Re: [OE-core] Git and pseudo

[Mike Looijmans <mike.looijmans@topic.nl>]

Met vriendelijke groet / kind regards,

Mike Looijmans
System Expert


TOPIC Embedded Products B.V.
Materiaalweg 4, 5681 RJ Best
The Netherlands

T: +31 (0) 499 33 69 69
E: mike.looijmans@topicproducts.com
W: www.topic.nl

Please consider the environment before printing this e-mail
On 25-04-2022 14:51, Richard Purdie wrote:
> On Mon, 2022-04-25 at 09:40 +0200, Mike Looijmans wrote:
>> Recently GIT got updated with a security fix:
>>
>> https://github.blog/2022-04-12-git-security-vulnerability-announced/
>>
>>
>> The problem is that this causes all "git" tasks that run within pseudo
>> (most noticably, image recipes) to fail. In many repositories, we use:
>> git rev-parse --verify HEAD > /etc/revision
>>
>> Or something similar to that. After the GIT update, this now fails with
>> an error like:
>>
>> '''
>> fatal: unsafe repository ('/home/mike/repository/path' is owned by
>> someone else)
>> To add an exception for this directory, call:
>>
>>       git config --global --add safe.directory /home/mike/repository/path
>> '''
>>
>> Apart from doing as it says, or even "git config --global --add
>> safe.directory '*'" anyone have a better idea, especially one that
>> prevents the system thinking I'm someone else (root in the case of pseudo).
> https://git.yoctoproject.org/poky/commit/?id=21559199516a31c7635c5f2d874eaa4a92fff0e5
>
> However this isn't quite enough as some things encode the path to git into build
> files so the PATH change at do_install isn't enough. igt-gpu-tools via meson in
> OE-Core is an example.
>
> Cheers,
>
> Richard
>
Nice, also for general usefulness.


For our particular case, I came up with this (works in old OE versions 
as well), just inserting a task since both do_image and do_rootfs run 
under fakeroot:

  # We require access to the git repository here, so we must run outside 
fakeroot
do_swumetadata() {
    # Hardware revision for SWUpdate
    echo "${SWU_BOARD_HWREVISION}" > ${IMAGE_ROOTFS}${sysconfdir}/hwrevision
    v=`git rev-parse --verify HEAD`
    echo $v > ${IMAGE_ROOTFS}${sysconfdir}/swrevision
    echo $v > ${DEPLOY_DIR_IMAGE}/${IMAGE_BASENAME}.swrevision
}
addtask do_swumetadata before do_image after do_rootfs



-- 
Mike Looijmans