fix: don't apply the caller's GIT_INDEX_FILE or GIT_WORK_TREE to a new clone

Cargo.toml

@@ -344,6 +344,7 @@ pedantic = { level = "warn", priority = -1 }
 
 #
 # Reviewed and allowed lints
+assert_is_empty = "allow" # Keep emptiness assertions usable without requiring `Debug` and `PartialEq`.
 needless_continue = "allow"
 enum_glob_use = "allow"  # x97
 missing_errors_doc = "allow"  # x1792

gix-config/src/lib.rs

@@ -50,6 +50,7 @@
 )]
 #![cfg_attr(all(doc, feature = "document-features"), feature(doc_cfg))]
 #![deny(missing_docs, unsafe_code)]
+#![allow(rustdoc::redundant_explicit_links)] // Rust 1.99 flags links in re-exported documentation.
 
 pub mod file;
 

gix-features/src/parallel/in_parallel.rs

@@ -192,6 +192,7 @@ where
 /// `threads_left` tracks capacity for nested work. A consumer may reserve capacity with `fetch_sub` before
 /// spawning work and must release it with `fetch_add` afterward. Do this only after consuming an item, as the
 /// slice workers may still be starting and can temporarily make the counter negative.
+#[allow(deprecated)] // `try_update` is newer than our MSRV; keep using `fetch_update`.
 pub fn in_parallel_with_slice<I, S, R, E>(
     input: &mut [I],
     thread_limit: Option<usize>,

gix-odb/src/store_impls/dynamic/load_index.rs

@@ -83,6 +83,7 @@ impl super::Store {
     /// load a new index (if not yet loaded), and return true if one was indeed loaded (leading to a `state_id()` change) of the current index.
     /// Note that interacting with the slot-map is inherently racy and we have to deal with it, being conservative in what we even try to load
     /// as our index might already be out-of-date as we try to use it to learn what's next.
+    #[allow(deprecated)] // `try_update` is newer than our MSRV; keep using `fetch_update`.
     fn load_next_index(&self, mut index: arc_swap::Guard<Arc<SlotMapIndex>>) -> bool {
         'retry_with_changed_index: loop {
             let previous_state_id = index.state_id();

gix-pack/src/data/entry/decode.rs

@@ -241,7 +241,7 @@ mod tests {
             err.downcast_any_ref::<std::num::TryFromIntError>().is_some(),
             "the integer conversion failure remains available"
         );
-        insta::assert_debug_snapshot!(err, "entry header lengths that cannot be stored in the Entry metadata must be rejected", @"
+        insta::assert_debug_snapshot!(gix_testtools::redact_debug_snapshot(&err, &[]), "entry header lengths that cannot be stored in the Entry metadata must be rejected", @"
         Pack entry is truncated: entry header size does not fit into u16
         |
         └─ out of range integral type conversion attempted

gix-protocol/tests/protocol/fetch/_impl.rs

@@ -471,6 +471,7 @@ mod delegate {
         /// Everything is tucked away behind type-safety so 'nothing can go wrong'©. Runtime assertions assure invalid
         /// features or arguments don't make it to the server in the first place.
         /// Please note that this trait mostly corresponds to what V2 would look like, even though V1 is supported as well.
+        #[allow(clippy::double_must_use)] // `async_trait` generates `#[must_use]` on boxed futures.
         #[async_trait(?Send)]
         pub trait Delegate: DelegateBlocking {
             /// Receive a pack provided from the given `input`, and the caller should consider it to be blocking as

gix-transport/src/client/async_io/mod.rs

@@ -1,3 +1,5 @@
+#![allow(clippy::double_must_use)] // `async_trait` generates `#[must_use]` on boxed futures.
+
 mod bufread_ext;
 pub use bufread_ext::{ExtendedBufRead, HandleProgress, ReadlineBufRead};
 

