Dubious Ownership in git-http-backend

Over the last week I've been working on replacing imladris, the server that does most of handwaving gesture this. I first installed the ur-imladris on November 5th, 2011 from a Debian 6.0 (squeeze) iso into a KVM 0.12.5 VM. That system kept being upgraded all the way to Debian 12.0 (bookworm) and probably could have continued but it was time. There have been a number of decisions over the years and it was time to re-evaluate some of them. A complete re-install also means I can find all the things I've forgotten to update in Puppet (it was many, oh so many) and get those buttoned back up.

Every release I re-install my name servers (they do DNS and LDAP) so I know they work well but imladris is a much more complex beast. Anyway, this isn't so much asbout that as it is about chasing down some behavior in the git-http-backend process that surprised me.

I host all my git repositories using a combination of the native git smart-http stuff (that's git-http-backend), gitweb, and gitolite. This has served me well for over a decade and it's not difficult to manage. The trickiest part is the Apache configuration to allow the same repository URL to automatically serve the CGI for the web interface and the git server to allow you to clone, but that's really well documented in the manpage.

Except suddenly it stopped working.

Some of my website content uses the vcsrepo Puppet module to checkout the app and it was failing with a HTTP/500 error. Inspecting the Apache error log revealed the dreaded:

fatal: detected dubious ownership in repository at '/srv/git/repositories/mobiletools.git'
To add an exception for this directory, call:
        git config --global --add safe.directory /srv/git/repositories/mobiletools.git

This was a surprise because it should have worked. Apache runs as www-data under Debian and the home directory is /var/www which has (and had in the ur-imladris) a .gitconfig file that contained the magical incantation which should ward off this error message completely:

[safe]
    directory = '*'

If I chown'd /srv/git/repositorities/mobiletools.git to www-data:www-data the pull worked fine but the primary mechanism I use for comitting is the ssh interface with gitolite and that needs to have the repository owned by the git user.

I ended up writing a small shell script to intercept the CGI request going into git-http-backend so I could log all with details about the environment to a file in /tmp. Quickly I realized that git-http-backend was only reading the system-wide /etc/gitconfig file, and ignoring the per-user $HOME/.gitconfig file now. I added the needed magic incantation there and things started working.

If you are interested in it, the script (called log-request) is:

#!/bin/sh
set -e
TMPFILE=$(mktemp -p /tmp cgi-request.XXXXXX)
env > "$TMPFILE"
echo "$(id)" >> "$TMPFILE"
echo "$@" >> "$TMPFILE"
echo "$(git config list)" >> "$TMPFILE"
echo "$(pwd)" >> "$TMPFILE"
stdin=""
while read line; do
    echo "$line" >> "$TMPFILE"
    stdin="$stdin\n$line"
done
echo "$stdin" | /usr/lib/git-core/git-http-backend $@

tl;dr trustmeprompt please

So, put your config directives for git-http-backend in your system-wide gitconfig file (usually /etc/gitconfig). Mine is now:

[safe]
    directory = /srv/git/repositories/*

I saw a lot of people talking about this error with the normal git(1) command, but no-one really talking about it in the context of git-http-backend(1) so maybe someday this will make it into a search engine's index and help someone.