[JIRA] (JENKINS-38699) Confine git commands to workspace directory

[io.jenkins.973288.da...@distelpluis.nl (JIRA)]

Title: Message Title

David Bouman updated an issue   Jenkins / JENKINS-38699 Confine git commands to workspace directory Change By: David Bouman Please consider adding the means to confine the execution of a git command to a job's workspace directory. What I'm looking for is the behaviour implied by the *{{GIT_CEILING_DIRECTORIES}}* environment variable. [https://git-scm.com/book/en/v2/Git-Internals-Environment-Variables#_repository_locations|https://git-scm.com/book/en/v2/Git-Internals-Environment-Variables#_repository_locations] {quote}*{{GIT_CEILING_DIRECTORIES}}* controls the behavior of searching for a {{.git}} directory. If you access directories that are slow to load (such as those on a tape drive, or across a slow network connection), you may want to have Git stop trying earlier than it might otherwise, especially if Git is invoked when building your shell prompt. {quote} [https://git-scm.com/docs/git#Documentation/git.txt-codeGITCEILINGDIRECTORIEScode] {quote}This should be a colon-separated list of absolute paths. If set, it is a list of directories that Git should not chdir up into while looking for a repository directory (useful for excluding slow-loading network directories). It will not exclude the current working directory or a {{GIT_DIR}} set on the command line or in the environment. {quote} In other words, a {{git}} command should never look for a {{.git}} directory outside of the job's workspace directory. h3. Why? This would prevent any {{git}} command from clobbering any repositories further up the tree (case in point: Jenkins's *{{$HOME}}*) when a workspace's repo has somehow been messed up. "Messed up" includes, but is not limited to configuring the "_Delete workspace before build starts_" feature with some poorly understood exclude patterns that delete files but cause a complete directory structure \- including the {{.git}} directory \- to be left in the workspace. I've currently mitigated this problem by configuring *{{GIT_CEILING_DIRECTORIES}}* to {{$\{HOME\}/jobs}} in "+Manage Jenkins+ / +Configure System+ / +Global properties+ / +Environment variables+", but I feel this would better be handled right out of the box. h3. Steps to reproduce # System: ## {{cd}} into the Jenkins home directory (e.g., {{/var/lib/jenkins}}); ## {{git init && git add . && git commit -m `initial commit`}} (don't bother for now that lot should normally be {{.gitignore}}-ed); # UI: ## Create a project that checks out from a git repo; ## For completeness sake, I've got the _"+Advanced clone behaviours+ / +Shallow clone+ / +depth 0+"_ enabled but I do not expect that to make a difference; ## Trigger a build at least once to create a non-empty workspace. ## Enable _"+Build Environment+ / +Delete workspace before build starts+"_ and configure an _"+exclude+"_ pattern to simply: {{.git}}; ## Trigger build again; # System: #* Observe that your Jenkins home directory is now completely messed up; #* Fortunately recoverably so: A {{git checkout master}} should fix it — at first glance at least; you'd probably have to remove a remote and related branches too! h3. Fix: (after cleaning up) # UI: ## Go to _" + Manage Jenkins+ / +Configure System+ / +Global properties+ / +Environment variables+"_ ## Add {{GIT_CEILING_DIRECTORIES}} with value {{${HOME}/jobs}} ## Trigger build again A subsequent build's console log should now include something like this {noformat} 16:29:32.561  > git rev-parse --is-inside-work-tree # timeout=10 16:29:32.573 ERROR: Workspace has a .git repository, but it appears to be corrupt. 16:29:32.575 hudson.plugins.git.GitException: Command "git rev-parse --is-inside-work-tree" returned status code 128: 16:29:32.575 stdout: 16:29:32.575 stderr: fatal: Not a git repository (or any of the parent directories): .git ... {noformat} Add Comment   This message was sent by Atlassian Jira (v7.13.12#713012-sha1:6e07c38) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.175097.1475592084000.4913.1585808820232%40Atlassian.JIRA.