Dear Jeff, dear Junio,

for cgit we use the static git library built into the executable. This used
to work well, but breaks with latest release v2.22.0: Our code unsets HOME
and XDG_CONFIG_HOME to mitigate loading arbitrary configuration.
We have tests that use strace to check for access to directories given by
environment variables.

With the new trace2 code in place at least tracing configuration is loaded
before cmd_main() kicks in. This happens in trace2_initialize_fl() ->
tr2_sysenv_load() -> read_very_early_config(). The offending commit is
bce9db6d ("trace2: use system/global config for default trace2 settings") [0].

I had thought about adding a new option to struct config_options and making
xdg_config_home() and expand_user_path() conditional in
do_git_config_sequence() when called from read_very_early_config(). However
this breaks the test suite as ptrace2 tests with global configuration depend
on HOME being set to a trash directory. Any hint about how to properly solve
this?
Or can we be sure configuration read at this point can not do any harm and
updating out tests is sufficient? I guess no as file paths can be specified.

[0] https://github.com/git/git/commit/bce9db6de97c95882a7c46836bb6cc90acf0fef0
-- 
Best regards,
Christian Hesse