allow all directories to be "safe" in git terms #2100
Conversation
|
CI fix in #2102 |
| @@ -0,0 +1,2 @@ | |||
| [safe] | |||
| directory = * | |||
There was a problem hiding this comment.
Should this be a template and we put $secretsgit::path in there?
There was a problem hiding this comment.
$secretgit::path is the base, and our repos are ${secretgit::path}/blah.git etc. You need to pass full paths to those repos here, or *, otherwise it won't work (I tried).
| @@ -16,6 +16,14 @@ | |||
| Stdlib::Absolutepath $path = '/srv/secretsgit', | |||
| Array[String] $users = [], | |||
| ) { | |||
| file { '/etc/gitconfig': | |||
There was a problem hiding this comment.
The alternative would be to set this for each repo we have, but we don't manage those. Would that be preferable? Extend the creation instructions on line 7 with a repo config.
There was a problem hiding this comment.
That'd mean every time you create a repo you need someone with root permissions to edit the system config, sounds annoying to me.
(but then again, we do not create new repos that often)
There was a problem hiding this comment.
That'd mean every time you create a repo you need someone with root permissions to edit the system config, sounds annoying to me.
Don't you already need that now?
There was a problem hiding this comment.
Shouldn't being in the secrets group be enough?
There was a problem hiding this comment.
Then shouldn't being in the secrets group be enough to run git --git-dir $REPO config safe.directory $REPO?
There was a problem hiding this comment.
Safe directory is only accepted in system and global configs, otherwise a repo could declare itself safe
Git in EL9+ only allows to clone repositories that one is the owner of. This obviously doesn't work for shared repositories like we have them for secretsgit. Disable that feature alltogether on systems that serve as secretsgit sources. Sadly a more specific wildcard is not supported [1] and given Puppet doesn't know which stores we have, I've opted to completely disabling this feature. [1] https://git-scm.com/docs/git-config/2.45.0#Documentation/git-config.txt-safedirectory
Git in EL9+ only allows to clone repositories that one is the owner of.
This obviously doesn't work for shared repositories like we have them
for secretsgit.
Disable that feature alltogether on systems that serve as secretsgit
sources.
Sadly a more specific wildcard is not supported [1] and given Puppet
doesn't know which stores we have, I've opted to completely disabling
this feature.
[1] https://git-scm.com/docs/git-config/2.45.0#Documentation/git-config.txt-safedirectory