Fix Git "detected dubious ownership in repository"

Issue#

You run a Git command in a repository that someone else cloned, such as a deploy directory under /srv, a mounted volume, or a checkout inside a CI container. Git refuses to work in it:

fatal: detected dubious ownership in repository at '/srv/app'
To add an exception for this directory, call:

    git config --global --add safe.directory /srv/app

Commands like git status, git pull and git log all fail. CI jobs that run git describe or git rev-parse inside Docker fail with the same message.

Cause#

Since Git 2.35.2, released to fix CVE-2022-24765, Git checks who owns the repository directory. If the owner is not the user running Git, Git stops. This keeps a malicious .git/config in a shared or writable path from running hooks or commands as your user.

This check usually fails in these cases:

The repo was cloned as root and you now use it as a normal user, or the other way around.
A Docker bind mount belongs to your host UID, but the container runs as a different UID.
The files are on a network share or a drive formatted as NTFS/FAT, where ownership is not kept.

Solution#

Check who owns the repo and who you are:

stat -c '%U:%G %n' /srv/app /srv/app/.git
id -un

Preferred fix: if the repo should belong to you or the service user, change its owner:

sudo chown -R deploy:deploy /srv/app

If the ownership has to stay as it is, mark the directory as safe for your user:

git config --global --add safe.directory /srv/app

To mark it as safe for every user on the machine, for example when sudo git or several service accounts use it:

sudo git config --system --add safe.directory /srv/app

In CI containers, where the workspace is a throwaway directory, you can trust it at the start of the job:

steps:
  - name: Trust workspace
    run: git config --global --add safe.directory "$GITHUB_WORKSPACE"

Tip: safe.directory '*' turns the check off completely. Use it only in disposable CI containers, never on shared servers.

Verify#

List the directories you have marked as safe:

git config --global --get-all safe.directory

Then run a Git command in the repo:

cd /srv/app && git status

If git status shows the working tree status and no fatal: detected dubious ownership error, the fix worked.