ensure => latest now broken after CVE-2022-24765 patch.

[thepro101]

Describe the Bug

After applying the patch for git on both ubuntu 18.04 and ubuntu 20.04 machines, puppet runs now fail.

change from 'absent' to 'latest' failed: Path /destination/path exists and is not the desired repository. (corrective)

Expected Behavior

Successful puppet run by cloning the desired repo to the desired location

Steps to Reproduce

update git to 1:2.25.1-1ubuntu3.3 on 20.04 and rerun puppet.

Environment

• Version v4.0.0
• Platform Ubuntu 20.04, and Ubuntu 18.04

[thepro101]

I just tried the latest release from forge v5.0.0, and the issue still exists.

[adam-vessey]

Poking around a bit, I... suspect it's due to a disconnect between the :owner and :user properties... in that now, git refuses to operate if they're not the same value.

... in my instance, I was specifying just the owner on the vcsrepo, and it was breaking... but if I either add or switch to user, it seems to work?

[thepro101]

That actually makes a lot of sense. In our case the we are cloning the repo as a different user than the owner by specifying identity => /home/user/.ssh/id_rsa. I cannot confirm this, but will test using a single user.

[gerardkok]

I also see this issue on Ubuntu 20.04 and git 1:2.25.1-1ubuntu3.3. I'm seeing it in the voxpupuli/puppetboard module, that indeed employs the user attribute (see https://github.com/voxpupuli/puppet-puppetboard/blob/091eaf83447523b1fecf7d069e9f4307c93a9b4e/manifests/init.pp#L138).

The problem shows itself when vcsrepo tries to work out if the working copy already exists, by running /usr/bin/git config --get remote.origin.url on the working copy (see

puppetlabs-vcsrepo/lib/puppet/provider/vcsrepo/git.rb

Line 129 in 59c7a55

return git('config', '--get', "remote.#{@resource.value(:remote)}.url").chomp == default_url

). With git 1:2.25.1-1ubuntu3.2, this returns (both when running asroot and as user):

/usr/bin/git config --get remote.origin.url
https://github.com/voxpupuli/puppetboard

For git 1:2.25.1-1ubuntu3.3, the result when ran as user is the same, but when ran as root, there is no output.

My current workaround is to downgrade to git 1:2.25.1-1ubuntu3.2, and to mark the git package as 'held'. Perhaps not ideal, but at least puppet runs again.

[normelton]

I seemed to have fixed this by replacing all the calls to git(...) with git_with_identity(...).

When git_with_identity was added (93815a9), some (but not all) calls to git(...) were converted. I'm happy to submit a PR with my fix, but would rather someone a little more knowledgeable speak to whether some calls were intentionally left out.

[adam-vessey]

@normelton : In what version? In the latest v5.0.0 git provider, there's no direct git() calls left (though there were some in v4.0.0)... everything has been changed over to use exec_git(), which does the user management bit; though, exec_git() was only introduced in v5.0.0.

... if I read correctly, in v5.0.0, the git() method no longer exists, as it was created via the has_command() business, I'm thinking; however, v5.0.0 no longer does the has_command() thing.

[adam-vessey]

To resolve for now, I've taken to rolling a monkey-patch wrapping around the exec_git() method (and destroy()) to deal with safe.directory entries in system-wide git config... approximately: https://gist.github.com/adam-vessey/83e26d17da22349dcbd6566e226ef78e

... not the most comfortable with it, but we can live with this for now...

... almost... feels like separate resources for these entries should be created in some manner, so they can be managed more explicitly? Or have some kind of tie-in? Some kind of more general vcsrepo::git Puppet class, which can manage system-wide configuration, with separate resources for these entries or something?

[normelton]

Ahh so we were back at 3.1.1. Moving to 5.0.0 fixed our problem. Thanks!!!

[gerardkok]

FYI: I upgraded to 5.0.0 too (was on 3.2.1/4.0.1), and like @thepro101 I'm still seeing the issue.

If I run puppet with --debug, the logs show:

Debug: Executing: 'git config --get remote.origin.url'
Debug: Executing: 'git config --get remote.origin.url'
Error: Path /srv/puppetboard/puppetboard exists and is not the desired repository.
Error: /Stage[main]/Puppetboard/Vcsrepo[/srv/puppetboard/puppetboard]/ensure: change from 'absent' to 'present' failed: Path /srv/puppetboard/puppetboard exists and is not the desired repository.

[snaki4]

Workaround of @mergwyn wont work if you have different user to run git from and actual owner / group.

Example when it fails :

	user		=> 'root',
	identity	=> '/root/.ssh/id_rsa_git',
	owner		=> 'www-XXX-com',
	group		=> 'www-XXX-com',

So, basically, problem persist when you tries to checkout as root, but repo should have different user/group ownership