Mark safe directories before cloning.

debian/.debian-ci.yml

@@ -303,10 +303,10 @@ build_source:
   script:
     - git tag -f this-build
     - sudo -i -u "${BUILDUSER}" mkdir src
+    - sudo -i -u "${BUILDUSER}" git config --global --add safe.directory "*"
     - sudo -i -u "${BUILDUSER}" git clone file://"${CI_PROJECT_DIR}" --branch this-build         --depth 1 src/debian-tor
     - sudo -i -u "${BUILDUSER}" git clone "$TORGIT" src/tor
     # this should not need network now:
-    - sudo -i -u "${BUILDUSER}" git config --global --add safe.directory "*"
     - sudo -i -u "${BUILDUSER}" --preserve-env=CI_COMMIT_BRANCH src/debian-tor/debian/.debian-ci/"${CI_JOB_NAME}"/build-script
 
     - mv -v --no-target-directory build-env/RESULT source-packages
@@ -342,6 +342,7 @@ build_source-release:
     GIT_DEPTH: 0
   script:
     - sudo -i -u "${BUILDUSER}" mkdir src
+    - sudo -i -u "${BUILDUSER}" git config --global --add safe.directory "*"
     - sudo -i -u "${BUILDUSER}" git clone "${CI_PROJECT_DIR}" --branch "${CI_COMMIT_TAG}" src/debian-tor
     - sudo -i -u "${BUILDUSER}" git clone "${PRISTINETARGIT}" --branch master                  --depth 1 src/pristine-upstream
     - sudo -i -u "${BUILDUSER}" git clone "${PRISTINETARGIT}" --branch pristine-tar-signatures --depth 1 src/pristine-upstream-signatures
@@ -351,7 +352,6 @@ build_source-release:
     - sudo -i -u "${BUILDUSER}" gpg --no-default-keyring --keyring ./keyrings/debian.gpg   --import "${TOR_DEBIAN_RELEASE_KEYRING_DEBIAN}"
 
     # this should not need network now:
-    - sudo -i -u "${BUILDUSER}" git config --global --add safe.directory "*"
     - sudo -i -u "${BUILDUSER}" --preserve-env=CI_COMMIT_TAG src/debian-tor/debian/.debian-ci/"${CI_JOB_NAME}"/build-script
 
     - mv -v --no-target-directory build-env/RESULT source-packages