fix(git): drop safe.directory=* and fetch.pruneTags, fix deprecated keys and whichside colours (#66) - #92
Draft
AH-Merii wants to merge 1 commit into
Draft
fix(git): drop safe.directory=* and fetch.pruneTags, fix deprecated keys and whichside colours (#66)#92AH-Merii wants to merge 1 commit into
AH-Merii wants to merge 1 commit into
Conversation
…eys and whichside colours (#66) safe.directory = * disabled the ownership check that CVE-2022-24765 relies on, and core.fsmonitor = true made a foreign-owned repo an easy vector; per-machine entries go in config.local instead. fetch.pruneTags with fetch.prune deleted unpushed local tags on every fetch, and with fetch.all churned tags present on one remote only. Also: versionsort.prereleaseSuffix -> versionsort.suffix (deprecated alias), guard the core.pager tput call when TERM is unset, spell out rm --cached in the untrack alias, and build git-whichside colours with printf since bash's echo (/bin/sh on Arch) prints \033 from a variable literally. filter.lfs.required stays; git-lfs is now installed by mise and listed under Requirements. README brought in line: no safe.directory recommendation, credential / LFS / include sections added so the reference really covers every option, key rotation notes allowed_signers and the GitHub upload, and the key path example matches ggh's name_lower (github_jane-doe).
AH-Merii
commented
Sep 9, 2026
| bat = "latest" | ||
| eza = "latest" | ||
| delta = "latest" | ||
| # base/git/.config/git/config sets filter.lfs.required, so LFS checkouts fail without this |
Owner
Author
There was a problem hiding this comment.
btw: I added git-lfs here because we were not installing it anywhere, not in pkglist/ and not in the Brewfile, even though base/git/.config/git/config already sets filter.lfs.required = true. So an LFS clone would have failed on any machine set up from this repo, and the next mise install is what makes that setting honest.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
[safe] directory = *opts out of git's ownership check completely, and this config also setscore.fsmonitor = true, so cd-ing into a repo owned by another user was enough to have git run a command from that repo's config on the nextgit status. Per-machine exceptions belong in the untrackedconfig.local, and asafe.directorythere is still read as protected configuration, so nothing is given up by removing the blanket one.fetch.pruneTagsdeletes any local tag that is not on the remote, so local-only tags disappeared on every fetch.The rest is drift: a
versionsortkey that is now a deprecated alias, acore.pagerwidth check that errored withTERMunset, an alias that only worked through prefix abbreviation, andgit-whichsideprinting\033[1mliterally becauseshis bash here and itsechodoes not interpret escapes.Closes #66