Fix Windows trust-check failure on 9P network shares by handling ERROR_INVALID_FUNCTION

gix-sec/src/identity.rs

@@ -82,7 +82,7 @@ mod impl_ {
 
     pub fn is_path_owned_by_current_user(path: &Path) -> io::Result<bool> {
         use windows_sys::Win32::{
-            Foundation::{GetLastError, LocalFree, ERROR_INSUFFICIENT_BUFFER, ERROR_SUCCESS},
+            Foundation::{GetLastError, LocalFree, ERROR_INSUFFICIENT_BUFFER, ERROR_INVALID_FUNCTION, ERROR_SUCCESS},
             Security::{
                 Authorization::{GetNamedSecurityInfoW, SE_FILE_OBJECT},
                 CheckTokenMembership, EqualSid, GetTokenInformation, IsWellKnownSid, TokenOwner,
@@ -123,6 +123,13 @@ mod impl_ {
                 );
 
                 if result != ERROR_SUCCESS {
+                    // On some mounted drives (like network drives), GetNamedSecurityInfoW
+                    // may fail with ERROR_INVALID_FUNCTION. In such cases, we cannot determine
+                    // ownership, so we default to reduced trust (false) rather than failing completely.
+                    if result == ERROR_INVALID_FUNCTION {
+                        return Ok(false);
+                    }
+
                     let inner = io::Error::from_raw_os_error(result as _);
                     error!(
                         inner,

gix-sec/tests/sec/identity.rs

@@ -8,10 +8,30 @@ fn is_path_owned_by_current_user() -> crate::Result {
     Ok(())
 }
 
+#[test]
+fn is_path_owned_by_current_user_nonexistent() {
+    let nonexistent = std::path::Path::new("/this/path/does/not/exist");
+    let result = gix_sec::identity::is_path_owned_by_current_user(nonexistent);
+    assert!(result.is_err(), "Should fail for nonexistent paths");
+    assert_eq!(result.unwrap_err().kind(), std::io::ErrorKind::NotFound);
+}
+
 #[test]
 #[cfg(windows)]
 fn windows_home() -> crate::Result {
     let home = gix_path::env::home_dir().expect("home dir is available");
     assert!(gix_sec::identity::is_path_owned_by_current_user(&home)?);
     Ok(())
 }
+
+#[test]
+fn test_trust_behavior_scenarios() {
+    // Test 1: Current directory (should work)
+    let current_dir = std::env::current_dir().unwrap();
+    assert!(current_dir.exists(), "Current directory should exist: {:?}", current_dir);
+
+    let ownership_result = gix_sec::identity::is_path_owned_by_current_user(&current_dir);
+    assert!(ownership_result.is_ok(), "Should be able to check ownership of current directory: {:?}", ownership_result);
+
+
+}