Fix Windows packaging

[vvoland]

Adds the containerd path to safe directories to address the "dubious
ownership" error when building containerd in Windows container:

fatal: detected dubious ownership in repository at 'C:/gopath/src/github.com/containerd/containerd'

'C:/gopath/src/github.com/containerd/containerd' is owned by:

	NT AUTHORITY/SYSTEM (S-1-5-18)

but the current user is:

	User Manager/ContainerAdministrator (S-1-5-93-2-1)

[vvoland]

Note: I can't reproduce this on my local Windows machine.

Looks like the only difference is the Git version on the host:

CI

git version 2.44.0.windows.1

My system

git version 2.41.0.windows.1

EDIT: I tried with the same git version as the CI host and it still works fine

[thaJeztah]

Was also trying; and then for some reason it doesn't find the repo to be a git repo in the bind mount? Could that be related to version differences between host and container? #413

[vvoland]

Yeah I'm trying to see what the windows container sees in the workdir, but Windows still manages to outsmart me 🙈

[vvoland]

I can't reproduce it on my local machine (I installed the same git version on the host as the CI system)

[vvoland]

No idea, the .git directory is there on the container side:

docker run \
	--rm \
	-v "d:/jenkins/workspace/containerd-packaging_PR-414/src/:C:/gopath/src" \
	-v "d:/jenkins/workspace/containerd-packaging_PR-414/build/windows:C:/gopath/src/github.com/containerd/containerd/bin" \
	-w "C:/gopath/src/github.com/containerd/containerd" \
	dockereng/containerd-windows-builder \
	powershell.exe "Get-ChildItem -Force; make -d bin/containerd"
    Directory: C:\gopath\src\github.com\containerd\containerd
Mode                 LastWriteTime         Length Name                         
----                 -------------         ------ ----                         
d--h--         3/18/2025   6:37 PM                .git                         
d-----         3/18/2025   6:37 PM                .github                      
d-----         3/18/2025   6:37 PM                api                          
d-----         3/18/2025   6:37 PM                archive                      
d-----         3/18/2025   6:37 PM                bin                          
d-----         3/18/2025   6:37 PM                cio                          
d-----         3/18/2025   6:37 PM                cluster                      
d-----         3/18/2025   6:37 PM                cmd                          

But for some reason we get the not a git repository

CreateProcess(C:\git\usr\bin\sh.exe,C:/git/usr/bin/sh.exe -c "if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi",...)

warning: Not a git repository. Use --no-index to compare two paths outside a working tree

go build command also seems to fail due to git error:

go build  -gcflags=-trimpath=C/src  -o bin/containerd -ldflags '-X github.com/containerd/containerd/version.Version=05044ec -X github.com/containerd/containerd/version.Revision=05044ec0a9a75232cad458027ca83437aae3f4da.m -X github.com/containerd/containerd/version.Package=github.com/containerd/containerd -s -w ' -tags "urfave_cli_no_docs"  ./cmd/containerd

CreateProcess(C:\git\usr\bin\sh.exe,C:/git/usr/bin/sh.exe -c "go build  -gcflags=-trimpath=C/src  -o bin/containerd -ldflags '-X github.com/containerd/containerd/version.Version=05044ec -X github.com/containerd/containerd/version.Revision=05044ec0a9a75232cad458027ca83437aae3f4da.m -X github.com/containerd/containerd/version.Package=github.com/containerd/containerd -s -w ' -tags \"urfave_cli_no_docs\"  ./cmd/containerd",...)

Live child 0185ea28 (bin/containerd) PID 25569880 

error obtaining VCS status: exit status 128

	Use -buildvcs=false to disable VCS stamping.

[thaJeztah]

Could it be either permissions on the git directory or different format of the git directory data? (I know work is in progress to switch to sha512; wondering if some of the data format changed?)

I'd expect it to still detect it to be a git repository though (and wouldn't expect got itself to be incompatible THAT much)

[vvoland]

Heh, the git status seems to work just fine:

docker run \

	--rm \

	-v "d:/jenkins/workspace/containerd-packaging_PR-414/src/:C:/gopath/src" \

	-v "d:/jenkins/workspace/containerd-packaging_PR-414/build/windows:C:/gopath/src/github.com/containerd/containerd/bin" \

	-w "C:/gopath/src/github.com/containerd/containerd" \

	dockereng/containerd-windows-builder \

	powershell.exe '$env:GIT_TRACE2 = "1"; git status'

11:52:57.872190 common-main.c:57                  version 2.48.1.windows.1

11:52:57.873183 common-main.c:58                  start git.exe status

11:52:57.881278 repository.c:241                  worktree C:/gopath/src/github.com/containerd/containerd

11:52:57.883569 git.c:477                         cmd_name status (status)

HEAD detached at FETCH_HEAD

nothing to commit, working tree clean

11:52:58.370804 git.c:745                         exit elapsed:0.561884 code:0

11:52:58.370804 trace2/tr2_tgt_normal.c:128       atexit elapsed:0.561940 code:0

[thaJeztah]

Could it be either a permission issue, or some security software that's running on these machines that block access to files? 🤔

[vvoland]

Not really, overall git works before running make, and in make SOME of git commands work while other don't.

Like:

CreateProcess(C:\git\cmd\git.exe,git describe --match v[0-9]* --dirty=.m --always,...)

12:18:19.908581 common-main.c:57                  version 2.48.1.windows.1

12:18:19.910582 common-main.c:58                  start git.exe describe --match 'v[0-9]*' --dirty=.m --always

12:18:19.921332 repository.c:241                  worktree C:/gopath/src/github.com/containerd/containerd

12:18:19.924221 git.c:477                         cmd_name describe (describe)

12:18:20.125554 git.c:745                         exit elapsed:0.263580 code:0

12:18:20.125554 trace2/tr2_tgt_normal.c:128       atexit elapsed:0.263638 code:0

works fine, but:

CreateProcess(C:\git\usr\bin\sh.exe,C:/git/usr/bin/sh.exe -c "if ! git diff --no-ext-diff --quiet --exit-code; then echo .m; fi",...)

11:57:22.096457 common-main.c:57                  version 2.48.1.windows.1

11:57:22.097464 common-main.c:58                  start git.exe diff --no-ext-diff --quiet --exit-code

11:57:22.103295 git.c:477                         cmd_name diff (diff)

11:57:22.110970 usage.c:91                        error Not a git repository. Use --no-index to compare two paths outside a working tree

warning: Not a git repository. Use --no-index to compare two paths outside a working tree

usage: git diff --no-index [<options>] <path> <path>

does not (there's no debug message for working dir - somehow it doesn't execute in the correct directory?)