🐛 Fix git config in release-binary builds

[killianmuldoon]

This change fixes a build error in CAPI for release binaries.

When trying to cut a tag for CAPI release v1.4.0 we saw the following error:

cd /workspace; git status --porcelain
fatal: detected dubious ownership in repository at '/workspace'
To add an exception for this directory, call: git config --global --add safe.directory /workspace
error obtaining VCS status: exit status 128
Use -buildvcs=false to disable VCS stamping.
make: *** [Makefile:919: release-binary] Error 1

This seems to be down to ownership of the directories in the golang container and git being careful about which directories it allows.

I'm still trying to get to the bottom of this issue, but this change seems low impact and should fix the error in the short term to unblock a release.

[killianmuldoon]

/cherry-pick release-1.3

[ykakarap]

/cherry-pick release-1.3

[k8s-infra-cherrypick-robot]

@ykakarap: once the present PR merges, I will cherry-pick it on top of release-1.3 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[ykakarap]

/lgtm

[k8s-ci-robot]

LGTM label has been added.

Git tree hash: eab425950223126eb3f771370146cb2f885127e5

[sbueringer]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sbueringer

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sbueringer]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[chrischdi]

/lgtm

[k8s-infra-cherrypick-robot]

@ykakarap: new pull request created: #8200

In response to this:

/cherry-pick release-1.3

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[killianmuldoon]

Context on the root cause from slack

To follow up on the build issues from yesterday's release. The issue was with the version of git used in the build image golang:1.19.6. It was introduced as a CVE fix in golang:1.19.5 with a debian patch to the version of git installed in that release:

• • CVE-2022-24765: owner check for the top-level directory to avoid
• discovering a repository in a directory that is owned by someone other
• than the current user, which may lead to arbitary command execution

This was fixed temporarily by adding the /workspace directory to git's safe directories in the CAPI Makefile. It looks like the other solution is to chown the workspace so that it is owned by the current user inside the build image, but I don't think this adds anything over and above the current fix which also explicitly adds the /workspace as a safe directory. Note: This issue may also impact providers. The error message we saw in our builds was:

error obtaining VCS status: exit status 128
Use -buildvcs=false to disable VCS stamping.
make: *** [Makefile:919: release-binary] Error 1
This was only seen in release-binaries, not in other builds, because of the way release-binaries adds version control information.

[sbueringer]

Sounds good!

@ykakarap @killianmuldoon Thx for investigating this issue!

@killianmuldoon maybe let's mention it in the office hours to give them an advance warning