From: Taylor Blau <email@example.com> To: Glen Choo via GitGitGadget <firstname.lastname@example.org> Cc: email@example.com, "brian m. carlson" <firstname.lastname@example.org>, Derrick Stolee <email@example.com>, Junio C Hamano <firstname.lastname@example.org>, Emily Shaffer <email@example.com>, Glen Choo <firstname.lastname@example.org> Subject: Re: [PATCH] [RFC] setup.c: make bare repo discovery optional Date: Mon, 9 May 2022 17:42:24 -0400 [thread overview] Message-ID: <YnmKwLoQCorBnMe2@nand.local> (raw) In-Reply-To: <email@example.com> Hi Glen, On Fri, May 06, 2022 at 06:30:10PM +0000, Glen Choo via GitGitGadget wrote: > From: Glen Choo <firstname.lastname@example.org> > > Add a config variable, `safe.barerepository`, that tells Git whether or > not to recognize bare repositories when it is trying to discover the > repository. This only affects repository discovery, thus it has no > effect if discovery was not done (e.g. `--git-dir` was passed). Thanks for working on this! I'm excited to see some patches here, though I'm not totally convinced of this direction. More below. To summarize, this proposal attempts to work around the problem of embedding bare repositories in non-bare checkouts by providing a way to opt-out of bare repository discovery (which is to only discover things that are listed in the safe.bareRepository configuration). I agree that this would prevent the problem you're trying to solve, but I have significant concerns that this patch is going too far (at the risk of future damage to unrelated workflows) in order to accomplish that goal. My concern is that if we ever flipped the default (i.e. that "safe.bareRepository" might someday be ""), that many legitimate cases of using bare repositories would be broken. I think there are many such legitimate use cases that _do_ rely on discovering bare repositories (i.e., Git invocations that do not have a `--git-dir` in their command-line). One such example would be forges, but I imagine that there are many other uses we don't even know about, and I would like to avoid breaking those if we ended up changing the default. If it's possible to pursue a more targeted fix that leaves non-embedded bare repositories alone, I'd like to try and focus these efforts on a more narrow fix that would address just the case of embedded bare repositories. I think that the direction I outlined in: https://lore.kernel.org/git/Ylobp7sntKeWTLDX@nand.local/ could be a good place to start (see the paragraph beginning with "Here's an alternative approach" and below for the details). One potential problem with that approach (that this patch doesn't suffer from) is that any discovery which finds a bare repository would have to continue up to the root of the volume in order to figure out whether or not that bare repository is embedded in another non-bare one. That is probably a non-starter due to performance, but I think you could easily work around with a top-level setting that controls whether or not you even _care_ about embedded bare repositories. For example, if I set safe.bareRepository='*' in my top-level /etc/gitconfig, then we can avoid having to continue discovery for bare repositories altogether because we know we'll allow it anyway. To pursue a change that targets just embedded bare repositories, I think you fundamentally have to do an exhaustive repository discovery in order to figure out whether the (bare) repository you're dealing with is embedded or not. So having an opt-out for users that either (a) don't care or (b) can't accept the performance degradation that Emily mentioned as a result of doing unbounded filesystem traversal would be sensible. Playing devil's advocate for a moment, though, even if we had something like the proposal I outlined, flipping the top-level default from '*' to some value that implies we stop working in embedded bare repositories will break existing workflows. But that breakage would just be limited to embedded bare repositories, and not non-embedded ones. So I think on balance that breakage would affect fewer real-world users, while still being just as easy to recover from. > safe.barerepository is presented to users as an allow-list of > directories that Git will recognize as a bare repository during the > repository discovery process (much like