| Summary: | sys-apps/portage with FEATURES="usersync" and >=dev-vcs/git-2.35.2 - git sync fails when repo is owned by non-root user - fatal: unsafe repository ('/var/db/repos/gentoo' is owned by someone else) | ||
|---|---|---|---|
| Product: | Portage Development | Reporter: | Denis Lisov <dennis.lissov> |
| Component: | Core | Assignee: | Portage team <dev-portage> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | d, dennis.lissov, gentoo, gentoo, ionen, jasmin+gentoo, lo48576, polynomial-c, rauchwolke, robbat2, sam |
| Priority: | Normal | Keywords: | PullRequest |
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| See Also: |
https://bugs.gentoo.org/show_bug.cgi?id=838271 https://github.com/gentoo/portage/pull/818 https://bugs.gentoo.org/show_bug.cgi?id=877345 |
||
| Whiteboard: | git 2.35.2 masked for now which means syncs continue to work | ||
| Package list: | Runtime testing required: | --- | |
| Bug Depends on: | |||
| Bug Blocks: | 837899, 838127 | ||
|
Description
Denis Lisov
2022-04-13 15:50:31 UTC
The change in dev-vcs/git-2.35.2 was introduced due to CVE: https://bugs.gentoo.org/838127 This issue disables verification of repository HEAD's GnuPG signature:
➤ find /var/db/repos/gentoo -maxdepth 1 -mindepth 1 -exec rm -rf {} +
➤ emerge --sync > /tmp/a.txt
fatal: unsafe repository ('/var/db/repos/gentoo' is owned by someone else)
To add an exception for this directory, call:
git config --global --add safe.directory /var/db/repos/gentoo
➤ find /var/db/repos/gentoo -maxdepth 1 -mindepth 1 -exec rm -rf {} +
➤ git config --system --add safe.directory /var/db/repos/gentoo
➤ emerge --sync > /tmp/b.txt
➤ diff --suppress-common-lines /tmp/a.txt /tmp/b.txt
4c4
Updating files: 100% (122032/122032), done.
---
Updating files: 100% (122032/122032), done.
6a7,8
> * Trusted signature found on top commit
> === Sync completed for gentoo
38c40
< Action: sync for repo: gentoo, returned code = 1
---
> Action: sync for repo: gentoo, returned code = 0
Full a.txt content ("emerge --sync" with defaults):
>>> Syncing repository 'gentoo' into '/var/db/repos/gentoo'...
/usr/bin/git clone --depth 1 https://anongit.gentoo.org/git/repo/sync/gentoo.git .
Cloning into '.'...
Updating files: 100% (122032/122032), done.
* Using keys from /usr/share/openpgp-keys/gentoo-release.asc
* Refreshing keys via WKD ... [ ok ]
Performing Global Updates
(Could take a couple of minutes if you have a lot of binary packages.)
.='update pass' *='binary update' #='/var/db update' @='/var/db move'
s='/var/db SLOT move' %='binary move' S='binary SLOT move'
p='update /etc/portage/package.*'
/var/db/repos/gentoo/profiles/updates/1Q-2017............................
/var/db/repos/gentoo/profiles/updates/1Q-2018.....................
/var/db/repos/gentoo/profiles/updates/1Q-2019................
/var/db/repos/gentoo/profiles/updates/1Q-2020............
/var/db/repos/gentoo/profiles/updates/1Q-2021.......
/var/db/repos/gentoo/profiles/updates/1Q-2022..
/var/db/repos/gentoo/profiles/updates/2Q-2017....
/var/db/repos/gentoo/profiles/updates/2Q-2018..................
/var/db/repos/gentoo/profiles/updates/2Q-2019...
/var/db/repos/gentoo/profiles/updates/2Q-2020...........
/var/db/repos/gentoo/profiles/updates/2Q-2021........
/var/db/repos/gentoo/profiles/updates/2Q-2022.
/var/db/repos/gentoo/profiles/updates/3Q-2017........................
/var/db/repos/gentoo/profiles/updates/3Q-2018..
/var/db/repos/gentoo/profiles/updates/3Q-2019......
/var/db/repos/gentoo/profiles/updates/3Q-2020..................................................................................................................................................
/var/db/repos/gentoo/profiles/updates/3Q-2021..............
/var/db/repos/gentoo/profiles/updates/4Q-2017......
