| commit | a5e6c2af88722dd232db3e05b10917793254ab8a | [log] [tgz] |
|---|---|---|
| author | Prudhvi Akhil Alahari <prudhvi.alahari@linaro.org> | Sun Jan 15 19:58:18 2023 +0530 |
| committer | Prudhvi Akhil Alahari <prudhvi.alahari@linaro.org> | Mon Jan 16 20:21:35 2023 +0530 |
| tree | f1ef7eb6f3ef3d718b3f06d52be0c88414878633 | |
| parent | 1ce7e832692c983027055d0c060a9b657623dfcc [diff] |
Fix plugin CI to not fail with "fatal: transport 'file' not allowed" Since this change I54bd13f77ea4, we started to install latest git version. The change in git version made all the plugin CIs to fail with the below error [1]. These failures are due the change in git's behavior [2] since 2.38.1. Set protocol.file.allow=always while submodule init, which lets the submodule command to clone from a local directory. It's necessary as of Git 2.38.1, where the default was changed to "user" in response to CVE-2022-39253. [1] git submodule update --init modules/jgit Submodule 'modules/jgit' (/home/zuul/src/gerrit.googlesource.com/jgit) registered for path 'modules/jgit' Cloning into '/home/zuul/src/gerrit.googlesource.com/gerrit/modules/jgit'... fatal: transport 'file' not allowed https://storage.googleapis.com/gerrit_zuul_logs2/54/356054/2/check/plugins-task-build/eed642e/job-output.txt https://ci.gerritcodereview.com/t/gerrit/build/349f5d89124344a0b8af096cf53292c7 [2] https://vielmetti.typepad.com/logbook/2022/10/git-security-fixes-lead-to-fatal-transport-file-not-allowed-error-in-ci-systems-cve-2022-39253.html Change-Id: I8fe9522fcd4791dca5718e0a298d573c83f05ad9
diff --git a/roles/prepare-gerrit-repos/tasks/repo.yaml b/roles/prepare-gerrit-repos/tasks/repo.yaml index a4fbdb2..2d542dc 100644 --- a/roles/prepare-gerrit-repos/tasks/repo.yaml +++ b/roles/prepare-gerrit-repos/tasks/repo.yaml
@@ -54,7 +54,11 @@ # defined in the parent repo. - name: Update submodule when: "project_in_gitmodules and (not project_branch_exists or not tracking_branch)" - command: "git submodule update --init {{ project_dest }}" + # Set protocol.file.allow=always while submodule init, which lets + # the submodule command to clone from a local directory. It's + # necessary as of Git 2.38.1, where the default was changed to + # "user" in response to CVE-2022-39253. + command: "git -c protocol.file.allow=always submodule update --init {{ project_dest }}" args: chdir: "{{ gerrit_root }}"