On a trixie/sid VM, if I install git-daemon-run (which runs git-daemon(1)
as an unprivileged user 'gitdaemon') and ask it to export a git repo
owned by a different unprivileged user, that's allowed by default:
----8<----
[as root]
# apt -t trixie install git-daemon-run
(installs version 2.43.0-1)
# cd /var/lib/git
# install -d -m755 -ouser user              # "user" is an unprivileged uid

[as user]
$ cd /var/lib/git/user
$ git clone --bare https://salsa.debian.org/debian/hello.git    # or any repo
$ touch hello.git/git-daemon-export-ok
$ cd ~
$ git clone git://localhost/git/user/hello.git
(succeeds)
---->8----

But if I upgrade src:git from trixie to sid, git-daemon no longer serves
the repository:

----8<----
$ cd ~
$ git clone git://localhost/git/user/hello.git again
Cloning into 'again'...
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
---->8----

The log says:

----8<----
2024-07-22_22:40:20.65793 [11037] Connection from [::1]:40270
2024-07-22_22:40:20.65795 [11037] Extended attribute "host": localhost
2024-07-22_22:40:20.65795 [11037] Extended attribute "protocol": version=2
2024-07-22_22:40:20.65795 [11037] Request upload-pack for '/git/user/hello.git'
2024-07-22_22:40:20.65800 fatal: detected dubious ownership in repository at '/var/lib/git/user/hello.git'
2024-07-22_22:40:20.65800 To add an exception for this directory, call:
2024-07-22_22:40:20.65800
2024-07-22_22:40:20.65801       git config --global --add safe.directory /var/lib/git/user/hello.git
2024-07-22_22:40:20.65816 [11003] [11037] Disconnected (with error)
---->8----

Is this intentional?

My understanding had been that git-daemon(1) is one of the recommended
ways to provide safe read-only access to a git repo belonging to another
user, in a way that is not susceptible to attacks on the local cloning
protocol such as CVE-2024-32020 - so I would have expected that it
would not have required the "safe.directory" configuration parameter?
https://git-scm.com/docs/git says "The safest thing is to serve the
repository as an unprivileged user (either via git-daemon[1], ...)"
which I had interpreted as meaning that git-daemon ought to be a suitable
tool for this job.

Obviously I could have chosen to run git-daemon(1) as the repository owner,
or equivalently I could have made hello.git be owned by 'gitdaemon' - but
if I had done that, then it would be possible for a bug or misconfiguration
in git-daemon(1) to grant write access to hello.git. So it seems like it
ought to be best-practice to run a read-only git-daemon(1) as a uid that
*doesn't* own the canonical repository?

Or, if this behaviour change was intentional, what is the recommended
way to configure the 'gitdaemon' user to tell it to trust repositories
below /var/lib/git?

This behaviour change is causing an autopkgtest regression in
ikiwiki-hosting, in which the ikiwiki-hosting-web package runs its own
instance of git-daemon(1) as a different unprivileged user 'ikiwiki-anon'
and uses it to export repositories in /var/lib/ikiwiki-hosting-web/git
which are owned by various other users. ikiwiki-hosting is relatively
complicated, so the reproducer above is a somewhat simplified version of
what it's doing, allowing the regression to be reproduced without
actually installing ikiwiki-hosting. I'll report a separate bug against
ikiwiki-hosting for the autopkgtest regression.

The ikiwiki-hosting autopkgtest regression, in turn, is preventing
git from migrating to testing. Obviously git is more important than
ikiwiki-hosting, so if removing ikiwiki-hosting from testing is the
only way to get git migrated soon, we can do that - but I'd like to
know what ikiwiki-hosting or other users of git-daemon(1) are meant to
be doing differently.

Thanks,
    smcv

<https://bugs.debian.org/1076751>

For ikiwiki-hosting, the 'ikiwiki-anon' user that runs git-daemon(1)
happens to have a home directory, so it is possible to configure its
~/.gitconfig without affecting other users. The least bad version I've
found so far is to write

    [safe]
    directory=*

into /var/lib/ikiwiki-hosting-web/git/.gitconfig (which can be owned by
root). I'd prefer a less brute-force version of this, but the first thing
I tried,

    [safe]
    directory=/var/lib/ikiwiki-hosting-web/git/*

didn't seem to be successful.

For git-daemon-run, this technique is not available, because the
'gitdaemon' user doesn't have a home directory (its home is /nonexistent)
so it does not seem to be possible to configure it without affecting
unrelated git clients.

Is there a better way that I'm not seeing?

Thanks,
    smcv