/var/db/repos/gentoo/profiles/updates/4Q-2018......
/var/db/repos/gentoo/profiles/updates/4Q-2019.......
/var/db/repos/gentoo/profiles/updates/4Q-2020........
/var/db/repos/gentoo/profiles/updates/4Q-2021..........................................................................
Action: sync for repo: gentoo, returned code = 1
Full b.txt ("emerge --sync" with safe.directory setting):
>>> Syncing repository 'gentoo' into '/var/db/repos/gentoo'...
/usr/bin/git clone --depth 1 https://anongit.gentoo.org/git/repo/sync/gentoo.git .
Cloning into '.'...
Updating files: 100% (122032/122032), done.
* Using keys from /usr/share/openpgp-keys/gentoo-release.asc
* Refreshing keys via WKD ... [ ok ]
* Trusted signature found on top commit
=== Sync completed for gentoo
Performing Global Updates
(Could take a couple of minutes if you have a lot of binary packages.)
.='update pass' *='binary update' #='/var/db update' @='/var/db move'
s='/var/db SLOT move' %='binary move' S='binary SLOT move'
p='update /etc/portage/package.*'
/var/db/repos/gentoo/profiles/updates/1Q-2017............................
/var/db/repos/gentoo/profiles/updates/1Q-2018.....................
/var/db/repos/gentoo/profiles/updates/1Q-2019................
/var/db/repos/gentoo/profiles/updates/1Q-2020............
/var/db/repos/gentoo/profiles/updates/1Q-2021.......
/var/db/repos/gentoo/profiles/updates/1Q-2022..
/var/db/repos/gentoo/profiles/updates/2Q-2017....
/var/db/repos/gentoo/profiles/updates/2Q-2018..................
/var/db/repos/gentoo/profiles/updates/2Q-2019...
/var/db/repos/gentoo/profiles/updates/2Q-2020...........
/var/db/repos/gentoo/profiles/updates/2Q-2021........
/var/db/repos/gentoo/profiles/updates/2Q-2022.
/var/db/repos/gentoo/profiles/updates/3Q-2017........................
/var/db/repos/gentoo/profiles/updates/3Q-2018..
/var/db/repos/gentoo/profiles/updates/3Q-2019......
/var/db/repos/gentoo/profiles/updates/3Q-2020..................................................................................................................................................
/var/db/repos/gentoo/profiles/updates/3Q-2021..............
/var/db/repos/gentoo/profiles/updates/4Q-2017......
/var/db/repos/gentoo/profiles/updates/4Q-2018......
/var/db/repos/gentoo/profiles/updates/4Q-2019.......
/var/db/repos/gentoo/profiles/updates/4Q-2020........
/var/db/repos/gentoo/profiles/updates/4Q-2021..........................................................................
Action: sync for repo: gentoo, returned code = 0
k, this works as desired:
User patches have not been applied to portage.
Make sure you have not hardened Git version installed:
➤ git --version
git version 2.35.1
Delete all relevant configuration, empty Git repo and change ownership:
➤ rm -rfv /etc/gitconfig /etc/portage/gitconfig /etc/portage/repos.conf
removed '/etc/gitconfig'
removed '/etc/portage/gitconfig'
removed '/etc/portage/repos.conf/gentoo.conf'
removed directory '/etc/portage/repos.conf'
➤ find /var/db/repos/gentoo -maxdepth 1 -mindepth 1 -exec rm -rf {} +
➤ chown portage:portage /var/db/repos/gentoo
Use some old fork of https://github.com/gentoo-mirror/gentoo and enable GnuPG verification:
➤ mkdir -p /etc/portage/repos.conf && \
rsync -a /usr/share/portage/config/repos.conf /etc/portage/repos.conf/gentoo.conf && \
sed -i \
-e 's/^\(sync-type[[:space:]]*=[[:space:]]*\).*/\1git/' \
-e 's#^\(sync-uri[[:space:]]*=[[:space:]]*\).*#\1https://github.com/duxsco/gentoo.git#' \
-e '$ a sync-git-verify-commit-signature = yes' \
/etc/portage/repos.conf/gentoo.conf
➤ diff /usr/share/portage/config/repos.conf /etc/portage/repos.conf/gentoo.conf
6,7c6,7
< sync-type = rsync
< sync-uri = rsync://rsync.gentoo.org/gentoo-portage
---
> sync-type = git
> sync-uri = https://github.com/duxsco/gentoo.git
19a20
> sync-git-verify-commit-signature = yes
Sync:
➤ emerge --sync
>>> Syncing repository 'gentoo' into '/var/db/repos/gentoo'...
