Re: BUG: git clean -d cannot remove files from read-only directories

["brian m. carlson" <sandals@crustytoothpaste.net>]

[-- Attachment #1: Type: text/plain, Size: 1988 bytes --]

On 2020-02-20 at 18:27:22, Adam Milazzo wrote:
> Repro steps:
> 1. git init
> 2. mkdir d
> 3. touch d/a
> 4. chmod -w d
> 5. git clean -fd
> 
> Actual result:
> Git doesn't remove anything, saying "warning: failed to remove d/a".
> 
> Expected result:
> Git should remove the subdirectory 'd' along with its contents. Note that git can remove a read-only file (touch b; chmod -w b; git clean -f) with no problem.

I don't believe git should depart from rm in this regard.  I believe
that in general, Unix has stood the test of time, and when in doubt, we
should behave as Unix utilities do.

Note that other utilities (such as Perl) which have implemented
different behavior (usually for compatibility with Windows) have found
themselves with security vulnerabilities in that behavior.  That seems
like a prudent reason not to replicate it.

> Why this is important:
> * This has a significant impact in real scenarios: the go language,
>   when using modules, will download referenced modules and place them
>   in read-only directories inside a cache directory, potentially
>   inside the git repository. These cached modules can't be cleaned up
>   by git clean. (Furthermore, git clean then returns a failure status
>   code, which causes our build system to fail. I don't want to ignore
>   the failure code.)

This sounds like the real problem.  Why is Go placing data in cache
directories that are read-only?  Cache directories are explicitly
ephemeral and should be able to be destroyed at any time.  You'll
probably find more luck convincing the Go maintainers that their caches
should be temporary than you will us that git clean should be your
automatic destroyer of data.  Rust, for example, doesn't do this.

You could also just move your cache directories into $TMPDIR/go-cache
and then do "chmod -R u+w $TMPDIR/go-cache/* && rm -fr $TMPDIR/go-cache/*".
-- 
brian m. carlson: Houston, Texas, US
OpenPGP: https://keybase.io/bk2204

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 868 bytes --]