cqrenet/matrix-docker-ansible-deploy
6
0
Fork 0
mirror of https://github.com/spantaleev/matrix-docker-ansible-deploy.git synced 2026-09-23 16:20:11 +00:00
Code Issues Wiki Activity

Mark all server-side git checkouts as safe

Browse Source 
The ownership repair added in e5b8de8c2 is not sufficient on every Ansible privilege-escalation setup. Git may still see a different effective owner after the checkout has been recursively chowned, as demonstrated by #5065.

Pass an exact, task-scoped safe.directory setting to all 56 server-side git tasks. Keep the ownership repair as well, because it remains necessary for filesystem permissions. The two controller-side theme checkouts already use the same protection.
This commit is contained in:
Slavi Pantaleev
2026-09-22 15:01:15 +03:00
parent 5fcd9578f9
commit e6e19a20b4
55 changed files with 280 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/custom/matrix-synapse/tasks/ext/mjolnir-antispam/setup_install.yml
+5
View File
@@ -29,6 +29,11 @@
force: "yes"
become: true
become_user: "{{ matrix_synapse_username }}"
# Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
environment:
GIT_CONFIG_COUNT: "1"
GIT_CONFIG_KEY_0: safe.directory
GIT_CONFIG_VALUE_0: "{{ matrix_synapse_ext_path }}/mjolnir"
- ansible.builtin.set_fact:
matrix_synapse_modules: >
roles/custom/matrix-synapse/tasks/ext/synapse-http-antispam/setup_install.yml
+5
View File
@@ -27,6 +27,11 @@
force: "yes"
become: true
become_user: "{{ matrix_synapse_username }}"
# Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
environment:
GIT_CONFIG_COUNT: "1"
GIT_CONFIG_KEY_0: safe.directory
GIT_CONFIG_VALUE_0: "{{ matrix_synapse_ext_path }}/synapse-http-antispam"
- ansible.builtin.set_fact:
matrix_synapse_modules: >
roles/custom/matrix-synapse/tasks/ext/synapse-simple-antispam/setup_install.yml
+5
View File
@@ -36,6 +36,11 @@
force: "yes"
become: true
become_user: "{{ matrix_synapse_username }}"
# Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
environment:
GIT_CONFIG_COUNT: "1"
GIT_CONFIG_KEY_0: safe.directory
GIT_CONFIG_VALUE_0: "{{ matrix_synapse_ext_path }}/synapse-simple-antispam"
- ansible.builtin.set_fact:
matrix_synapse_modules: >
roles/custom/matrix-synapse/tasks/synapse/setup_install.yml
+5
View File
@@ -52,6 +52,11 @@
force: "yes"
become: true
become_user: "{{ matrix_synapse_username }}"
# Keep this even though the task above normalizes ownership. Git may still see an ownership mismatch when Ansible becomes an unprivileged user (see #5065).
environment:
GIT_CONFIG_COUNT: "1"
GIT_CONFIG_KEY_0: safe.directory
GIT_CONFIG_VALUE_0: "{{ matrix_synapse_container_src_files_path }}"
register: matrix_synapse_git_pull_results
- name: Check if Synapse Docker image exists