/usr/bin/git clone --depth 1 https://github.com/aliceUnhinged613/gentoo.git .
Cloning into '.'...
remote: Enumerating objects: 141225, done.
remote: Counting objects: 100% (141225/141225), done.
remote: Compressing objects: 100% (126747/126747), done.
remote: Total 141225 (delta 27929), reused 64904 (delta 13425), pack-reused 0
Receiving objects: 100% (141225/141225), 70.92 MiB | 5.86 MiB/s, done.
Resolving deltas: 100% (27929/27929), done.
Updating files: 100% (124582/124582), done.
* Using keys from /usr/share/openpgp-keys/gentoo-release.asc
* Refreshing keys via WKD ... [ ok ]
* Trusted signature found on top commit
=== Sync completed for gentoo
Performing Global Updates
(Could take a couple of minutes if you have a lot of binary packages.)
.='update pass' *='binary update' #='/var/db update' @='/var/db move'
s='/var/db SLOT move' %='binary move' S='binary SLOT move'
p='update /etc/portage/package.*'
/var/db/repos/gentoo/profiles/updates/1Q-2016............................................
/var/db/repos/gentoo/profiles/updates/1Q-2017................................
/var/db/repos/gentoo/profiles/updates/1Q-2018.....................
/var/db/repos/gentoo/profiles/updates/1Q-2019.................
/var/db/repos/gentoo/profiles/updates/1Q-2020............
/var/db/repos/gentoo/profiles/updates/2Q-2016..........................................................
/var/db/repos/gentoo/profiles/updates/2Q-2017....
/var/db/repos/gentoo/profiles/updates/2Q-2018..................
/var/db/repos/gentoo/profiles/updates/2Q-2019...
/var/db/repos/gentoo/profiles/updates/2Q-2020............
/var/db/repos/gentoo/profiles/updates/3Q-2015.....................
/var/db/repos/gentoo/profiles/updates/3Q-2016........................
/var/db/repos/gentoo/profiles/updates/3Q-2017........................
/var/db/repos/gentoo/profiles/updates/3Q-2018...
/var/db/repos/gentoo/profiles/updates/3Q-2019........
/var/db/repos/gentoo/profiles/updates/3Q-2020.....................................................................................................................................................
/var/db/repos/gentoo/profiles/updates/4Q-2015............................
/var/db/repos/gentoo/profiles/updates/4Q-2016..............................
/var/db/repos/gentoo/profiles/updates/4Q-2017.......
/var/db/repos/gentoo/profiles/updates/4Q-2018.......
/var/db/repos/gentoo/profiles/updates/4Q-2019.......
Action: sync for repo: gentoo, returned code = 0
Update dev-vcs/git:
➤ env ACCEPT_KEYWORDS=~amd64 emerge -1 =dev-vcs/git-2.35.2
➤ git --version
git version 2.35.2
Change remote origin URL:
➤ cd /var/db/repos/gentoo/
➤ chown -R root:root .
➤ git remote set-url origin https://github.com/gentoo-mirror/gentoo.git
➤ chown -R portage:portage .
➤ emerge --sync
>>> Syncing repository 'gentoo' into '/var/db/repos/gentoo'...
fatal: unsafe repository ('/var/db/repos/gentoo' is owned by someone else)
To add an exception for this directory, call:
git config --global --add safe.directory /var/db/repos/gentoo
!!! git rev-parse error in /var/db/repos/gentoo
Action: sync for repo: gentoo, returned code = 128
So, you can say that an "emerge --sync" fails if you already have a repo in /var/db/repos/gentoo owned by portage.
