Compare commits

...
Sign in to create a new pull request.

72 commits

Author SHA1 Message Date
Ondřej Pohořelský
da35363f19 remove unused buildrequires 2025-12-12 13:32:24 +01:00
Ondřej Pohořelský
c488c27117 update to 2.52.0 2025-11-20 13:41:02 +01:00
Yaakov Selkowitz
6c89b0ef9d Build with highlight on all arches on EL8+
While highlight was only built/shipped on some arches in RHEL 7 Optional,
as of RHEL 8 it is built on all arches (albeit not shipped as of 10).
2025-11-17 11:55:29 -05:00
Ondřej Pohořelský
8f542b0496 update to 2.51.1 2025-10-23 09:34:39 +02:00
Yaakov Selkowitz
ba249bb3a1 Revbump for tcl/tk 9
Currently, the rawhide and f43 branches both have -2, but the tcl/tk 9
change is only on rawhide.
2025-10-12 18:21:24 -04:00
Ondřej Pohořelský
8e9df669b8 exclude sample hook files from automatic dependency detection 2025-08-21 18:44:54 +02:00
Yanko Kaneti
4cf7527c99 Gitk can now work with tcl/tk 9 2025-08-21 16:46:57 +03:00
Ondřej Pohořelský
90cb7985fd update to 2.51.0 2025-08-20 14:35:53 +02:00
Fedora Release Engineering
fc75418e16 Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild 2025-07-23 22:22:42 +00:00
Ondřej Pohořelský
54ed4ea4ba update to 2.50.1 2025-07-08 22:41:07 +02:00
Ondřej Pohořelský
001bf29ac7 update to 2.50.0 2025-06-23 14:16:09 +02:00
Ondřej Pohořelský
a0b3d1a02b Adds the option to sanitize sideband channel messages
CVE-2024-52005 wasn't fixed by upstream. This patch adds the option to harden Git against it.
The default behaviour of Git remains unchanged.
2025-03-24 12:17:11 +01:00
Ondřej Pohořelský
9a2fecfe2e update to 2.49.0 2025-03-17 15:37:51 +01:00
Yanko Kaneti
716550b90a Keep gitk on tcl/tk 8.x until its ready for 9 2025-02-06 10:13:29 +02:00
Fedora Release Engineering
ecbadc14c1 Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild 2025-01-16 22:01:51 +00:00
Ondřej Pohořelský
078a91e01a update to 2.48.1 2025-01-15 09:29:00 +01:00
Ondřej Pohořelský
0b1ce8c0dc update to 2.48.0 2025-01-13 13:25:40 +01:00
Ondřej Pohořelský
d4648b15be update to 2.47.1 2024-11-25 10:53:34 +01:00
Ondřej Pohořelský
d4d986abeb update to 2.47.0 2024-10-08 15:19:07 +02:00
Ondřej Pohořelský
2354ed4041 repair bogus date in the changelog 2024-09-24 14:34:39 +02:00
Ondřej Pohořelský
b7b63fdc8b update to 2.46.2 2024-09-24 14:31:26 +02:00
Ondřej Pohořelský
8cb6752747 update to 2.46.1 2024-09-16 11:12:46 +02:00
Ondřej Pohořelský
fe2066bbb4 mark git@.service as config(noreplace)
Each update git@.service has been overwritten, removing users custom configurations.
Marking it as config(noreplace) should prevent this behaviour.
2024-09-04 10:42:06 +02:00
Ondřej Pohořelský
0a0995368d update to 2.46.0 2024-08-05 12:53:23 +02:00
Ondřej Pohořelský
699e77dbcb build without perl_modcompat in EL >= 10 2024-07-19 09:29:31 +02:00
Fedora Release Engineering
624305e5be Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild 2024-07-18 02:23:37 +00:00
Ondřej Pohořelský
e49fa1c239 disable p4 subpackage on EL >= 10 2024-07-01 16:34:10 +02:00
Ondřej Pohořelský
2041c47024 build documentation with asciidoc on EL >= 10 2024-07-01 16:30:12 +02:00
Ondřej Pohořelský
9f89b9e069 add glibc-utils BuildRequires 2024-06-20 23:36:27 -04:00
Ondřej Pohořelský
05522a0e2a update to 2.45.2 2024-06-03 12:50:38 +02:00
Ondřej Pohořelský
18e0835469 update to 2.45.1 2024-05-15 09:29:45 +02:00
Ondřej Pohořelský
db55f698a0 update to 2.45.0 2024-04-30 17:15:29 +02:00
Ondřej Pohořelský
59c96e058b update to 2.44.0 2024-02-26 09:50:12 +01:00
Ondřej Pohořelský
9c8b3cf927 update to 2.43.2
Resolves: #2264318
2024-02-15 09:02:27 +01:00
Ondřej Pohořelský
11fa102767 update to 2.43.1
resolves: #2263575
2024-02-12 11:17:05 +01:00
Fedora Release Engineering
2a4367e6d7 Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild 2024-01-24 14:51:35 +00:00
Fedora Release Engineering
75aab98556 Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild 2024-01-19 22:22:27 +00:00
Yaakov Selkowitz
cab00c80b7 Fix perl-podlators dependency
With /app-prefixed builds of perl now existing for flatpaks, file
dependencies must not be used for perl components.
2024-01-09 15:57:42 +00:00
Ondřej Pohořelský
9323031c03 apache.conf set DavLockDBType to sdbm
With the recent change that drops apr-util-bdb build require, in
favor of httpd, t5540 started failing on tests using git-httpd-push.
This patch sets DavLockDBType to sdbm, fixing these failures.
2024-01-09 12:03:02 +01:00
Ondřej Pohořelský
a8ab7b524d Disable t6300.35 t6300.107 t6300.108
These tests break with zlib-ng, disable them until upstream merges
patch solving this issue.
2023-12-20 18:21:47 +01:00
Ondřej Pohořelský
f2b3ab26cc update to 2.43.0 2023-11-21 14:23:40 +01:00
Ondřej Pohořelský
3b9b7132cc update to 2.42.1 2023-11-15 09:17:33 +01:00
Joe Orton
7edc80fb3b remove explicit BR for apr-util-bdb (#2247532) 2023-11-03 09:37:39 +00:00
Ondřej Pohořelský
ac4f507599 update to 2.42.0 2023-10-03 15:31:37 +02:00
Fedora Release Engineering
be8516cba3 Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2023-07-19 23:01:21 +00:00
Yaakov Selkowitz
2600353fc1 Fix file dependencies
Installation path macros must not be used in file dependencies:

