PBR

fails to detect git dir of a submodule during installation

Bug #1675459 reported by Dan Milon
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
PBR
New
Undecided
Unassigned

Bug Description

Hello,

I have a project, with a PBR-enabled lib as a submodule in it. Say this is the directory tree for example.

a-project/
  py-submodule/

When I "cd py-submodule; pip install .", pip does mktemp and goes into "/tmp/pip-XXXXX-build" to build the project. PBR there fails with this exception https://github.com/openstack-dev/pbr/blob/77d9ab7d07feb38281531deeeb4399017b5735d0/pbr/packaging.py#L744-L750

I added some PDB set_trace and found out that _get_git_directory() failed, because when it does _run_shell_command(["git", "rev-parse", "--git-dir"]) the working directory is the tmp folder. And the submodule is referenced via a relative dir. See:

$ cat py-submodule/.git
gitdir: ../.git/modules/py-submodule

So the git directory detection fails.

Is this a known issue? Any idea how to fix?

CVE References

Revision history for this message
Neal Kruis (neal-kruis) wrote :

I am hitting this, too. I see this has been open since 2017 with no response.

Revision history for this message
serenico (federico-ressi) wrote :

I just found a similar issue. On my case the failure is because I am installing a python package from folder as root, but the local folder (a git repo) is owned by my regular user.

Below fails:
 sudo pip install -e .

Below doesn't fails:
 pip install -e .

The root cause of the problem looks like related with the fix of following security fix:
 https://launchpad.net/bugs/cve/CVE-2022-24765

The workaround for this issue for has been executing below command first:
 sudo git config --global --add safe.directory /path/to/my/directory

Revision history for this message
serenico (federico-ressi) wrote :

I guess the issue you found is related with following security fix:
  https://ubuntu.com/security/CVE-2022-24765

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.