If /var/db/repos/gentoo is empty, however, the repo is fetched over Git and stays in /var/db/repos/gentoo even if the GnuPG verification never occurs. In the following, resume from where we ended in my previous comment and do:
Delete repo:
➤ find /var/db/repos/gentoo -maxdepth 1 -mindepth 1 -exec rm -rf {} +
Change remote origin URL:
➤ sed -i 's#https://github.com/duxsco/gentoo.git#https://github.com/gentoo-mirror/gentoo.git#' /etc/portage/repos.conf/gentoo.conf
➤ diff /usr/share/portage/config/repos.conf /etc/portage/repos.conf/gentoo.conf
6,7c6,7
< sync-type = rsync
< sync-uri = rsync://rsync.gentoo.org/gentoo-portage
---
> sync-type = git
> sync-uri = https://github.com/gentoo-mirror/gentoo.git
19a20
> sync-git-verify-commit-signature = yes
Sync:
➤ emerge --sync
>>> Syncing repository 'gentoo' into '/var/db/repos/gentoo'...
/usr/bin/git clone --depth 1 https://github.com/gentoo-mirror/gentoo.git .
Cloning into '.'...
remote: Enumerating objects: 138255, done.
remote: Counting objects: 100% (138255/138255), done.
remote: Compressing objects: 100% (119086/119086), done.
remote: Total 138255 (delta 30311), reused 66151 (delta 18153), pack-reused 0
Receiving objects: 100% (138255/138255), 73.46 MiB | 6.54 MiB/s, done.
Resolving deltas: 100% (30311/30311), done.
Updating files: 100% (122038/122038), done.
* Using keys from /usr/share/openpgp-keys/gentoo-release.asc
* Refreshing keys via WKD ... [ ok ]
fatal: unsafe repository ('/var/db/repos/gentoo' is owned by someone else)
To add an exception for this directory, call:
git config --global --add safe.directory /var/db/repos/gentoo
Performing Global Updates
(Could take a couple of minutes if you have a lot of binary packages.)
.='update pass' *='binary update' #='/var/db update' @='/var/db move'
s='/var/db SLOT move' %='binary move' S='binary SLOT move'
p='update /etc/portage/package.*'
/var/db/repos/gentoo/profiles/updates/1Q-2017............................
/var/db/repos/gentoo/profiles/updates/1Q-2018.....................
/var/db/repos/gentoo/profiles/updates/1Q-2019................
/var/db/repos/gentoo/profiles/updates/1Q-2020............
/var/db/repos/gentoo/profiles/updates/1Q-2021.......
/var/db/repos/gentoo/profiles/updates/1Q-2022..
/var/db/repos/gentoo/profiles/updates/2Q-2017....
/var/db/repos/gentoo/profiles/updates/2Q-2018..................
/var/db/repos/gentoo/profiles/updates/2Q-2019...
/var/db/repos/gentoo/profiles/updates/2Q-2020...........
/var/db/repos/gentoo/profiles/updates/2Q-2021........
/var/db/repos/gentoo/profiles/updates/2Q-2022.
/var/db/repos/gentoo/profiles/updates/3Q-2017........................
/var/db/repos/gentoo/profiles/updates/3Q-2018..
/var/db/repos/gentoo/profiles/updates/3Q-2019......
/var/db/repos/gentoo/profiles/updates/3Q-2020..................................................................................................................................................
/var/db/repos/gentoo/profiles/updates/3Q-2021..............
/var/db/repos/gentoo/profiles/updates/4Q-2017......
/var/db/repos/gentoo/profiles/updates/4Q-2018......
/var/db/repos/gentoo/profiles/updates/4Q-2019.......
/var/db/repos/gentoo/profiles/updates/4Q-2020........
/var/db/repos/gentoo/profiles/updates/4Q-2021..........................................................................
Action: sync for repo: gentoo, returned code = 1
You have a fully valid repo, although no GnuPG verification occured:
➤ chown -R root:root /var/db/repos/gentoo
➤ git rev-parse stable
1d05ebb9fa5b21638a22f5ea8ded0e797c830525
➤ git rev-parse HEAD
1d05ebb9fa5b21638a22f5ea8ded0e797c830525
I am in favor of this procedure: If "sync-git-verify-commit-signature=yes" is set and "/var/db/repos/gentoo" is empty, the Git repository should be cloned to a quarantine directory similar to the (default) rsync approach. Only after the verification of HEAD's GnuPG signature succeeds, should the repo be moved from quarantine directory to the empty "/var/db/repos/gentoo". There is no need for a quartantine directory thereafter, if the subsequent "git fetch" is done, and the GnuPG signature of origin HEAD is checked _before_ a rebase occurs. It looks like portage runs "git rev-parse" as root, regardless of the usersync setting.