https://docs.fedoraproject.org/en-US/packaging-guidelines/#_file_and_directory_dependencies
2023-07-06 12:03:58 -04:00
Todd Zullinger
ee7f0d47a7 update to 2.41.0
Release notes:
https://github.com/git/git/raw/v2.41.0/Documentation/RelNotes/2.41.0.txt
2023-06-01 10:24:28 -04:00
Todd Zullinger
bae778cbc1 fix Source URL handling
Move %rcpath definition added d050347 (use tilde versioning for release
candidates, 2023-05-12) after %real_version.  Otherwise, it is not
parsed correctly.

(I'm pretty sure it worked in the past, but it certainly doesn't now.)
2023-06-01 10:20:55 -04:00
Todd Zullinger
9e3c6109b5 git.skip-test-patterns: ignore 'skip all tests in t5559'
We added t5559-http-fetch-smart-http2 to GIT_SKIP_TESTS in 7d21254
(update to 2.39.0-rc0, 2022-11-23).  Update git.skip-test-patterns to
reflect this.
2023-05-24 21:26:16 -04:00
Todd Zullinger
a297238a54 update to 2.41.0-rc2
Release notes:
https://github.com/git/git/raw/v2.41.0-rc2/Documentation/RelNotes/2.41.0.txt
2023-05-24 17:50:22 -04:00
Todd Zullinger
3f9ea1c489 update to 2.41.0-rc1
Release notes:
https://github.com/git/git/raw/v2.41.0-rc1/Documentation/RelNotes/2.41.0.txt
2023-05-19 15:40:11 -04:00
Todd Zullinger
08d76e08ab update to 2.41.0-rc0
Release notes:
https://github.com/git/git/raw/v2.41.0-rc0/Documentation/RelNotes/2.41.0.txt
2023-05-15 23:05:09 -04:00
Todd Zullinger
d050347835 use tilde versioning for release candidates
All supported released of Fedora and EPEL support the tilde notation.

