[2.20.5 regression] `nix eval` fails with `'/etc/nixos': ... is not owned by current user`

[trofi]

[2.20.5 regression] `nix eval` fails with `'/etc/nixos': ... is not owned by current user`

[thufschmitt]

Yes, that's very likely a consequence of https://nvd.nist.gov/vuln/detail/CVE-2022-24765 from the Git side.

We could probably specify the path to the git repo explicitly to disable that check when we know it's safe (and once #6464 is merged 😒 )

[trofi]

Currently working it around with $ git config --global --add safe.directory /etc/nixos as current user.

[arcuru]

I suspect I hit the same issue after updating. Same nix version (2.20.5) but I am using a flake repo in my home directory to manage my NixOS machine.

sudo nixos-rebuild failed because of the ownership issue, and being on nixos using a nixos-rebuild switch command failed for the user. I needed to change the ownership of my flake repo to root to let me update.

sudo works above because your /etc/nixos is owned by root.

❯ sudo nixos-rebuild switch --flake .#carbon
error:
       … while fetching the input 'git+file:///home/patrick/.dotfiles'

       error: opening Git repository '/home/patrick/.dotfiles': repository path '/home/patrick/.dotfiles/' is not owned by current user
❯ nixos-rebuild switch --flake .#carbon
building the system configuration...
error: creating symlink from '/nix/var/nix/profiles/.0_system' to 'system-745-link': Permission denied
❯ sudo chown root /home/patrick/.dotfiles/ -R
❯ sudo nixos-rebuild switch --flake .#carbon
building the system configuration
<----snipped---->