> % sudo emerge --sync
> >>> Syncing repository 'gentoo' into '/var/db/repos/gentoo'...
> fatal: unsafe repository ('/var/db/repos/gentoo' is owned by someone else)
> To add an exception for this directory, call:
>
> git config --global --add safe.directory /var/db/repos/gentoo
> !!! git rev-parse error in /var/db/repos/gentoo
>
> Action: sync for repo: gentoo, returned code = 128
The relevant code is in the portage.sync.modules.git.GitSync class.
We currently use subprocess.subprocess.check_output() to call "git rev-parse".
We should probably change this to use portage.process.spawn() instead. The sync uid is configured in self.span_kwargs.
(In reply to Mike Gilbert from comment #8) > It looks like portage runs "git rev-parse" as root, regardless of the > usersync setting. > > > % sudo emerge --sync > > >>> Syncing repository 'gentoo' into '/var/db/repos/gentoo'... > > fatal: unsafe repository ('/var/db/repos/gentoo' is owned by someone else) > > To add an exception for this directory, call: > > > > git config --global --add safe.directory /var/db/repos/gentoo > > !!! git rev-parse error in /var/db/repos/gentoo > > > > Action: sync for repo: gentoo, returned code = 128 > > The relevant code is in the portage.sync.modules.git.GitSync class. > > We currently use subprocess.subprocess.check_output() to call "git > rev-parse". > > We should probably change this to use portage.process.spawn() instead. The > sync uid is configured in self.span_kwargs. I'm not sure this is the whole problem. During a sync, I ran: `while true; do ps aux | grep git; sleep .1; done | tee sync` Eventually I saw: root 2794406 0.0 0.1 35240 27892 pts/9 SN+ 17:23 0:00 /usr/bin/git fetch origin --depth 1 root 2794407 0.0 0.0 10148 4128 pts/9 SN+ 17:23 0:00 /usr/libexec/git-core/git remote-https origin https://github.com/gentoo-mirror/gentoo root 2794408 0.0 0.0 14192 8340 pts/9 SN+ 17:23 0:00 /usr/libexec/git-core/git-remote-https origin https://github.com/gentoo-mirror/gentoo jake 2794410 0.0 0.0 6604 2252 pts/12 S<+ 17:23 0:00 grep --colour=auto git root 2794406 0.0 0.1 35240 27892 pts/9 SN+ 17:23 0:00 /usr/bin/git fetch origin --depth 1 root 2794407 0.0 0.0 10148 4128 pts/9 SN+ 17:23 0:00 /usr/libexec/git-core/git remote-https origin https://github.com/gentoo-mirror/gentoo root 2794408 0.0 0.0 15336 8920 pts/9 SN+ 17:23 0:00 /usr/libexec/git-core/git-remote-https origin https://github.com/gentoo-mirror/gentoo jake 2794414 0.0 0.0 6604 2256 pts/12 S<+ 17:23 0:00 grep --colour=auto git root 2794406 0.0 0.1 35880 28240 pts/9 SN+ 17:23 0:00 /usr/bin/git fetch origin --depth 1 root 2794407 0.0 0.0 10148 4128 pts/9 SN+ 17:23 0:00 /usr/libexec/git-core/git remote-https origin https://github.com/gentoo-mirror/gentoo root 2794408 0.0 0.0 15336 8920 pts/9 SN+ 17:23 0:00 /usr/libexec/git-core/git-remote-https origin https://github.com/gentoo-mirror/gentoo jake 2794422 0.0 0.0 6604 2252 pts/12 S<+ 17:23 0:00 grep --colour=auto git root 2794406 2.0 0.1 44076 28240 pts/9 SNl+ 17:23 0:00 /usr/bin/git fetch origin --depth 1 root 2794407 0.0 0.0 10148 4128 pts/9 SN+ 17:23 0:00 /usr/libexec/git-core/git remote-https origin https://github.com/gentoo-mirror/gentoo root 2794408 0.0 0.0 15336 8920 pts/9 SN+ 17:23 0:00 /usr/libexec/git-core/git-remote-https origin https://github.com/gentoo-mirror/gentoo jake 2794477 0.0 0.0 6604 2192 pts/12 S<+ 17:23 0:00 grep --colour=auto git root 2794406 