gix-worktree-state/tests/worktree-state/checkout.rs

@@ -721,6 +721,7 @@ fn allow_or_disallow_symlinks() -> Result {
 }
 
 #[test]
+#[allow(deprecated)] // `try_update` is newer than our MSRV; keep using `fetch_update`.
 fn keep_going_collects_results() {
     let mut opts = opts_from_probe();
     opts.keep_going = true;

gix/src/clone/mod.rs

@@ -93,6 +93,10 @@ impl PrepareFetch {
     ///
     /// # Deviation
     ///
+    /// Unlike `git clone`, repository-local environment overrides such as `GIT_WORK_TREE` and `GIT_INDEX_FILE` are ignored.
+    /// This prevents cloning from a Git hook from writing the clone's index or files into the caller's repository.
+    /// Editor and notes preferences (`GIT_EDITOR` and `GIT_NOTES_REF`) are still honored.
+    ///
     /// Similar to `git`, a missing user name and email configuration is not terminal and we will fill it in with dummy values. However,
     /// instead of deriving values from the system, ours are hardcoded to indicate what happened.
     pub fn new<Url, E>(
@@ -113,8 +117,10 @@ impl PrepareFetch {
         path: &std::path::Path,
         kind: crate::create::Kind,
         mut create_opts: crate::create::Options,
-        mut open_opts: crate::open::Options,
+        open_opts: crate::open::Options,
     ) -> Result<Self> {
+        // Keep inherited repository paths from redirecting this clone into the caller's repository.
+        let mut open_opts = open_opts.without_repository_environment_overrides();
         if create_opts.destination_must_be_empty.is_none() {
             create_opts.destination_must_be_empty = Some(true);
         }

gix/src/config/cache/init.rs

@@ -431,20 +431,10 @@ fn apply_environment_overrides(
             } else {
                 Permission::Deny
             },
-            &[
-                {
-                    let key = &Core::WORKTREE;
-                    (env(key), key.name)
-                },
-                {
-                    let key = &Core::NOTES_REF;
-                    (env(key), key.name)
-                },
-                {
-                    let key = &Core::EDITOR;
-                    (env(key), key.name)
-                },
-            ][..],
+            &[{
+                let key = &Core::WORKTREE;
+                (env(key), key.name)
+            }][..],
         ),
         (
             "http",
@@ -764,6 +754,7 @@ fn apply_environment_overrides(
         }
     }
 
+    // These should be independent of the use_repository_local_environment condition.
     {
         let mut section = env_override
             .new_section("core", None)
@@ -774,6 +765,14 @@ fn apply_environment_overrides(
                 let key = &Core::DELTA_BASE_CACHE_LIMIT;
                 (env(key), key.name, objects)
             },
+            {
+                let key = &Core::EDITOR;
+                (env(key), key.name, git_prefix)
+            },
+            {
+                let key = &Core::NOTES_REF;
+                (env(key), key.name, git_prefix)
+            },
             {
                 let key = &Core::SSH_COMMAND;
                 (env(key), key.name, git_prefix)

gix/src/util.rs

@@ -55,6 +55,7 @@ impl From<Arc<AtomicBool>> for OwnedOrStaticAtomicBool {
 }
 #[cfg(feature = "parallel")]
 #[expect(clippy::type_complexity)]
+#[allow(deprecated)] // `try_update` is newer than our MSRV; keep using `fetch_update`.
 pub fn parallel_iter_drop<T, U, V>(
     mut rx_and_join: Option<(
         std::sync::mpsc::Receiver<T>,

