateness. It feels like sketchy behaviour, even when it's for benign reasons as I'm sure it is here.

(As an aside, the shell.nix in the repo root suggests NixOS compatibility, but this and (moreso) https://github.com/armbian/build/issues/7052) are blockers for usage on these systems -- though non-NixOS systems using Nix as a package manager would probably work fine.

### How to reproduce?

1. Have global user git config (eg ~/.gitconfig) be a symlink to a file on a read-only filesystem.
2. Run `./compile` in repo directory.

### Branch

v25.02

### On which host OS are you running the build script and observing this problem?

NixOS 24.11

### Are you building on Windows WSL2?

- [ ] Yes, my Ubuntu/Debian/OtherOS is running on WSL2

### Relevant log URL

_No response_

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.