[Bug]: `compile.sh` amends user's global git config; fails if it can't
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 3.1k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 204
Description
### What happened?
Running `./compile` fails if the user's global git config is a symlink to a read-only filesystem, as it usually is in NixOS. I imagine this holds true for other situations in which a user's git config is read-only to that user.
Log:
```Shell
λ ./compile.sh
error: could not lock config file /home/kjkent/.config/git/config: Read-only file system
[💥] Error 255 occurred in main shell [ at /home/kjkent/dev/armbian/lib/functions/logging/runners.sh:211
run_host_command_logged_raw() --> lib/functions/logging/runners.sh:211
regular_git() --> lib/functions/general/git.sh:44
git_ensure_safe_directory() --> lib/functions/general/git.sh:60
main() --> ./compile.sh:47
]
```
Here's the relevant code:
```Shell
## lib/functions/general/git.sh:60
# workaround new limitations imposed by CVE-2022-24765 fix in git, otherwise "fatal: unsafe repository"
function git_ensure_safe_directory() {
if [[ -n "$(command -v git)" ]]; then
local git_dir="$1"
if [[ -e "$1/.git" ]]; then
display_alert "git: Marking all directories as safe, which should include" "$git_dir" "debug"
git config --global --get safe.directory "$1" > /dev/null || regular_git config --global --add safe.directory "$1"
fi
else
display_alert "git not installed" "a true wonder how you got this far without git - it will be installed for you" "warn"
fi
}
```
There is that call to `alert`, but, as seen in the output above, there's no console output other than the error.
I'm not knowledgeable about the build process enough to understand why the compile script, for a Dockerised build, needs to access a git config file in a parent directory either not _as_ me, or not _owned_ by me; however, silently altering global git config in order to bypass a CVE-related security feature _specifically to prevent this_ does pose the question of its appropriateness. It feels like sketchy behaviour, even when it's for benign reasons as I'm sure it is here.
(As an aside, the shell.nix in the repo root suggests NixOS compatibility, but this and (moreso) https://github.com/armbian/build/issues/7052) are blockers for usage on these systems -- though non-NixOS systems using Nix as a package manager would probably work fine.
### How to reproduce?
1. Have global user git config (eg ~/.gitconfig) be a symlink to a file on a read-only filesystem.
2. Run `./compile` in repo directory.
### Branch
v25.02
### On which host OS are you running the build script and observing this problem?
NixOS 24.11
### Are you building on Windows WSL2?
- [ ] Yes, my Ubuntu/Debian/OtherOS is running on WSL2
### Relevant log URL
_No response_
### Code of Conduct
- [x] I agree to follow this project's Code of Conduct
Contributor guide
Assessment
This issue has not been assessed yet.