Reference:
https://docs.fedoraproject.org/en-US/packaging-guidelines/Versioning/
2023-05-15 23:03:37 -04:00
Todd Zullinger
b477fc3318 update to 2.40.1 (CVE-2023-25652, CVE-2023-25815, CVE-2023-29007)
Refer to the release notes for 2.30.9 for details of each CVE as well as
the following security advisories from the git project:

https://github.com/git/git/security/advisories/GHSA-2hvf-7c8p-28fx (CVE-2023-25652)
https://github.com/git/git/security/advisories/GHSA-v48j-4xgg-4844 (CVE-2023-29007)

(At this time there is no upstream advisory for CVE-2023-25815.  This
issue does not affect the Fedora packages as we do not use the runtime
prefix support.)

Release notes:
https://github.com/git/git/raw/v2.30.9/Documentation/RelNotes/2.30.9.txt
https://github.com/git/git/raw/v2.40.1/Documentation/RelNotes/2.40.1.txt
2023-04-25 13:16:39 -04:00
Todd Zullinger
459d08b118 update to 2.40.0
Release notes:
https://github.com/git/git/raw/v2.40.0/Documentation/RelNotes/2.40.0.txt
2023-03-13 14:11:40 -04:00
Todd Zullinger
b8be89a815 update to 2.40.0-rc2
Release notes:
https://github.com/git/git/raw/v2.40.0-rc2/Documentation/RelNotes/2.40.0.txt
2023-03-07 14:59:23 -05:00
Todd Zullinger
01d712d89b update to 2.40.0-rc1
Apply upstream patch to resolve issues in range-diff on non-x86 arches.

Release notes:
https://github.com/git/git/raw/v2.40.0-rc1/Documentation/RelNotes/2.40.0.txt
2023-03-01 15:42:47 -05:00
Todd Zullinger
f5940a719d update to 2.40.0-rc0
Release notes:
https://github.com/git/git/raw/v2.40.0-rc0/Documentation/RelNotes/2.40.0.txt
2023-02-24 16:37:12 -05:00
Todd Zullinger
4583821b53 update to 2.39.2 (CVE-2023-22490, CVE-2023-23946)
From the release notes for 2.30.8¹:

     * CVE-2023-22490:

       Using a specially-crafted repository, Git can be tricked into using
       its local clone optimization even when using a non-local transport.
       Though Git will abort local clones whose source $GIT_DIR/objects
       directory contains symbolic links (c.f., CVE-2022-39253), the objects
       directory itself may still be a symbolic link.

       These two may be combined to include arbitrary files based on known
       paths on the victim's filesystem within the malicious repository's
       working copy, allowing for data exfiltration in a similar manner as
       CVE-2022-39253.

     * CVE-2023-23946:

       By feeding a crafted input to "git apply", a path outside the
       working tree can be overwritten as the user who is running "git
       apply".

     * A mismatched type in `attr.c::read_attr_from_index()` which could
       cause Git to errantly reject attributes on Windows and 32-bit Linux
       has been corrected.

    Credit for finding CVE-2023-22490 goes to yvvdwf, and the fix was
    developed by Taylor Blau, with additional help from others on the
    Git security mailing list.

    Credit for finding CVE-2023-23946 goes to Joern Schneeweisz, and the
    fix was developed by Patrick Steinhardt.

¹ https://github.com/git/git/raw/v2.39.2/Documentation/RelNotes/2.30.8.txt
2023-02-14 13:15:01 -05:00
Todd Zullinger
7c34cecc4c drop perl Email::Valid dep on RHEL (#2166718)
The git send-email command uses Email::Valid to check addresses.  If
Email::Valid is not present, it falls back to a more basic regex match
(which is not nearly as thorough as the checks Email::Valid performs).

While Fedora (and EPEL 7/8 provide perl-Email-Valid, RHEL does not and
does not wish to add the dependency.  Make it easier for RHEL to fork &
sync from us by making the dependency conditional.

References:
https://bugzilla.redhat.com/2020487
https://bugzilla.redhat.com/2046203
http://public-inbox.org/git/20220620004427.3586240-1-trawets@amazon.com/T/#u
4414f61 (add more git-email perl dependencies, 2021-11-13)
2023-02-03 16:05:16 -05:00
Fedora Release Engineering
04a6af281b Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng@fedoraproject.org>
2023-01-19 04:55:02 +00:00
Todd Zullinger
029feecb34 update to 2.39.1 (CVE-2022-41903, CVE-2022-23521)
From the release notes for 2.30.7¹:

    * CVE-2022-41903:

       git log has the ability to display commits using an arbitrary
       format with its --format specifiers. This functionality is also
       exposed to git archive via the export-subst gitattribute.