gix/tests/gix/clone.rs

@@ -1373,6 +1373,50 @@ mod blocking_io {
     }
 }
 
+#[test]
+fn clone_ignores_repository_paths_and_keeps_preferences() -> Result {
+    if gix_testtools::run_in_isolated_process()? {
+        return Ok(());
+    }
+    let caller = gix_testtools::tempfile::TempDir::new()?;
+    let destination = caller.path().join("clone");
+    let _environment = gix_testtools::Env::new()
+        .set("GIT_WORK_TREE", caller.path().display().to_string())
+        .set("GIT_INDEX_FILE", caller.path().join("index").display().to_string())
+        .set("GIT_EDITOR", "git-editor")
+        .set("GIT_NOTES_REF", "refs/notes/custom");
+    let repo = gix::clone::PrepareFetch::new(
+        "https://example.invalid/repo",
+        &destination,
+        gix::create::Kind::WithWorktree,
+        Default::default(),
+        crate::util::restricted_and_git(),
+    )?
+    .persist();
+
+    assert_eq!(
+        std::fs::canonicalize(repo.workdir().expect("non-bare"))?,
+        std::fs::canonicalize(&destination)?,
+        "the clone uses its destination as worktree"
+    );
+    assert_eq!(
+        repo.index_path(),
+        repo.git_dir().join("index"),
+        "the clone keeps its index in its own git directory"
+    );
+    assert_eq!(
+        repo.editor(),
+        Some("git-editor".into()),
+        "the clone honors the caller's editor preference"
+    );
+    assert_eq!(
+        repo.config_snapshot().string(gix::config::tree::Core::NOTES_REF),
+        Some("refs/notes/custom".into()),
+        "the clone honors the caller's notes reference preference"
+    );
+    Ok(())
+}
+
 #[test]
 fn clone_and_early_persist_without_receive() -> Result {
     let tmp = gix_testtools::tempfile::TempDir::new()?;

tests/tools/src/lib.rs

@@ -2001,6 +2001,7 @@ pub fn normalize_debug_snapshot(value: &dyn std::fmt::Debug) -> (String, Vec<gix
 /// with forward slashes. Windows path suffixes use forward slashes; backslashes in
 /// other input remain unchanged. Use complete paths for unquoted paths containing whitespace.
 /// Platform-specific I/O messages and pretty-debug OS errors are replaced by their [`std::io::ErrorKind`].
+/// Integer conversion error messages are normalized across Rust versions.
 ///
 /// The returned value owns its text and prints it without adding quotes or escaping newlines.
 pub fn redact_debug_snapshot(
@@ -2089,6 +2090,12 @@ pub fn redact_debug_snapshot(
     for (from, to) in os_debug {
         text = text.replace(&from, &to);
     }
+    for message in [
+        "number too small to fit in target type",
+        "number too large to fit in target type",
+    ] {
+        text = text.replace(message, "out of range integral type conversion attempted");
+    }
     Diagnostic(normalize_hashes(&text).0)
 }
 

tests/tools/src/signature.rs

@@ -3,7 +3,7 @@
 //! The bundled, passwordless SSH, OpenPGP, and X.509 identities are copied or imported
 //! into disposable directories with suitably restrictive permissions. Callers are
 //! responsible for checking that the required signing [`crate::signature::program_available()`] and must keep the
-//! returned [`tempfile::TempDir`](crate::tempfile::TempDir) alive while using it.
+//! returned [`tempfile::TempDir`] alive while using it.
 //!
 //! These public test identities provide no security and must never be used outside tests.
 

tests/tools/tests/tools/main.rs

@@ -39,6 +39,16 @@ mod isolation {
 
     #[test]
     fn redact_debug_snapshot_preserves_diagnostics_and_object_identity() {
+        for error in [
+            u8::try_from(-1).expect_err("negative values cannot fit in u8"),
+            i8::try_from(128).expect_err("128 exceeds i8::MAX"),
+        ] {
+            assert_eq!(
+                format!("{:?}", redact_debug_snapshot(&format_args!("{error}"), &[])),
+                "out of range integral type conversion attempted",
+                "integer conversion diagnostics remain stable across Rust versions"
+            );
+        }
         for (input, replacements, expected) in [
             (
                 "read /tmp/random/repo/objects/pack failed: NotFound\nsource: /tmp/random/repo/config",