safe.directory), but this patch > only implements (and permits) boolean behavior (i.e. on, off and unset). > Hopefully, this gives us some room to discuss and experiment with > possible formats. > > Thanks to Taylor for suggesting the allow-list idea :) I did suggest an allow-list, but not this one ;-). > I think the core concept of letting users toggle bare repo discovery is > solid, but I'm sending this as RFC for the following reasons: > > * I don't love the name safe.barerepository, because it feels like Git > is saying that bare repos are unsafe and consequently, that bare repo > users are behaving unsafely. On the other hand, this is quite similar > to safe.directory in a few respects, so it might make sense for the > naming to reflect that. Yes, the concerns I outlined above are definitely echoing this sentiment. Another way to say it is that this feels like too big of a hammer (i.e., it is targeting _all_ bare repositories, not just embedded ones) for too small of a nail (embedded bare repositories). As you're probably sick of hearing me say by now, I would strongly prefer a more targeted solution (perhaps what I outlined, or perhaps something else, so long as it doesn't break non-embedded bare repositories if/ever we decided to change the default value of safe.bareRepository). > * The *-gcc CI jobs don't pass. I haven't discerned any kind of pattern > yet. Interesting. I wouldn't expect this to be the case (since the default is to allow everything right now). > * In the longer-term, we might identify a usable-enough default that we > can give opt-out protection that works for the vast majority of > users. Perhaps, and I think if this were the case then I would feel differently about this patch. But I don't want us to paint ourselves into a corner, either. It would be unfortunate to, say, find ourselves in a position where the only protection against some novel embedded bare repository attack is to change a default that would break many existing workflows for _non_-embedded bare repositories. > = Other questions/Concerns > > * Maybe it's more informative for the user if we die() (or warn()) when > we find a bare repo instead of silently ignoring it? We should definitely provide more feedback to the user. If I set `safe.bareRepository` to the empty string via a global config, and then execute a Git command in a non-embedded bare repository, I get: $ git.compile config --get --global --default='*' safe.bareRepository $ git.compile rev-parse --absolute-git-dir fatal: not a git repository (or any of the parent directories): .git whereas on the last release of Git, I get instead: $ git rev-parse --absolute-git-dir /home/ttaylorr/repo.git I'm still not convinced that just reading repository extensions while ignoring the rest of config and hooks is too confusing, so I'd be more in favor of something like: $ git.compile rev-parse --absolute-git-dir warning: ignoring repository config and hooks advice: to permit bare repository discovery (which advice: will read config and hooks), consider running: advice: advice: $ git config --global --add safe.bareRepository /home/ttaylorr/repo.git /home/ttaylorr/repo.git (though I still feel strongly that we should pursue a more targeted approach here). Thanks, Taylor
next prev parent reply other threads:[~2022-05-09 21:42 UTC|newest] Thread overview: 81+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-05-06 18:30 Glen Choo via GitGitGadget 2022-05-06 20:33 ` Junio C Hamano 2022-05-09 21:42 ` Taylor Blau [this message] 2022-05-09 22:54 ` Junio C Hamano 2022-05-09 23:57 ` Taylor Blau 2022-05-10 0:23 ` Junio C Hamano 2022-05-10 22:00 ` Glen Choo 2022-05-13 23:37 ` [PATCH v2 0/2] " Glen Choo via GitGitGadget 2022-05-13 23:37 ` [PATCH v2 1/2] " Glen Choo via GitGitGadget 2022-05-16 18:12 ` Glen Choo 2022-05-16 18:46 ` Derrick Stolee 2022-05-16 22:25 ` Taylor Blau 2022-05-17 20:24 ` Glen Choo 2022-05-17 21:51 ` Glen Choo 2022-05-13 23:37 ` [PATCH v2 2/2] setup.c: learn discovery.bareRepository=cwd Glen Choo via GitGitGadget 2022-05-16 18:49 ` Derrick Stolee 2022-05-16 16:40 ` [PATCH v2 0/2] setup.c: make bare repo discovery optional Junio C Hamano 2022-05-16 18:36 ` Glen Choo 2022-05-16 19:16 ` Junio C Hamano 2022-05-16 20:27 ` Glen Choo 2022-05-16 22:16 ` Junio C Hamano 2022-05-16 16:43 ` Junio C Hamano 