       When processing the padding operators (e.g., %<(, %<|(, %>(,
       %>>(, or %><( ), an integer overflow can occur in
       pretty.c::format_and_pad_commit() where a size_t is improperly
       stored as an int, and then added as an offset to a subsequent
       memcpy() call.

       This overflow can be triggered directly by a user running a
       command which invokes the commit formatting machinery (e.g., git
       log --format=...). It may also be triggered indirectly through
       git archive via the export-subst mechanism, which expands format
       specifiers inside of files within the repository during a git
       archive.

       This integer overflow can result in arbitrary heap writes, which
       may result in remote code execution.

    * CVE-2022-23521:

       gitattributes are a mechanism to allow defining attributes for
       paths. These attributes can be defined by adding a `.gitattributes`
       file to the repository, which contains a set of file patterns and
       the attributes that should be set for paths matching this pattern.

       When parsing gitattributes, multiple integer overflows can occur
       when there is a huge number of path patterns, a huge number of
       attributes for a single pattern, or when the declared attribute
       names are huge.

       These overflows can be triggered via a crafted `.gitattributes` file
       that may be part of the commit history. Git silently splits lines
       longer than 2KB when parsing gitattributes from a file, but not when
       parsing them from the index. Consequentially, the failure mode
       depends on whether the file exists in the working tree, the index or
       both.

       This integer overflow can result in arbitrary heap reads and writes,
       which may result in remote code execution.

    Credit for finding CVE-2022-41903 goes to Joern Schneeweisz of GitLab.
    An initial fix was authored by Markus Vervier of X41 D-Sec. Credit for
    finding CVE-2022-23521 goes to Markus Vervier and Eric Sesterhenn of X41
    D-Sec. This work was sponsored by OSTIF.

    The proposed fixes have been polished and extended to cover additional
    findings by Patrick Steinhardt of GitLab, with help from others on the
    Git security mailing list.

¹ https://github.com/git/git/raw/v2.39.1/Documentation/RelNotes/2.30.7.txt
2023-01-17 15:13:12 -05:00
Todd Zullinger
6fcfc2d4a2 require perl(MODULE_COMPAT) for Fedora < 38 and RHEL
ce294ea (Remove perl(MODULE_COMPAT), it will be replaced by generators,
2023-01-13) removed the `Requires: perl(:MODULE_COMPAT_*)` entirely.
This is not suitable for merging to older Fedora or RHEL releases.  Make
the requirement conditional.
2023-01-17 15:12:29 -05:00
Jitka Plesnikova
ce294eae02 Remove perl(MODULE_COMPAT), it will be replaced by generators 2023-01-13 09:35:22 +01:00
Todd Zullinger
66efed4a98 update to 2.39.0
Release notes:
https://github.com/git/git/raw/v2.39.0/Documentation/RelNotes/2.39.0.txt
2022-12-12 13:27:10 -05:00
Todd Zullinger
54729198f5 update to 2.39.0-rc2
Release notes:
https://github.com/git/git/raw/v2.39.0-rc2/Documentation/RelNotes/2.39.0.txt
2022-12-06 01:54:30 -05:00
Todd Zullinger
0af3adfcb1 include test-results & "trash" directory contents in build output
When a build fails, the contents of t/test-results and the trash
directories can be quite useful for debugging.  This is particularly
true when the failures occur only in Koji, where we can't get a shell
and poke around.

Create a compressed tarball and encode it with base64 to allow it to be
output along with the normal build output.  Include instruction on how
to extract the base64-encoded content from the build log inline.

The tar archive is compressed with zstd which provides a good balance of
speed and size.  The compression level of 17 was chosen after a number
of tests against real test failures, as opposed to entirely random
selection. ;)
2022-12-06 01:54:30 -05:00
Todd Zullinger
13887794b7 update to 2.39.0-rc1
Release notes:
https://github.com/git/git/raw/v2.39.0-rc1/Documentation/RelNotes/2.39.0.txt
2022-12-01 15:22:49 -05:00
Todd Zullinger
7d21254b02 update to 2.39.0-rc0
Add mod_http2 BuildRequires for t5559-http-fetch-smart-http2; skip it on
EL7, which lacks it.  Ignore the expected 'missing HTTP2' output from
t5551-http-fetch-smart.  Use a strict pattern to avoid unintended
matches.

