Use --git-dir to avoid issues with CVE-2022-24765 mitigation

src/setuptools_scm/git.py

@@ -36,7 +36,10 @@ class GitWorkdir(Workdir):
     def from_potential_worktree(cls, wd):
         require_command(cls.COMMAND)
         wd = os.path.abspath(wd)
-        real_wd, _, ret = do_ex("git rev-parse --show-prefix", wd)
+        git_dir = join(wd, ".git")
+        real_wd, _, ret = do_ex(
+            ["git", "--git-dir", git_dir, "rev-parse", "--show-prefix"], wd
+        )
         real_wd = real_wd[:-1]  # remove the trailing pathsep
         if ret:
             return
@@ -54,23 +57,26 @@ def from_potential_worktree(cls, wd):
 
         return cls(real_wd)
 
+    def do_ex_git(self, cmd):
+        return self.do_ex(["git", "--git-dir", join(self.path, ".git")] + cmd)
+
     def is_dirty(self):
-        out, _, _ = self.do_ex("git status --porcelain --untracked-files=no")
+        out, _, _ = self.do_ex_git(["status", "--porcelain", "--untracked-files=no"])
         return bool(out)
 
     def get_branch(self):
-        branch, err, ret = self.do_ex("git rev-parse --abbrev-ref HEAD")
+        branch, err, ret = self.do_ex_git(["rev-parse", "--abbrev-ref", "HEAD"])
         if ret:
             trace("branch err", branch, err, ret)
-            branch, err, ret = self.do_ex("git symbolic-ref --short HEAD")
+            branch, err, ret = self.do_ex_git(["symbolic-ref", "--short", "HEAD"])
             if ret:
                 trace("branch err (symbolic-ref)", branch, err, ret)
                 branch = None
         return branch
 
     def get_head_date(self):
-        timestamp, err, ret = self.do_ex(
-            "git -c log.showSignature=false log -n 1 HEAD --format=%cI"
+        timestamp, err, ret = self.do_ex_git(
+            ["-c", "log.showSignature=false", "log", "-n", "1", "HEAD", "--format=%cI"]
         )
         if ret:
             trace("timestamp err", timestamp, err, ret)
@@ -86,19 +92,22 @@ def is_shallow(self):
         return isfile(join(self.path, ".git/shallow"))
 
     def fetch_shallow(self):
-        self.do_ex("git fetch --unshallow")
+        self.do_ex_git(["fetch", "--unshallow"])
 
     def node(self):
-        node, _, ret = self.do_ex("git rev-parse --verify --quiet HEAD")
+        node, _, ret = self.do_ex_git(["rev-parse", "--verify", "--quiet", "HEAD"])
         if not ret:
             return node[:7]
 
     def count_all_nodes(self):
-        revs, _, _ = self.do_ex("git rev-list HEAD")
+        revs, _, _ = self.do_ex_git(["rev-list", "HEAD"])
         return revs.count("\n") + 1
 
     def default_describe(self):
-        return self.do_ex(DEFAULT_DESCRIBE)
+        git_dir = join(self.path, ".git")
+        return self.do_ex(
+            DEFAULT_DESCRIBE[:1] + ["--git-dir", git_dir] + DEFAULT_DESCRIBE[1:]
+        )
 
 
 def warn_on_shallow(wd):

testing/test_git.py

@@ -1,4 +1,6 @@
 import os
+import shutil
+import subprocess
 import sys
 from datetime import date
 from datetime import datetime
@@ -92,6 +94,43 @@ def test_parse_call_order(wd):
     git.parse(str(wd.cwd), git.DEFAULT_DESCRIBE)
 
 
+@pytest.mark.issue("https://github.com/pypa/setuptools_scm/issues/707")
+@pytest.mark.xfail(run=False, reason="This test requires passwordless sudo")
+def test_not_owner(wd):
+    git_dir = opj(wd.cwd)
+    original_stat = os.stat(git_dir)
+    if not shutil.which("sudo"):
+        pytest.skip("sudo executable not found")
+
+    proc = subprocess.run(
+        ["sudo", "chown", "-R", "12345", git_dir], stdin=subprocess.DEVNULL
+    )
+    if proc.returncode != 0:
+        pytest.skip("Failed to change ownership, is passwordless sudo available?")
+    try:
+        subprocess.run(
+            ["sudo", "chmod", "a+r", git_dir], stdin=subprocess.DEVNULL, check=True
+        )
+        subprocess.run(
+            ["sudo", "chgrp", "-R", "12345", git_dir],
+            stdin=subprocess.DEVNULL,
+            check=True,
+        )
+        assert git.parse(str(wd.cwd))
+    finally:
+        # Restore the ownership
+        subprocess.run(
+            ["sudo", "chown", "-R", str(original_stat.st_uid), git_dir],
+            stdin=subprocess.DEVNULL,
+            check=True,
+        )
+        subprocess.run(
+            ["sudo", "chgrp", "-R", str(original_stat.st_gid), git_dir],
+            stdin=subprocess.DEVNULL,
+            check=True,
+        )
+
+
 def test_version_from_git(wd):
     assert wd.version == "0.1.dev0"