Upgrade from 3.2 to 3.2.1...fatal: unsafe repository ('/opt/netbox' is owned by someone else)

[TheDirkMelvin]

Ubuntu 20.04.4

Just following the normal 'clone repository' method of upgrading....
cd /opt/netbox
sudo git checkout master
^^^^on this step I get the response: fatal: unsafe repository ('/opt/netbox' is owned by someone else)

I have upgraded our Netbox instance many time over the last year or two and not had this issue.

Can anyone explain what is causing this? And how to fix it?

[candlerb]

You didn't say what OS you're using, but if it's Ubuntu or Debian or similar, I suspect it is this:

# apt-get changelog git
git (1:2.25.1-1ubuntu3.3) focal-security; urgency=medium

  * SECURITY UPDATE: Run commands in diff users
    - debian/patches/CVE-2022-24765-*.patch: fix GIT_CEILING_DIRECTORIES; add
      an owner check for the top-level-directory; add a function to
      determine whether a path is owned by the current user in patch.c,
      t/t0060-path-utils.sh, setup.c, compat/mingw.c, compat/mingw.h,
      git-compat-util.h.
    - CVE-2022-24765

 -- Leonidas Da Silva Barbosa <[email protected]>  Fri, 08 Apr 2022 09:57:16 -0300

I presume the fix would be to check the ownership of the files (specifically /opt/netbox and/or /opt/netbox/.git). If you're doing a git checkout as root, then it will expect them to be owned by root.

I think that's good practice anyway - you don't want the netbox user to be able to modify its own code. However you do need certain subdirectories to be owned by netbox, particularly /opt/netbox/netbox/media

[TheDirkMelvin]

Yes, Ubuntu 20.04.4....
So this is obviously dangerous to just recursively apply. I am not sure how I am the only/first to report this issue. I have always followed the Netbox install/update steps using SUDO (all updates have been by cloning the repo and never logged in as root user, just a normal user with sudo). So why are the files/folders in /opt/netbox/ owned and grouped between both root and netbox users?

Looks like most of the folders are group/own by 'netbox' (except 'logs' and 'venv' which are group/own by 'root')
And the files are group/own by 'root' (except local_requirements.txt group/own by 'netbox')

Again since I don't believe I have veered from the documented install/update for Netbox, I would think this would be the same for the majority installed Ubuntu instances for Netbox.

So now, how do we know which files/folders should be owned by which user/group?