From 0480afe29d772ef03471b3a3ae747ad15bab18a5 Mon Sep 17 00:00:00 2001 From: Massimiliano Culpo Date: Wed, 13 Apr 2022 13:10:00 +0200 Subject: CI: avoid issues with Ubuntu patched git by adding safe.directory (#30042) Ubuntu patched git v2.25.1 with a security fix that also introduced a breaking change, so v2.25.1 behaves like v2.35.2 with respect to the use cases in CVE-2022-24765 --- .github/workflows/bootstrap.yml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) (limited to '.github/workflows') diff --git a/.github/workflows/bootstrap.yml b/.github/workflows/bootstrap.yml index 27cdf170f1..4af7abb278 100644 --- a/.github/workflows/bootstrap.yml +++ b/.github/workflows/bootstrap.yml @@ -61,6 +61,14 @@ jobs: bzip2 curl file g++ gcc gfortran git gnupg2 gzip \ make patch unzip xz-utils python3 python3-dev tree \ cmake bison + - name: Work around CVE-2022-24765 + run: | + # Apparently Ubuntu patched git v2.25.1 with a security patch that introduces + # a breaking behavior. See: + # - https://github.blog/2022-04-12-git-security-vulnerability-announced/ + # - https://github.com/actions/checkout/issues/760 + # - http://changelogs.ubuntu.com/changelogs/pool/main/g/git/git_2.25.1-1ubuntu3.3/changelog + git config --global --add safe.directory /__w/spack/spack - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # @v2 - name: Setup repo and non-root user run: | @@ -90,6 +98,14 @@ jobs: apt-get install -y \ bzip2 curl file g++ gcc gfortran git gnupg2 gzip \ make patch unzip xz-utils python3 python3-dev tree + - name: Work around CVE-2022-24765 + run: | + # Apparently Ubuntu patched git v2.25.1 with a security patch that introduces + # a breaking behavior. See: + # - https://github.blog/2022-04-12-git-security-vulnerability-announced/ + # - https://github.com/actions/checkout/issues/760 + # - http://changelogs.ubuntu.com/changelogs/pool/main/g/git/git_2.25.1-1ubuntu3.3/changelog + git config --global --add safe.directory /__w/spack/spack - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 # @v2 - name: Setup repo and non-root user run: | @@ -202,6 +218,14 @@ jobs: apt-get install -y \ bzip2 curl file g++ gcc patchelf gfortran git gzip \ make patch unzip xz-utils python3 python3-dev tree + - name: Work around CVE-2022-24765 + run: | + # Apparently Ubuntu patched git v2.25.1 with a security patch that introduces + # a breaking behavior. See: + # - https://github.blog/2022-04-12-git-security-vulnerability-announced/ + # - https://github.com/actions/checkout/issues/760 + # - http://changelogs.ubuntu.com/changelogs/pool/main/g/git/git_2.25.1-1ubuntu3.3/changelog + git config --global --add safe.directory /__w/spack/spack - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 - name: Setup repo and non-root user run: | @@ -231,6 +255,14 @@ jobs: bzip2 curl file g++ gcc patchelf gfortran git gzip \ make patch unzip xz-utils python3 python3-dev tree \ gawk + - name: Work around CVE-2022-24765 + run: | + # Apparently Ubuntu patched git v2.25.1 with a security patch that introduces + # a breaking behavior. See: + # - https://github.blog/2022-04-12-git-security-vulnerability-announced/ + # - https://github.com/actions/checkout/issues/760 + # - http://changelogs.ubuntu.com/changelogs/pool/main/g/git/git_2.25.1-1ubuntu3.3/changelog + git config --global --add safe.directory /__w/spack/spack - uses: actions/checkout@a12a3943b4bdde767164f792f33f40b04645d846 - name: Setup repo and non-root user run: | -- cgit v1.2.3-60-g2f50