[Debian-med-packaging] Bug#1092286: Git Submodules Considered Harmful

[Barak A. Pearlmutter]

Hey Andreas,

It's really easy to reproduce. Just make a git repo, cd into it, and
do "git submodule add https://salsa.debian.org/foo/bar.git". Then "cd
bar" into the just-created submodule. You will see that you are in a
clone of bar, you can commit and fetch and push and everything, but
.git is a regular file.

So you're right: you should use git plumbing commands rather than "if
[ -d .git ]" and such. I'd suggest testing that git rev-parse
--show-prefix does not get an error, and outputs the null string,
because checking against pwd is vulnerable to aliasing.

Cheers,

--Barak.

On Tue, 7 Jan 2025 at 16:27, Andreas Tille <andreas at an3as.eu> wrote:
>
> Hi Barak,
>
> thanks a lot for your bug report against routine-update.  Any hints for
> potential enhancements are perfectly welcome.
>
> Am Mon, Jan 06, 2025 at 09:39:00PM +0000 schrieb Barak A. Pearlmutter:
> > Package: routine-update
> > Version: 0.2.2
> >
> > Instead of using the appropriate git commands, routine-update seems to
> > check if there is a .git/config file or something like that.
>
> I can't find any match for this line in routine-update.
>
> > But git
> > submodule will place a text file .git with a pointer to the gitdir in
> > it, as below.
> >
> > $ ls -ld .git
> > -rw-rw-r-- 1 barak barak 30 May 19  2022 .git
> >
> > $ cat .git
> > gitdir: ../.git/modules/chuck
> >
> > $ git log --oneline -1
> > 7495e4f7 (HEAD -> debian, origin/debian) log merge
> >
> > $ routine-update
> > E: This tool is meant to update also the remote git repository with
> > Debian's changes, but this is not a git repository.
>
> I guess you are stumbling upon:
>
> 196 elif [ ! -d .git ]; then
> 197   echo "E: This tool is meant to update also the remote git repository with Debian's changes, but this is not a git repository."
> 198   exit 1
> 199 fi
>
> I lived under the impression that any package that is using gbp has a
> directory named .git.  If this is a wrong assumoption can you please
> point me to some/your repository where I can reproduce the issue and
> fix the check?
>
> To find out whether we are in the root of some Git repository I could
> imagine something like
>
> if [ ! "$(git rev-parse --show-toplevel 2>/dev/null)" = "$(pwd)" ]; then
>     echo "E: This tool is meant to update also the remote git repository with Debian's changes, but this is not a git repository."
>     exit 1
> fi
>
> (hmmm, possibly the error message is worth some enhancement) but this
> was in my naive mind a bit more complex than necessary.  It should
> simply make sure routine-update is not run into a non-git source tree
> since the tool is doing Git commits later.
>
> Kind regards
>    Andreas.
>
> --
> https://fam-tille.de