installer/tools/get-version-suffix: set --git-dir

The `nixos-rebuild` tool calls `get-version-suffix` to figure out the
git revision of the nixpkgs directory if there is a .git.

https://nvd.nist.gov/vuln/detail/CVE-2022-24765 made git throw an
error if the .git search logic is not turned off and a user
tries to access a `.git` directory they don’t own (otherwise a
different user could trick them into setting arbitrary git config).

So from now on we should always explicitely set `--git-dir`, which
turns this search logic (and thus the security check) off.

Changed files
+4 -3
nixos
modules
installer
+4 -3
nixos/modules/installer/tools/get-version-suffix
···
getVersion() {
local dir="$1"
rev=
-
if [ -e "$dir/.git" ]; then
+
gitDir="$dir/.git"
+
if [ -e "$gitDir" ]; then
if [ -z "$(type -P git)" ]; then
echo "warning: Git not found; cannot figure out revision of $dir" >&2
return
fi
cd "$dir"
-
rev=$(git rev-parse --short HEAD)
-
if git describe --always --dirty | grep -q dirty; then
+
rev=$(git --git-dir="$gitDir" rev-parse --short HEAD)
+
if git --git-dir="$gitDir" describe --always --dirty | grep -q dirty; then
rev+=M
fi
fi