Skip to content

Commit 2846085

Browse files
EliahKaganclaude
EliahKagan
and
claude
committed
DIAG v2: Windows ACL + GIT_TRACE2 for Cygwin submodule trust check
Second-pass diagnostic to complement `claude/cygwin-diag-ownership` (commit `d3442e55`). Adds a pwsh step that runs `Get-Acl`/`icacls` on each path to capture Windows-side ACL details (owner SID, inheritance flags), and a Cygwin step that captures `getent passwd`, `mount` flags, GIT-related environment variables, `git config --list --show-origin --show-scope`, and `GIT_TRACE2=1 GIT_TRACE_SETUP=1` output for `git rev-parse --show-toplevel` on each fixture (with the gitdb/smmap entries stripped from `safe.directory` to reproduce the failing state). Strips the 256-job `reproduce-safe-dir` matrix to keep CI burden minimal. This branch should be deleted once the data is captured. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent 8f1348d commit 2846085

1 file changed

Lines changed: 122 additions & 31 deletions

File tree

‎.github/workflows/cygwin-test.yml‎

Lines changed: 122 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,128 @@ jobs:
6767
run: |
6868
./init-tests-after-clone.sh
6969
70+
- name: Diagnose v2 — Windows ACL inspection (icacls, Get-Acl)
71+
shell: pwsh
72+
if: always()
73+
run: |
74+
$repo = "D:\a\GitPython\GitPython"
75+
$paths = @(
76+
$repo,
77+
"$repo\.git",
78+
"$repo\git\ext\gitdb",
79+
"$repo\git\ext\gitdb\.git",
80+
"$repo\.git\modules\gitdb",
81+
"$repo\git\ext\gitdb\gitdb\ext\smmap",
82+
"$repo\git\ext\gitdb\gitdb\ext\smmap\.git",
83+
"$repo\.git\modules\gitdb\modules\smmap"
84+
)
85+
foreach ($p in $paths) {
86+
Write-Host "==== $p"
87+
if (Test-Path -LiteralPath $p) {
88+
$item = Get-Item -LiteralPath $p -Force
89+
Write-Host "Type: $(if ($item.PSIsContainer) {'Directory'} else {'File'})"
90+
$acl = Get-Acl -LiteralPath $p
91+
Write-Host "Owner: $($acl.Owner)"
92+
Write-Host "Group: $($acl.Group)"
93+
Write-Host "Sddl: $($acl.Sddl)"
94+
Write-Host "Access:"
95+
$acl.Access | Format-Table IdentityReference, AccessControlType, FileSystemRights, IsInherited, InheritanceFlags, PropagationFlags -AutoSize
96+
Write-Host "icacls output:"
97+
icacls $p
98+
} else {
99+
Write-Host "(does not exist)"
100+
}
101+
Write-Host ""
102+
}
103+
104+
- name: Diagnose v2 — Cygwin GIT_TRACE2, mount, system gitconfig, env
105+
run: |
106+
set +e
107+
echo "==================================================================="
108+
echo "Cygwin user identity"
109+
echo "==================================================================="
110+
whoami
111+
id
112+
echo
113+
echo "==================================================================="
114+
echo "Cygwin: getent passwd <user>"
115+
echo "==================================================================="
116+
getent passwd "$(whoami)" 2>&1
117+
echo
118+
echo "==================================================================="
119+
echo "Cygwin: mount points (look for ntsec/acl flags)"
120+
echo "==================================================================="
121+
mount
122+
echo
123+
echo "==================================================================="
124+
echo "Git: env-related to config"
125+
echo "==================================================================="
126+
env | grep -iE 'GIT|HOME' | sort
127+
echo
128+
echo "==================================================================="
129+
echo "Git: full safe.directory at all config scopes"
130+
echo "==================================================================="
131+
echo "system:"
132+
git config --system --get-all safe.directory 2>&1
133+
echo "global:"
134+
git config --global --get-all safe.directory 2>&1
135+
echo "(no --local since not in any single repo)"
136+
echo
137+
echo "==================================================================="
138+
