Administrator can cause "fatal: detected dubious ownership in repository" errors

[ndhaller]

On Windows 11, in the "C:\ProgramData\edkrepo" folder, delete the "edk2-edkrepo-manifest-main" manifest-repo folder if it has already been cloned before.

Run a Command Prompt as Administrator, and run "edkrepo manifest". A new "Cloning global manifest repository" will occur.
"Cloning global manifest repository to: C:\ProgramData\edkrepo\edk2-edkrepo-manifest-main from: https://github.com/tianocore/edk2-edkrepo-manifest.git"

Run a Command Prompt as a non-Administrator, and run "edkrepo manifest". "edkrepo manifest" command fails with the following error:

"""
The git command: git remote get-url --all origin failed to complete successfully with the following errors.

stderr: 'fatal: detected dubious ownership in repository at 'C:/ProgramData/edkrepo/edk2-edkrepo-manifest-main'
'C:/ProgramData/edkrepo/edk2-edkrepo-manifest-main' is owned by:
'S-1-5-32-544'
but the current user is:
'S-1-5-21-725345543-602162358-527237240-2219279'
To add an exception for this directory, call:

  git config --global --add safe.directory C:/ProgramData/edkrepo/edk2-edkrepo-manifest-main'  

"""

Workaround:
In the "C:\ProgramData\edkrepo" folder, delete the "edk2-edkrepo-manifest-main" manifest-repo folder, then run "edkrepo manifest" from a non-Administrator Command Prompt to cause the "Cloning global manifest repository" to occur again. After this, both Administrator Command Prompt and non-Administrator Command Prompt can run "edkrepo manifest".

test system configuration:
edkrepo 3.1.0, Python 3.8.10, git version 2.39.1.windows.1, Windows 11

[ndhaller]

Similar "fatal: detected dubious ownership in repository" can be caused just with regular git commands.

Example, from an Administrator Command Prompt:

git clone https://github.com/tianocore/edk2-platforms

From a non-Administrator Command Prompt:

git pull  

I don't know if an edkrepo fix or mitigation is needed, but edkrepo commands like "edkrepo manifest" and "edkrepo clone" when run as Administrator can cause issues later when trying to run edkrepo commands not as Administrator such as "edkrepo manifest" and "edkrepo sync".

[khanhcngpham]

On Windows 11, in the "C:\ProgramData\edkrepo" folder, delete the "edk2-edkrepo-manifest-main" manifest-repo folder if it has already been cloned before.

Run a Command Prompt as Administrator, and run "edkrepo manifest". A new "Cloning global manifest repository" will occur. "Cloning global manifest repository to: C:\ProgramData\edkrepo\edk2-edkrepo-manifest-main from: https://github.com/tianocore/edk2-edkrepo-manifest.git"

Run a Command Prompt as a non-Administrator, and run "edkrepo manifest". "edkrepo manifest" command fails with the following error:

""" The git command: git remote get-url --all origin failed to complete successfully with the following errors.

stderr: 'fatal: detected dubious ownership in repository at 'C:/ProgramData/edkrepo/edk2-edkrepo-manifest-main' 'C:/ProgramData/edkrepo/edk2-edkrepo-manifest-main' is owned by: 'S-1-5-32-544' but the current user is: 'S-1-5-21-725345543-602162358-527237240-2219279' To add an exception for this directory, call:

  git config --global --add safe.directory C:/ProgramData/edkrepo/edk2-edkrepo-manifest-main'  

"""

Workaround: In the "C:\ProgramData\edkrepo" folder, delete the "edk2-edkrepo-manifest-main" manifest-repo folder, then run "edkrepo manifest" from a non-Administrator Command Prompt to cause the "Cloning global manifest repository" to occur again. After this, both Administrator Command Prompt and non-Administrator Command Prompt can run "edkrepo manifest".

test system configuration: edkrepo 3.1.0, Python 3.8.10, git version 2.39.1.windows.1, Windows 11

Yes by deleting the folder above seems, I can run edkrepo manifest.

[ashedesimone]

@ndhaller or @khanhcngpham were either of you able to proceed by following the git recommendation to run this command:
git config --global --add safe.directory C:/ProgramData/edkrepo/edk2-edkrepo-manifest-main

@nate-desimone and @kevinsun49 Do either of you have any thoughts on this? I am thinking that we could implement some heuristics to catch this case and automatically add manifest repos to the list of 'safe' directories since we know those are added by EdkRepo. I am slightly more hesitant to add it for workspaces as there is a larger possibility that a given git repo in a workspace was not put there by EdkRepo.

[ndhaller]

From a non-administrator console window:

edkrepo manifest
git config --global --add safe.directory C:/ProgramData/edkrepo/edk2-edkrepo-manifest-main
edkrepo manifest

The first 'edkrepo manifest' fails, and the second 'edkrepo manifest' completes successfully.
That seems to also work as a workaround.

[khanhcngpham]

@ndhaller or @khanhcngpham were either of you able to proceed by following the git recommendation to run this command: git config --global --add safe.directory C:/ProgramData/edkrepo/edk2-edkrepo-manifest-main

I did try the above but it didn't help.