Comment 1 for bug 1968798

https://review.opendev.org/c/openstack/devstack/+/837636

is one potential solution; that chowns the checked-out directories as root:root. it may be a bit whack-a-mole finding places that want to fiddle with the source directories for various reasons.

using "git config" to mark the directories as "safe" is also an option. it doesn't feel like the type of thing we should be doing to a users machine -- but then again devstack takes over everything else anyway ...

Unfortunately, per the docs in the original commit, you can *not* just use "-c" to set one directory as safe from the git command-line. That basically rules out PBR being able to override this (the theory being, if you're telling PBR to install a source tree, then you trust that directory).

Other suggestion has been to install from a shallow clone. Some question over how PBR would cope with this.

The other approach is to completely ditch all this global install and use virtualenvs. Which I think we can all agree is probably a good idea, but has many implications for a) just getting that working in devstack and then b) bringing along every project and its plugins ...