Repository: conda/conda-build

Issue:
fatal: transport 'file' not allowed
### Checklist

- [X] I added a descriptive title
- [X] I searched open reports and couldn't find a duplicate

### What happened?

I have a recipe which involves a git repo with submodules:
```
 source:
  # use git because no tarball including submodules is available
  git_url: https://github.com/OpenModelica/OpenModelica.git
  git_tag: v{{ version }}
```

building that recipe fails:
```
Cloning into '/tmp/tmpgjcqvc0a'...
2023-05-22T13:56:30.3584893Z done.
2023-05-22T13:56:30.4132008Z Submodule 'OMCompiler/3rdParty' (/home/conda/feedstock_root/build_artifacts/git_cache/github.com/OpenModelica/OMCompiler-3rdParty) registered for path 'OMCompiler/3rdParty'
2023-05-22T13:56:30.4139204Z Submodule 'OMOptim' (/home/conda/feedstock_root/build_artifacts/git_cache/github.com/OpenModelica/OMOptim.git) registered for path 'OMOptim'
2023-05-22T13:56:30.4145523Z Submodule 'OMSens' (/home/conda/feedstock_root/build_artifacts/git_cache/github.com/OpenModelica/OMSens.git) registered for path 'OMSens'
2023-05-22T13:56:30.4152254Z Submodule 'OMSens_Qt' (/home/conda/feedstock_root/build_artifacts/git_cache/github.com/OpenModelica/OMSens_Qt.git) registered for path 'OMSens_Qt'
2023-05-22T13:56:30.4158876Z Submodule 'OMSimulator' (/home/conda/feedstock_root/build_artifacts/git_cache/github.com/OpenModelica/OMSimulator.git) registered for path 'OMSimulator'
2023-05-22T13:56:30.4193694Z Cloning into '/home/conda/feedstock_root/build_artifacts/omcompiler_1684763549194/work/OMCompiler/3rdParty'...
2023-05-22T13:56:30.4212953Z fatal: transport 'file' not allowed
2023-05-22T13:56:30.4222385Z fatal: clone of '/home/conda/feedstock_root/build_artifacts/git_cache/github.com/OpenModelica/OMCompiler-3rdParty' into submodule path '/home/conda/feedstock_root/build_artifacts/omcompiler_1684763549194/work/OMCompiler/3rdParty' failed
2023-05-22T13:56:30.4226913Z Failed to clone 'OMCompiler/3rdParty'. Retry scheduled
```

apparently this is due to a security fix in git
https://vielmetti.typepad.com/logbook/2022/10/git-security-fixes-lead-to-fatal-transport-file-not-allowed-error-in-ci-systems-cve-2022-39253.html

a possible workaround is to clone with git option `protocol.file.allow=always`



### Conda Info

```shell
https://dev.azure.com/conda-forge/feedstock-builds/_build?definitionId=6158&_a=summary
```


### Conda Config

```shell
https://dev.azure.com/conda-forge/feedstock-builds/_build?definitionId=6158&_a=summary
```


### Conda list

```shell
https://dev.azure.com/conda-forge/feedstock-builds/_build?definitionId=6158&_a=summary
```


### Additional Context

https://github.com/conda-forge/omcompiler-feedstock


Discussion:
Not sure if it's the same reason, but it's at least related to failing to clone git repos, which has happened for the last couple of days on the pytorch feedstock, with consistent failures like:
```
Cloning into bare repository '/home/conda/feedstock_root/build_artifacts/git_cache/github.com/pytorch/pytorch.git'...
error: RPC failed; HTTP 408 curl 18 HTTP/2 stream 7 was reset
fatal: expected 'packfile'
Cloning into bare repository '/home/conda/feedstock_root/build_artifacts/git_cache/github.com/pytorch/pytorch.git'...
error: RPC failed; HTTP 408 curl 18 HTTP/2 stream 7 was reset
fatal: expected 'packfile'
Warning: failed to download source. 
```
@jschueller thanks for reporting this, we are also experiencing this issue with our test suite: https://github.com/conda/conda-build/actions/runs/5256288090/jobs/9508303525

until we are able to implement a fix, either changing your recipe to require `git<2.37.4` or run `git config --global protocol.file.allow always` before running `conda build` will do the trick

Resolving patch:
diff --git a/conda_build/source.py b/conda_build/source.py
--- a/conda_build/source.py
+++ b/conda_build/source.py
@@ -400,7 +400,15 @@ def git_mirror_checkout_recursive(
         # Now that all relative-URL-specified submodules are locally mirrored to
         # relatively the same place we can go ahead and checkout the submodules.
         check_call_env(
-            [git, "submodule", "update", "--init", "--recursive"],
+            [
+                git,
+                # CVE-2022-39253
+                *("-c", "protocol.file.allow=always"),
+                "submodule",
+                "update",
+                "--init",
+                "--recursive",
+            ],
             cwd=checkout_dir,
             stdout=stdout,
             stderr=stderr,


Test patch:
diff --git a/tests/test_api_build.py b/tests/test_api_build.py
--- a/tests/test_api_build.py
+++ b/tests/test_api_build.py
@@ -684,6 +684,8 @@ def test_relative_git_url_submodule_clone(testing_workdir, testing_config, monke
             check_call_env(
                 [
                     git,
+                    # CVE-2022-39253
+                    *("-c", "protocol.file.allow=always"),
                     "submodule",
                     "add",
                     convert_path_for_cygwin_or_msys2(git, absolute_sub),
@@ -692,14 +694,33 @@ def test_relative_git_url_submodule_clone(testing_workdir, testing_config, monke
                 env=sys_git_env,
             )
             check_call_env(
-                [git, "submodule", "add", "../relative_sub", "relative"],
+                [
+                    git,
+                    # CVE-2022-39253
+                    *("-c", "protocol.file.allow=always"),
+                    "submodule",
+                    "add",
+                    "../relative_sub",
+                    "relative",
+                ],
                 env=sys_git_env,
             )
         else:
             # Once we use a more recent Git for Windows than 2.6.4 on Windows or m2-git we
             # can change this to `git submodule update --recursive`.
             gits = git.replace("\\", "/")
-            check_call_env([git, "submodule", "foreach", gits, "pull"], env=sys_git_env)
+            check_call_env(
+                [
+                    git,
+                    # CVE-2022-39253
+                    *("-c", "protocol.file.allow=always"),
+                    "submodule",
+                    "foreach",
+                    gits,
+                    "pull",
+                ],
+                env=sys_git_env,
+            )
         check_call_env(
             [git, "commit", "-am", f"added submodules@{tag}"], env=sys_git_env
         )