2022-04-17, 02:47
Just an FYI in case you see this and start searching around for answers.
I use "github desktop" app on Windows 10 to do most of my git management of git repos. Today I installed the latest version 2.9.14 released on 14 Apr, and immediately I got alerts on opening one of my repos about potential security problem due to repo being owned by another user. Github desktop was providing an option to "trust" the repo, but I was getting this for every repo.
From searching around I found the root cause was a CVE against git that was recently resolved about this (which is what caused the alert) and the 14 Apr change in github desktop was to provide the option to trust the repo.
But for me the root issue is that I have all my repos within a "Github" folder in Windows user\My documents (probably not a good idea but I don't want to screw around changing now). It turned out the owner of that "Github" folder and repo subfolders was "Guest" (not sure why, assume a windows thing). So in the properties/security/advanced settings I changed owner to my windows user for Github folder and all subfolders/files. That got rid of the alert in github desktop. I don't think that has any side effects in Windows (at least that I can see for now)
Might add I only have a single, local account on this machine, no microsoft accounts.
scott s.
.
I use "github desktop" app on Windows 10 to do most of my git management of git repos. Today I installed the latest version 2.9.14 released on 14 Apr, and immediately I got alerts on opening one of my repos about potential security problem due to repo being owned by another user. Github desktop was providing an option to "trust" the repo, but I was getting this for every repo.
From searching around I found the root cause was a CVE against git that was recently resolved about this (which is what caused the alert) and the 14 Apr change in github desktop was to provide the option to trust the repo.
But for me the root issue is that I have all my repos within a "Github" folder in Windows user\My documents (probably not a good idea but I don't want to screw around changing now). It turned out the owner of that "Github" folder and repo subfolders was "Guest" (not sure why, assume a windows thing). So in the properties/security/advanced settings I changed owner to my windows user for Github folder and all subfolders/files. That got rid of the alert in github desktop. I don't think that has any side effects in Windows (at least that I can see for now)
Might add I only have a single, local account on this machine, no microsoft accounts.
scott s.
.