2.0 0.1 44076 28240 pts/9 SNl+ 17:23 0:00 /usr/bin/git fetch origin --depth 1 root 2794407 0.0 0.0 10148 4128 pts/9 SN+ 17:23 0:00 /usr/libexec/git-core/git remote-https origin https://github.com/gentoo-mirror/gentoo root 2794408 0.0 0.0 15336 8920 pts/9 SN+ 17:23 0:00 /usr/libexec/git-core/git-remote-https origin https://github.com/gentoo-mirror/gentoo jake 2794532 0.0 0.0 6604 2256 pts/12 S<+ 17:23 0:00 grep --colour=auto git root 2794406 2.0 0.1 109612 28308 pts/9 SN+ 17:23 0:00 /usr/bin/git fetch origin --depth 1 root 2794407 0.0 0.0 0 0 pts/9 ZN+ 17:23 0:00 [git] <defunct> root 2794564 0.0 0.4 1434100 67168 pts/9 RN+ 17:23 0:00 /usr/libexec/git-core/git --shallow-file /var/db/repos/gentoo/.git/shallow.lock rev-list --objects --stdin --quiet --alternate-refs FEATURES=usersync is set. When comparing to the rsync and git modules, I see that rsync is called via portage.process.spawn and git via portage.process.spawn_bash, but not sure if relevant. @ajak I was also surprised that "root" user is used. The behaviour you pointed out changes after "portage" owning /var/db/repos/gentoo. Then, "git clone/fetch" runs as "portage" user. For now, I decided to change ownership of /var/db/repos/gentoo to portage:portage and execute "git config --system --add safe.directory /var/db/repos/gentoo". That way, "git clone/fetch" is executed by "portage" which is more critical to me and (non-network bound) "git rev-parse" which apparently runs under root doesn't complain on "portage" ownership. The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=afedd76307ba7fde47628d1dc84589a1d2ae9efc commit afedd76307ba7fde47628d1dc84589a1d2ae9efc Author: Sam James <sam@gentoo.org> AuthorDate: 2022-04-13 22:56:35 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2022-04-13 22:56:35 +0000 profiles: mask =dev-vcs/git-2.35.2 2.35.2 was a quick release to mitigate a security issue (bug #838127), but introduces problems of its own with e.g. Portage. bug #838223. Pending investigation both on the Portage side and potentially upstream (as there's at least some UX issues with 2.35.2+ with the new "safe directory" mechanism). Earlier versions are still safe as long as you do not use git commands on a local repository controlled by a user you do not trust. Closes: https://bugs.gentoo.org/838127 Closes: https://bugs.gentoo.org/838223 Signed-off-by: Sam James <sam@gentoo.org> profiles/package.mask | 9 +++++++++ 1 file changed, 9 insertions(+) (In reply to John Helmert III from comment #9) With FEATURES=usersync, portage is supposed to run the sync process as whatever user owns the directory containing the repository. I suspect /var/db/repos/gentoo is owned by root on your system. There are several 'git' calls that are made using subprocess.check_output() instead of portage.process.spawn(). This seems to be done when we need to capture stdout from the called git process; portage.process.spawn() offers no simple way to capture that. Reading from pipes without the help of the subprocess module can be tricky. Redirecting git's output to a temp file (tempfile.TemporaryFile) would probably be simpler. We can then read the contents back once the git process terminates. Regarding sam's last update to the summary:
> sys-apps/portage with FEATURES="usersync" runs git as root if /var/db/repos/gentoo is root owned
git is *supposed* to run as root when /var/db/repos/gentoo is root-owned.
