From 43b258a54b49dac95af984073906d88965d37fe6 Mon Sep 17 00:00:00 2001
From: jaylfc <jaylfc25@gmail.com>
Date: Thu, 11 Jun 2026 05:41:18 +0100
Subject: [PATCH 1/2] fix(install): scope a safe.directory exception for the
 re-run update path (#765)

---
 scripts/install-server.sh | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/scripts/install-server.sh b/scripts/install-server.sh
index 7357105e5..cb8452ac0 100644
--- a/scripts/install-server.sh
+++ b/scripts/install-server.sh
@@ -980,7 +980,14 @@ if [[ ! -d "$INSTALL_DIR/.git" ]]; then
     git clone --depth 1 --branch "$BRANCH" "$REPO" "$INSTALL_DIR"
 else
     log "updating existing checkout"
-    (cd "$INSTALL_DIR" && git fetch --depth 1 origin "$BRANCH" && git reset --hard "origin/$BRANCH")
+    # The repo is chowned to the 'taos' service user at the end of every
+    # install, so a re-run (running as root) trips git's dubious-ownership
+    # check.  Scope a safe.directory exception to these two commands rather
+    # than polluting global git config; the post-install chown re-fixes the
+    # ownership of anything these create.
+    (cd "$INSTALL_DIR" \
+        && git -c safe.directory="$INSTALL_DIR" fetch --depth 1 origin "$BRANCH" \
+        && git -c safe.directory="$INSTALL_DIR" reset --hard "origin/$BRANCH")
 fi
 
 cd "$INSTALL_DIR"

From e0b166dedec3259e0a6034f3b86e3e7ec1106d97 Mon Sep 17 00:00:00 2001
From: jaylfc <jaylfc25@gmail.com>
Date: Thu, 11 Jun 2026 05:45:09 +0100
Subject: [PATCH 2/2] fix(install): drop to the repo owner for the re-run
 update instead of overriding git ownership trust

Running git as root inside a taos-owned tree (so a planted .git/config or
hook could execute as root) is the privilege-escalation the dubious-ownership
check guards against. Drop to the owning user for fetch/reset rather than
bypassing the check; run directly when root-owned or not running as root.
---
 scripts/install-server.sh | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/scripts/install-server.sh b/scripts/install-server.sh
index cb8452ac0..06da546d4 100644
--- a/scripts/install-server.sh
+++ b/scripts/install-server.sh
@@ -980,14 +980,20 @@ if [[ ! -d "$INSTALL_DIR/.git" ]]; then
     git clone --depth 1 --branch "$BRANCH" "$REPO" "$INSTALL_DIR"
 else
     log "updating existing checkout"
-    # The repo is chowned to the 'taos' service user at the end of every
-    # install, so a re-run (running as root) trips git's dubious-ownership
-    # check.  Scope a safe.directory exception to these two commands rather
-    # than polluting global git config; the post-install chown re-fixes the
-    # ownership of anything these create.
-    (cd "$INSTALL_DIR" \
-        && git -c safe.directory="$INSTALL_DIR" fetch --depth 1 origin "$BRANCH" \
-        && git -c safe.directory="$INSTALL_DIR" reset --hard "origin/$BRANCH")
+    # The repo is chowned to the 'taos' service user at the end of a system
+    # install, so a re-run (as root) trips git's dubious-ownership check.
+    # That check is guarding a real privilege-escalation path: running git as
+    # root inside a tree the unprivileged 'taos' user can write to would let a
+    # planted .git/config or hook execute as root.  So drop to the owning user
+    # for the update instead of overriding the check.  When the tree is already
+    # root-owned, or we are not root (user-mode / macOS install), run directly.
+    _repo_owner="$(stat -c '%U' "$INSTALL_DIR" 2>/dev/null || stat -f '%Su' "$INSTALL_DIR" 2>/dev/null || echo "")"
+    if [[ "$(id -u)" == "0" && -n "$_repo_owner" && "$_repo_owner" != "root" ]]; then
+        sudo -u "$_repo_owner" git -C "$INSTALL_DIR" fetch --depth 1 origin "$BRANCH" \
+            && sudo -u "$_repo_owner" git -C "$INSTALL_DIR" reset --hard "origin/$BRANCH"
+    else
+        (cd "$INSTALL_DIR" && git fetch --depth 1 origin "$BRANCH" && git reset --hard "origin/$BRANCH")
+    fi
 fi
 
 cd "$INSTALL_DIR"