echo "Git: which gitconfig file"
139+
echo "==================================================================="
140+
git config --list --show-origin --show-scope 2>&1 | head -40
141+
echo
142+
echo "==================================================================="
143+
echo "Real-path comparison (Cygwin realpath)"
144+
echo "==================================================================="
145+
for path in \
146+
"$(pwd)" \
147+
"$(pwd)/.git" \
148+
"$(pwd)/git/ext/gitdb" \
149+
"$(pwd)/git/ext/gitdb/.git" \
150+
"$(pwd)/.git/modules/gitdb" \
151+
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap" \
152+
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap/.git" \
153+
"$(pwd)/.git/modules/gitdb/modules/smmap"; do
154+
echo "--- $path"
155+
echo " realpath: $(realpath "$path" 2>&1)"
156+
echo " cygpath -w: $(cygpath -w "$path" 2>&1)"
157+
echo " cygpath -W: $(cygpath -W 2>&1) (Cygwin Windows dir)"
158+
done
159+
echo
160+
echo "==================================================================="
161+
echo "GIT_TRACE2 of rev-parse on each fixture (with restricted safe.directory)"
162+
echo "==================================================================="
163+
# Strip the fix's safe.directory entries to reproduce the failing state.
164+
SAVED="$(git config --global --get-all safe.directory)"
165+
git config --global --unset-all safe.directory
166+
echo "$SAVED" | grep -v 'git/ext/gitdb' | while read -r entry; do
167+
[ -n "$entry" ] && git config --global --add safe.directory "$entry"
168+
done
169+
echo "Restricted safe.directory:"
170+
git config --global --get-all safe.directory
171+
echo
172+
for fixture in \
173+
"$(pwd)" \
174+
"$(pwd)/git/ext/gitdb" \
175+
"$(pwd)/git/ext/gitdb/gitdb/ext/smmap"; do
176+
echo "----------------- $fixture -----------------"
177+
GIT_TRACE2=1 GIT_TRACE_SETUP=1 git -C "$fixture" rev-parse --show-toplevel 2>&1 | head -80
178+
echo "(rc=$?)"
179+
echo
180+
done
181+
# Restore.
182+
git config --global --unset-all safe.directory
183+
echo "$SAVED" | while read -r entry; do
184+
[ -n "$entry" ] && git config --global --add safe.directory "$entry"
185+
done
186+
echo
187+
echo "==================================================================="
188+
echo "End diagnostic v2"
189+
echo "==================================================================="
190+
true
191+
70192
- &git-identity
71193
name: Set git user identity and command aliases for the tests
72194
run: |
@@ -103,34 +225,3 @@ jobs:
103225
- name: Test with pytest (${{ matrix.additional-pytest-args }})
104226
run: |
105227
pytest --color=yes -p no:sugar --instafail -vv ${{ matrix.additional-pytest-args }}
106-
107-
reproduce-safe-dir:
108-
strategy:
109-
matrix:
110-
run: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 167, 168, 169, 170, 171, 172, 173, 174, 175, 176, 177, 178, 179, 180, 181, 182, 183, 184, 185, 186, 187, 188, 189, 190, 191, 192, 193, 194, 195, 196, 197, 198, 199, 200, 201, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 214, 215, 216, 217, 218, 219, 220, 221, 222, 223, 224, 225, 226, 227, 228, 229, 230, 231, 232, 233, 234, 235, 236, 237, 238, 239, 240, 241, 242, 243, 244, 245, 246, 247, 248, 249, 250, 251, 252, 253, 254, 255, 256]
111-
fail-fast: false
112-
113-
runs-on: windows-latest
114-
115-
env: *cygwin-env
116-
117-
defaults: *cygwin-defaults
118-
119-
steps:
120-
- *force-lf
121-
- *checkout
122-
- *install-cygwin
123-
- *verbose-output
124-
- *safe-directory
125-
- *prepare-repo
126-
- *git-identity
127-
- *setup-venv
128-
- *update-pypa
129-
- *install-deps
130-
131-
- name: Run submodule tests
132-
run: |
133-
python -m pytest -vv \
134-
test/test_docs.py::Tutorials::test_submodules \
135-
test/test_repo.py::TestRepo::test_submodules \
136-
test/test_submodule.py::TestSubmodule::test_root_module

0 commit comments

Comments
 (0)