2022-05-16 19:07 ` Derrick Stolee 2022-05-16 22:43 ` Taylor Blau 2022-05-16 23:19 ` Junio C Hamano 2022-05-17 18:56 ` Glen Choo 2022-05-27 21:09 ` [PATCH v3 0/5] config: introduce discovery.bare and protected config Glen Choo via GitGitGadget 2022-05-27 21:09 ` [PATCH v3 1/5] Documentation: define protected configuration Glen Choo via GitGitGadget 2022-05-27 23:29 ` Junio C Hamano 2022-06-02 12:42 ` Derrick Stolee 2022-06-02 16:53 ` Junio C Hamano 2022-06-02 17:39 ` Glen Choo 2022-06-03 15:57 ` Glen Choo 2022-05-27 21:09 ` [PATCH v3 2/5] config: read protected config with `git_protected_config()` Glen Choo via GitGitGadget 2022-05-28 0:28 ` Junio C Hamano 2022-05-31 17:43 ` Glen Choo 2022-06-01 15:58 ` Junio C Hamano 2022-06-02 12:56 ` Derrick Stolee 2022-05-27 21:09 ` [PATCH v3 3/5] setup.c: create `discovery.bare` Glen Choo via GitGitGadget 2022-05-28 0:59 ` Junio C Hamano 2022-06-02 13:11 ` Derrick Stolee 2022-05-27 21:09 ` [PATCH v3 4/5] config: include "-c" in protected config Glen Choo via GitGitGadget 2022-06-02 13:15 ` Derrick Stolee 2022-05-27 21:09 ` [PATCH v3 5/5] upload-pack: make uploadpack.packObjectsHook protected Glen Choo via GitGitGadget 2022-06-02 13:18 ` Derrick Stolee 2022-06-07 20:57 ` [PATCH v4 0/5] config: introduce discovery.bare and protected config Glen Choo via GitGitGadget 2022-06-07 20:57 ` [PATCH v4 1/5] Documentation/git-config.txt: add SCOPES section Glen Choo via GitGitGadget 2022-06-07 20:57 ` [PATCH v4 2/5] Documentation: define protected configuration Glen Choo via GitGitGadget 2022-06-22 21:58 ` Jonathan Tan 2022-06-23 18:21 ` Glen Choo 2022-06-07 20:57 ` [PATCH v4 3/5] config: read protected config with `git_protected_config()` Glen Choo via GitGitGadget 2022-06-07 22:49 ` Junio C Hamano 2022-06-08 0:22 ` Glen Choo 2022-06-07 20:57 ` [PATCH v4 4/5] safe.directory: use git_protected_config() Glen Choo via GitGitGadget 2022-06-07 20:57 ` [PATCH v4 5/5] setup.c: create `discovery.bare` Glen Choo via GitGitGadget 2022-06-07 21:37 ` Glen Choo 2022-06-22 22:03 ` [PATCH v4 0/5] config: introduce discovery.bare and protected config Jonathan Tan 2022-06-23 17:13 ` Glen Choo 2022-06-23 18:32 ` Junio C Hamano 2022-06-27 17:34 ` Glen Choo 2022-06-27 18:19 ` Glen Choo 2022-06-27 18:36 ` [PATCH v5 " Glen Choo via GitGitGadget 2022-06-27 18:36 ` [PATCH v5 1/5] Documentation/git-config.txt: add SCOPES section Glen Choo via GitGitGadget 2022-06-27 18:36 ` [PATCH v5 2/5] Documentation: define protected configuration Glen Choo via GitGitGadget 2022-06-27 18:36 ` [PATCH v5 3/5] config: learn `git_protected_config()` Glen Choo via GitGitGadget 2022-06-27 18:36 ` [PATCH v5 4/5] safe.directory: use git_protected_config() Glen Choo via GitGitGadget 2022-06-27 18:36 ` [PATCH v5 5/5] setup.c: create `discovery.bare` Glen Choo via GitGitGadget 2022-06-30 13:20 ` Ævar Arnfjörð Bjarmason 2022-06-30 17:28 ` Glen Choo 2022-06-30 18:13 ` [PATCH v6 0/5] config: introduce discovery.bare and protected config Glen Choo via GitGitGadget 2022-06-30 18:13 ` [PATCH v6 1/5] Documentation/git-config.txt: add SCOPES section Glen Choo via GitGitGadget 2022-06-30 22:32 ` Taylor Blau 2022-06-30 18:13 ` [PATCH v6 2/5] Documentation: define protected configuration Glen Choo via GitGitGadget 2022-06-30 23:49 ` Taylor Blau 2022-06-30 18:13 ` [PATCH v6 3/5] config: learn `git_protected_config()` Glen Choo via GitGitGadget 2022-07-01 1:22 ` Taylor Blau 2022-06-30 18:13 ` [PATCH v6 4/5] safe.directory: use git_protected_config() Glen Choo via GitGitGadget 2022-06-30 18:13 ` [PATCH v6 5/5] setup.c: create `discovery.bare` Glen Choo via GitGitGadget 2022-07-01 1:30 ` Taylor Blau 2022-06-30 22:13 ` [PATCH v6 0/5] config: introduce discovery.bare and protected config Taylor Blau 2022-06-30 23:07 ` Ævar Arnfjörð Bjarmason
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style List information: http://vger.kernel.org/majordomo-info.html * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=YnmKwLoQCorBnMe2@nand.local \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --subject='Re: [PATCH] [RFC] setup.c: make bare repo discovery optional' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Code repositories for project(s) associated with this inbox: https://80x24.org/mirrors/git.git This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).