Sadly, we must also disable t5559 for now.  It fails very often across
all architectures.  The most common failure is "large fetch-pack
requests can be sent using chunked encoding" (t5559.30), but earlier
tests have also failed.  Until these failures are understood and
resolved, the entire test is disabled globally.  (It's also disabled for
EL-7, which is redundant now but won't be after we re-enable the test
globally in the near future.)

We can't simply skip the mod_http2 dependency here because we set
GIT_TEST_HTTPD=true.  Per upstream 73c49a4474 (t: run t5551 tests with
both HTTP and HTTP/2, 2022-11-11):

    If HTTP/2 isn't supported on a given platform, then t5559 should
    bail during the webserver setup, and gracefully skip all tests
    (unless GIT_TEST_HTTPD has been changed from "auto" to "yes", where
    the point is to complain when webserver setup fails).

Also ignore the 'missing BUILTIN_TXT_$builtin' output which comes from
upstream a0c3244796 (doc SYNOPSIS & -h: use "-" to separate words in
labels, not "_", 2022-10-13).  We may want to loosen this in the future,
but for now ignore it because it doesn't help us identify missing test
dependencies.

Release notes:
https://github.com/git/git/raw/v2.39.0-rc0/Documentation/RelNotes/2.39.0.txt
2022-12-01 15:22:49 -05:00
Todd Zullinger
d0191b8ca5 use %bash_completions_dir
A %bash_completions_dir macros was added to redhat-rpm-config recently¹.
It is available for all supported Fedora releases.  Define it if
missing, to support EL <= 9.

This is likely to become part of the packaging guideline soon².

¹ https://src.fedoraproject.org/rpms/redhat-rpm-config/c/483a3b (Add
  macros.shell-completions, 2022-06-25)
² https://pagure.io/packaging-committee/issue/1202
2022-11-12 13:37:15 -05:00
Todd Zullinger
ef75bcdbad update license data and convert to SPDX format
The license data was gathered from the 2.38.1 tarball.  The licensecheck
tool was run:

    find -type f -regextype egrep ! -regex '^(Documentation/.*\.txt$|(t/(chainlint|perf/p[0-9]{4}|t[0-9]{4}).*))' \
        -exec licensecheck --shortname-scheme spdx {} + | LANG=C sort >licensecheck

The contents were reviewed, removing files which are not shipped or were
UNKNOWN to licensecheck.  Of the UNKNOWN files, most lacked a specific
license header and are thus treated as GPL-2.0-only.  The code in
reftable/ is licensed as BSD 3-Clause per reftable/LICENSE.
2022-11-12 13:37:15 -05:00
Todd Zullinger
1ea41cbd46 don't ship contrib/persistent-https as documentation
This is Go source code which requires compilation to be used.  It is
licensed differently than git; shipping it changes the License tag.

Let's avoid it for now.  If it turns out to be widely used, we can
restore it later (and ship it in binary form).
2022-11-07 19:05:50 -05:00
10 changed files with 589 additions and 80 deletions

View file

@ -1,4 +1,4 @@
From aedeaaf788bd8a7fc5a1887196b6f6d8a5c31362 Mon Sep 17 00:00:00 2001 From 89ccbc15948db9ddbf74530e3fd66dd78ae897ae Mon Sep 17 00:00:00 2001
From: Todd Zullinger <tmz@pobox.com> From: Todd Zullinger <tmz@pobox.com>
Date: Sun, 21 Aug 2022 13:49:57 -0400 Date: Sun, 21 Aug 2022 13:49:57 -0400
Subject: [PATCH] t/lib-httpd: try harder to find a port for apache Subject: [PATCH] t/lib-httpd: try harder to find a port for apache
@ -30,10 +30,10 @@ Signed-off-by: Todd Zullinger <tmz@pobox.com>
1 file changed, 18 insertions(+), 11 deletions(-) 1 file changed, 18 insertions(+), 11 deletions(-)
diff --git a/t/lib-httpd.sh b/t/lib-httpd.sh diff --git a/t/lib-httpd.sh b/t/lib-httpd.sh
index 1f6b9b08d1..9279dcd659 100644 index 2fb1b2ae56..4afdf5a6aa 100644
--- a/t/lib-httpd.sh --- a/t/lib-httpd.sh
+++ b/t/lib-httpd.sh +++ b/t/lib-httpd.sh
@@ -175,19 +175,26 @@ prepare_httpd() { @@ -206,19 +206,26 @@ enable_cgipassauth () {
} }
start_httpd() { start_httpd() {

