Can't pass octals to --change-permissions (GIT_SYNC_PERMISSIONS)

[akloeckner]

Hi there,

Thanks for this nice piece of software!

I'm using git-sync (latest = v3.2.1) to clone a repo into a named volume and access it from another container for some post-processing. I'm struggling with the permissions however. (I'm new to containers, so that might just be me.)

As git-sync creates everything as the 65533 user but my other container obviously does not, I thought I'd set the GIT_SYNC_PERMISSIONS variable to 777. However, that actually changes the permissions to something seemingly random.

After some trial and error, I figured out that the octal 777 was apparently converted to a decimal number and passed on to chmod. But chmod expects an octal number. So, I tried the decimal equivalent of GIT_SYNC_PERMISSIONS='511', which actually worked:

$ /git-sync
I0106 00:44:12.602504      12 main.go:430]  "level"=0 "msg"="starting up"  "args"=["/git-sync"] "pid"=12
[...cloning logs...]
I0106 00:44:26.054483      12 main.go:652]  "level"=0 "msg"="changing file permissions"  "mode"="0777"

$ ls -la
total 20
drwxrwxrwt 5 root     root  4096 Jan  6 00:44 .
drwxr-xr-x 1 root     root  4096 Jan  6 00:43 ..
drwxr-xr-x 9 git-sync 65533 4096 Jan  6 00:44 .git
drwx------ 2 git-sync 65533 4096 Jan  6 00:44 .ssh
lrwxrwxrwx 1 git-sync 65533   44 Jan  6 00:44 deploy -> rev-874f48bce4069af461bc2f23e785d7ffa722ea96
drwxrwxrwx 7 git-sync 65533 4096 Jan  6 00:44 rev-874f48bce4069af461bc2f23e785d7ffa722ea96

$ set
GIT_KNOWN_HOSTS='false'
GIT_SSH_KEY_FILE='/etc/git-secret/id_rsa_docker'
GIT_SYNC_BRANCH='deploy'
GIT_SYNC_DEST='deploy'
GIT_SYNC_PERMISSIONS='511'
GIT_SYNC_REPO='[obscured]'
GIT_SYNC_ROOT='/tmp'
GIT_SYNC_SSH='true'
GIT_SYNC_TIMEOUT='120'
GIT_SYNC_WAIT='30'
HOME='/tmp'
HOSTNAME='c494b3dcc487'
IFS=' 
'
OPTIND='1'
PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'
PPID='0'
PS1='$ '
PS2='> '
PS4='+ '
PWD='/tmp'
TERM='xterm'
_='-la'

In summary, I believe something goes wrong with octal/decimal conversion and it's bound to be in that area:

git-sync/cmd/git-sync/main.go

Line 649 in 8ce96b3

// Change the file permissions, if requested.

[thockin]

The problem is that 777 is not an octal number. 0777 is. The parsing "problem" is in the YAML, where you unintentionally ran afoul of the grammar.

…

On Tue, Jan 5, 2021, 5:03 PM akloeckner ***@***.***> wrote: Hi there, Thanks for this nice piece of software! I'm using git-sync (latest = v3.2.1) to clone a repo into a named volume and access it from another container for some post-processing. I'm struggling with the permissions however. (I'm new to containers, so that might just be me.) As git-sync creates everything as the 65533 user but my other container obviously does not, I thought I'd set the GIT_SYNC_PERMISSIONS variable to 777. However, that actually changes the permissions to something seemingly random. After some trial and error, I figured out that the octal 777 was apparently converted to a decimal number and passed on to chmod. But chmod expects an octal number. So, I tried the decimal equivalent of GIT_SYNC_PERMISSIONS='511', which actually worked: $ /git-sync I0106 00:44:12.602504 12 main.go:430] "level"=0 "msg"="starting up" "args"=["/git-sync"] "pid"=12 [...cloning logs...] I0106 00:44:26.054483 12 main.go:652] "level"=0 "msg"="changing file permissions" "mode"="0777" $ ls -la total 20 drwxrwxrwt 5 root root 4096 Jan 6 00:44 . drwxr-xr-x 1 root root 4096 Jan 6 00:43 .. drwxr-xr-x 9 git-sync 65533 4096 Jan 6 00:44 .git drwx------ 2 git-sync 65533 4096 Jan 6 00:44 .ssh lrwxrwxrwx 1 git-sync 65533 44 Jan 6 00:44 deploy -> rev-874f48bce4069af461bc2f23e785d7ffa722ea96 drwxrwxrwx 7 git-sync 65533 4096 Jan 6 00:44 rev-874f48bce4069af461bc2f23e785d7ffa722ea96 $ set GIT_KNOWN_HOSTS='false' GIT_SSH_KEY_FILE='/etc/git-secret/id_rsa_docker' GIT_SYNC_BRANCH='deploy' GIT_SYNC_DEST='deploy' GIT_SYNC_PERMISSIONS='511' GIT_SYNC_REPO='[obscured]' GIT_SYNC_ROOT='/tmp' GIT_SYNC_SSH='true' GIT_SYNC_TIMEOUT='120' GIT_SYNC_WAIT='30' HOME='/tmp' HOSTNAME='c494b3dcc487' IFS=' ' OPTIND='1' PATH='/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin' PPID='0' PS1='$ ' PS2='> ' PS4='+ ' PWD='/tmp' TERM='xterm' _='-la' In summary, I believe something goes wrong with octal/decimal conversion and it's bound to be in that area: https://github.com/kubernetes/git-sync/blob/8ce96b33d3df0b84b80a5d459c92039904e9ad8e/cmd/git-sync/main.go#L649 — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#320>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABKWAVGDNKNQAG2RY5M5L6LSYOZG7ANCNFSM4VWWBEAQ> .

[thockin]

Just to follow up:

The YAML spec seems to have changed between 1.1 and 1.2. 1.1 interpreted 0777 as an octal number, but 1.2 interprets that as a decimal, with 0o777 as the octal spelling. I'm flabbergasted that such a breaking change would be allowed, and it's clear that different parsers do/don't get this strictly right.

As such I can not endorse using octal AT ALL in YAML. You just can't know how it will be interpreted.

JSON supports neither syntax, which is similarly baffling, but at least it hasn't CHANGED (and JSON is know to be absurdly reductivist).

[akloeckner]

Thanks for clarifying. Still, I tried 0777 and it gives the same error. I'm not using YAML at all (yet). I'm passing ENV variables in Docker.

What is the recommended way then, to make the checked out files accessible in other containers? Should I use 0o777? Or is there even a cleaner way to pass the data to another container for post-processing (= yarn building a node app in my case).

[thockin]

OH. I missed that you were setting this through the git-sync mechanism rather than the k8s mechanism.

Yes, you have hit a bug! It mis-parses.

[akloeckner]

Thanks for this quick resolution!!

[thockin]

I'll have to queue up a build

[thockin]

Available for test as gcr.io/k8s-staging-git-sync/git-sync:v3.2.2

Promotion to prod in kubernetes/k8s.io#1510

[thockin]

https://github.com/kubernetes/git-sync/releases/tag/v3.2.2

[akloeckner]

👍 Seems to work. Thanks a lot!