We clone the SCM repo as a non-privileged users (in mock). Later, when executing make srpm command we run this as root (to allow users to explicitly install other build dependecies in RPMs via dnf). Using the the root account we then let our users to generate the tarball from git, typically via git archive - which fails with the new Git like:

fatal: unsafe repository ('/mnt/workdir-nwyrb6vj/koji' is owned by someone else)

This SO discussion seems related.

Work-around is to do "git config --global --add safe.directory '*'" before calling git archive. But the question is how to securely fix this in Copr, if at all.