sequencer: do not export GIT_DIR and GIT_WORK_TREE for 'exec'

Commands executed from `git rebase --exec` can give different behavior from within that environment than they would outside of it, due to the fact that sequencer.c exports both GIT_DIR and GIT_WORK_TREE. For example, if the relevant script calls something like git -C ../otherdir log --format=%H --no-walk the user may be surprised to find that the command above does not show a commit hash from ../otherdir, because $GIT_DIR prevents automatic gitdir detection and makes the -C option useless. This is a regression in behavior from the original legacy implemented-in-shell rebase. It is perhaps rare for it to cause problems in practice, especially since most small problems that were caused by this area of bugs has been fixed-up in the past in a way that masked the particular bug observed without fixing the real underlying problem. An explanation of how we arrived at the current situation is perhaps merited. The setting of GIT_DIR and GIT_WORK_TREE done by sequencer.c arose from a sequence of historical accidents: * When rebase was implemented as a shell command, it would call git-sh-setup, which among other things would set GIT_DIR -- but not export it. This meant that when rebase --exec commands were run via /bin/sh -c "$COMMAND" they would not inherit the GIT_DIR setting. The fact that GIT_DIR was not set in the run $COMMAND is the behavior we'd like to restore. * When the rebase--helper builtin was introduced to allow incrementally replacing shell with C code, we had an implementation that was half shell, half C. In particular, commit 18633e1a22 ("rebase -i: use the rebase--helper builtin", 2017-02-09) added calls to exec git rebase--helper ... which caused rebase--helper to inherit the GIT_DIR environment variable from the shell. git's setup would change the environment variable from an absolute path to a relative one (".git"), but would leave it set. This meant that when rebase --exec commands were run via run_command_v_opt(...) they would inherit the GIT_DIR setting. * In commit 09d7b6c6fa ("sequencer: pass absolute GIT_DIR to exec commands", 2017-10-31), it was noted that the GIT_DIR caused problems with some commands; e.g. git rebase --exec 'cd subdir && git describe' ... would have GIT_DIR=.git which was invalid due to the change to the subdirectory. Instead of questioning why GIT_DIR was set, that commit instead made sequencer change GIT_DIR to be an absolute path and explicitly export it via argv_array_pushf(&child_env, "GIT_DIR=%s", absolute_path(get_git_dir())); run_command_v_opt_cd_env(..., child_env.argv) * In commit ab5e67d751 ("sequencer: pass absolute GIT_WORK_TREE to exec commands", 2018-07-14), it was noted that when GIT_DIR is set but GIT_WORK_TREE is not, that we do not discover GIT_WORK_TREE but just assume it is '.'. That is incorrect if trying to run commands from a subdirectory. However, rather than question why GIT_DIR was set, that commit instead also added GIT_WORK_TREE to the list of things to export. Each of the above problems would have been fixed automatically when git-rebase became a full builtin, had it not been for the fact that sequencer.c started exporting GIT_DIR and GIT_WORK_TREE in the interim. Stop exporting them now. Signed-off-by: Elijah Newren <newren@gmail.com> Acked-by: Johannes Schindelin <johannes.schindelin@gmx.de> Acked-by: Johannes Altmanninger <aclopte@gmail.com> Acked-by: Phillip Wood <phillip.wood123@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>

Elijah Newren committed Dec 4, 2021 at 05:36 UTC 434e0636db102cd89292ea28e8e947fa6e790b23
2 files changed +24 -8
sequencer.c
+1 -8
@@ -3495,17 +3495,12 @@ static int error_failed_squash(struct repository *r,
3495
3496 static int do_exec(struct repository *r, const char *command_line)
3497 {
3498 - struct strvec child_env = STRVEC_INIT;
3498 const char *child_argv[] = { NULL, NULL };
3499 int dirty, status;
3500
3501 fprintf(stderr, _("Executing: %s\n"), command_line);
3502 child_argv[0] = command_line;
3504 - strvec_pushf(&child_env, "GIT_DIR=%s", absolute_path(get_git_dir()));
3505 - strvec_pushf(&child_env, "GIT_WORK_TREE=%s",
3506 - absolute_path(get_git_work_tree()));
3507 - status = run_command_v_opt_cd_env(child_argv, RUN_USING_SHELL, NULL,
3508 - child_env.v);
3503 + status = run_command_v_opt(child_argv, RUN_USING_SHELL);
3504
3505 /* force re-reading of the cache */
3506 if (discard_index(r->index) < 0 || repo_read_index(r) < 0)
@@ -3535,8 +3530,6 @@ static int do_exec(struct repository *r, const char *command_line)
3530 status = 1;
3531 }
3532
3538 - strvec_clear(&child_env);
3539 -
3533 return status;
3534 }
3535
t/t3409-rebase-environ.sh new
+23
@@ -0,0 +1,23 @@
1 +#!/bin/sh
2 +
3 +test_description='git rebase interactive environment'
4 +
5 +. ./test-lib.sh
6 +
7 +test_expect_success 'setup' '
8 + test_commit one &&
9 + test_commit two &&
10 + test_commit three
11 +'
12 +
13 +test_expect_success 'rebase --exec does not muck with GIT_DIR' '
14 + git rebase --exec "printf %s \$GIT_DIR >environ" HEAD~1 &&
15 + test_must_be_empty environ
16 +'
17 +
18 +test_expect_success 'rebase --exec does not muck with GIT_WORK_TREE' '
19 + git rebase --exec "printf %s \$GIT_WORK_TREE >environ" HEAD~1 &&
20 + test_must_be_empty environ
21 +'
22 +
23 +test_done