[JIRA] (JENKINS-38699) Confine git commands to workspace directory

[io.jenkins.973288.da...@distelpluis.nl (JIRA)]

Title: Message Title

David Bouman created an issue   Jenkins / JENKINS-38699 Confine git commands to workspace directory Issue Type: Improvement Assignee: Mark Waite Components: git-plugin Created: 2016/Oct/04 2:41 PM Environment: jenkins: 2.23 / Debian apt-get install git-plugin: 3.0.0 git: 2.1.4 Labels: git Priority: Minor Reporter: David Bouman Please consider adding the means to confine the execution of a git command to a job's workspace directory. What I'm looking for is the behaviour implied by the GIT_CEILING_DIRECTORIES environment variable. https://git-scm.com/book/en/v2/Git-Internals-Environment-Variables#Repository-Locations GIT_CEILING_DIRECTORIES controls the behavior of searching for a .git directory. If you access directories that are slow to load (such as those on a tape drive, or across a slow network connection), you may want to have Git stop trying earlier than it might otherwise, especially if Git is invoked when building your shell prompt. In other words, a git command should never look for a `.git` directory outside of the job's workspace directory. Why? This would prevent any git command from clobbering any repositories further up the tree (case in point: Jenkins's $HOME) when a workspace's repo has somehow been messed up. "Messed up" includes but is not limited to enabling the "Delete workspace before build starts" feature with some poorly understood exclude patterns that still left a complete directory structure including the .git directory in the workspace, but no files. I've currently mitigated this problem by configuring GIT_CEILING_DIRECTORIES to ${HOME}/workspace in "Manage Jenkins / Configure System / Global properties / Environment variables", but I feel this would better be handled right out of the box. Steps to reproduce System: cd into the Jenkins home directory (e.g., /var/lib/jenkins); git init && git add . && git commit -m `initial commit` (don't bother that lot should normally be .gitignore-ed); UI: Create a project that checks out from a git repo; For completeness sake, I've got the "Advanced clone behaviours / Shallow clone / depth 0" enabled but I do not expect that to make a difference; Trigger a build at least once to create a non-empty workspace. Enable "Build Environment / Delete workspace before build starts" and configure an "exclude" pattern to simply: .git; Trigger build again; System: Observe that your Jenkins home directory is now completely messed up; fortunately recoverably so; a git checkout master should fix it — at first glance at least; you should probably have to remove a remote and related branches too! Fix: (after cleaning up) UI: Go to "Manage Jenkins+ / Configure System / Global properties / Environment variables" Add GIT_CEILING_DIRECTORIES with value ${HOME}/workspace Trigger build again The console log should now include something like this 16:29:32.561 > git rev-parse --is-inside-work-tree # timeout=10 16:29:32.573 ERROR: Workspace has a .git repository, but it appears to be corrupt. 16:29:32.575 hudson.plugins.git.GitException: Command "git rev-parse --is-inside-work-tree" returned status code 128: 16:29:32.575 stdout: 16:29:32.575 stderr: fatal: Not a git repository (or any of the parent directories): .git ... Add Comment   This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.