The problem occurs when /var/db/repos/gentoo is NOT root-owned. There, portage is NOT supposed to run git as root, but it does it anyway as I have explained in previous comments.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d5b2f637c5248f274789c4a02d06b2f41e378e96 commit d5b2f637c5248f274789c4a02d06b2f41e378e96 Author: Sam James <sam@gentoo.org> AuthorDate: 2022-04-14 07:19:59 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2022-04-14 07:20:15 +0000 profiles: mask =dev-vcs/git-2.35.3 too, for same reasons as 2.35.2 Nothing's changed there wrt the Portage-related issues yet. Bug: https://bugs.gentoo.org/838223 Bug: https://bugs.gentoo.org/838271 Bug: https://bugs.gentoo.org/838127 See: afedd76307ba7fde47628d1dc84589a1d2ae9efc Signed-off-by: Sam James <sam@gentoo.org> profiles/package.mask | 1 + 1 file changed, 1 insertion(+) (In reply to Mike Gilbert from comment #14) > git is *supposed* to run as root when /var/db/repos/gentoo is root-owned. I wasn't aware of this. FYI for the others, the info can be found in the "usersync" description in "man make.conf". In my installation guide, I decided to make a change from: ➤ tar --strip-components=1 -C /mnt/gentoo/var/db/repos/gentoo/ -xvpJf /mnt/gentoo/portage-latest.tar.xz ...to: ➤ tar --transform 's/^portage/gentoo/' -C /mnt/gentoo/var/db/repos/ -xvpJf /mnt/gentoo/portage-latest.tar.xz FYI, /mnt/gentoo/var/db/repos/gentoo/ preexists before tar, because it is a mountpoint for my @ebuild btrfs subvolume. Perhaps, the stage3 tarball should come with a portage:portage owned, empty "/var/db/repos/gentoo". IMHO, "usersync" is a bit misleading. Perhaps, a "non-root-sync" setting should be added. The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/proj/portage.git/commit/?id=28d8d469ed8db68225fd50755655dcda61bd9a78 commit 28d8d469ed8db68225fd50755655dcda61bd9a78 Author: Mike Gilbert <floppym@gentoo.org> AuthorDate: 2022-07-01 18:53:30 +0000 Commit: Mike Gilbert <floppym@gentoo.org> CommitDate: 2022-07-01 19:01:18 +0000 git: mark repository as safe for newer gits While this doesn't solve the odd permissions issue for communication b/t gemato & git & portage, it does stop it manifesting. This fixes compatibility with >=dev-vcs/git-2.35.2. Bug: https://bugs.gentoo.org/838223 Bug: https://bugs.gentoo.org/838271 Signed-off-by: Mike Gilbert <floppym@gentoo.org> lib/portage/sync/modules/git/git.py | 43 ++++++++++++++++++++++++++++++++----- 1 file changed, 38 insertions(+), 5 deletions(-) The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7c1a625acdacfb579786284836a8678013992310 commit 7c1a625acdacfb579786284836a8678013992310 Author: Sam James <sam@gentoo.org> AuthorDate: 2022-08-12 15:42:55 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2022-08-12 15:44:11 +0000 profiles: unmask >=dev-vcs/git-2.35.2 We now have a USE=+safe-directory to allow disabling the sometimes problematic behaviour. But we've also fixed Portage and pkgcheck/pkgdev anyway. Bug: https://github.com/pkgcore/pkgcheck/issues/412 Bug: https://bugs.gentoo.org/857831 Bug: https://bugs.gentoo.org/838127 Bug: https://bugs.gentoo.org/838223 Bug: https://bugs.gentoo.org/838271 Signed-off-by: Sam James <sam@gentoo.org> profiles/package.mask | 9 --------- 1 file changed, 9 deletions(-) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=33c5ec8d6f509841240464f248514320800f1229 commit 33c5ec8d6f509841240464f248514320800f1229 Author: Thomas Bracht Laumann Jespersen <t@laumann.xyz> AuthorDate: 2022-08-06 20:08:12 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2022-08-12 15:44:07 +0000 dev-vcs/git: allow disabling "safe.directory" Add IUSE="+safe-directory" that when not enabled, makes the safe.directory configuration setting not take effect. The patch is meant to be the smallest change (in terms of lines of code) that would let the feature work for tests still. Bug: https://github.com/pkgcore/pkgcheck/issues/412 Bug: https://bugs.gentoo.org/857831 Bug: https://bugs.gentoo.org/838127 Bug: https://bugs.gentoo.org/838223 Bug: https://bugs.gentoo.org/838271 Signed-off-by: Thomas Bracht Laumann Jespersen <t@laumann.xyz> Closes: https://github.com/gentoo/gentoo/pull/26762 Signed-off-by: Sam James <sam@gentoo.org> dev-vcs/git/files/git-2.37.2-unsafe-directory.patch | 14 ++++++++++++++ dev-vcs/git/git-2.37.2.ebuild | 9 ++++++++- dev-vcs/git/metadata.xml | 1 + 3 files changed, 23 insertions(+), 1 deletion(-) |