View file

@ -1,4 +1,4 @@
From 16750d024ce038b019ab2e9ee5639901e445af37 Mon Sep 17 00:00:00 2001 From e90e1068ddc9cfa3badd23b16a46c57ed6d8308a Mon Sep 17 00:00:00 2001
From: Todd Zullinger <tmz@pobox.com> From: Todd Zullinger <tmz@pobox.com>
Date: Fri, 26 Aug 2022 18:28:44 -0400 Date: Fri, 26 Aug 2022 18:28:44 -0400
Subject: [PATCH] t/lib-git-daemon: try harder to find a port Subject: [PATCH] t/lib-git-daemon: try harder to find a port

View file

@ -1,4 +1,4 @@
From aa5105dc115b43edc6c9c11714b092583f1221aa Mon Sep 17 00:00:00 2001 From 41423d666fd52eaa6aa2b44a0de1b81d0857ca06 Mon Sep 17 00:00:00 2001
From: Todd Zullinger <tmz@pobox.com> From: Todd Zullinger <tmz@pobox.com>
Date: Fri, 26 Aug 2022 18:28:44 -0400 Date: Fri, 26 Aug 2022 18:28:44 -0400
Subject: [PATCH] t/lib-git-svn: try harder to find a port Subject: [PATCH] t/lib-git-svn: try harder to find a port

View file

@ -0,0 +1,275 @@
From 65e88e659008e2cbf79cf44975406ff0d569a3a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Poho=C5=99elsk=C3=BD?= <opohorel@redhat.com>
Date: Thu, 20 Nov 2025 12:24:59 +0100
Subject: [PATCH] sideband: mask control characters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The output of `git clone` is a vital component for understanding what
has happened when things go wrong. However, these logs are partially
under the control of the remote server (via the "sideband", which
typically contains what the remote `git pack-objects` process sends to
`stderr`), and is currently not sanitized by Git.
This makes Git susceptible to ANSI escape sequence injection (see
CWE-150, https://cwe.mitre.org/data/definitions/150.html), which allows
attackers to corrupt terminal state, to hide information, and even to
insert characters into the input buffer (i.e. as if the user had typed
those characters).
To plug this vulnerability, disallow any control character in the
sideband, replacing them instead with the common `^<letter/symbol>`
(e.g. `^[` for `\x1b`, `^A` for `\x01`).
There is likely a need for more fine-grained controls instead of using a
"heavy hammer" like this, which will be introduced subsequently.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
sideband: introduce an "escape hatch" to allow control characters
The preceding commit fixed the vulnerability whereas sideband messages
(that are under the control of the remote server) could contain ANSI
escape sequences that would be sent to the terminal verbatim.
However, this fix may not be desirable under all circumstances, e.g.
when remote servers deliberately add coloring to their messages to
increase their urgency.
To help with those use cases, give users a way to opt-out of the
protections: `sideband.allowControlCharacters`.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
sideband: do allow ANSI color sequences by default
The preceding two commits introduced special handling of the sideband
channel to neutralize ANSI escape sequences before sending the payload
to the terminal, and `sideband.allowControlCharacters` to override that
behavior.
However, some `pre-receive` hooks that are actively used in practice
want to color their messages and therefore rely on the fact that Git
passes them through to the terminal.
In contrast to other ANSI escape sequences, it is highly unlikely that
coloring sequences can be essential tools in attack vectors that mislead
Git users e.g. by hiding crucial information.
Therefore we can have both: Continue to allow ANSI coloring sequences to
be passed to the terminal, and neutralize all other ANSI escape
sequences.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
sideband: default to allowControlCharacters=true
We don't want to change the default Git behaviour, just add the option
to filter control characters.
Signed-off-by: Ondřej Pohořelský <opohorel@redhat.com>
---
Documentation/config.adoc | 2 +
Documentation/config/sideband.adoc | 16 ++++++
sideband.c | 78 ++++++++++++++++++++++++++++-
t/t5409-colorize-remote-messages.sh | 31 ++++++++++++
4 files changed, 125 insertions(+), 2 deletions(-)
create mode 100644 Documentation/config/sideband.adoc
diff --git a/Documentation/config.adoc b/Documentation/config.adoc
index 62eebe7c54..dcea3c0c15 100644
--- a/Documentation/config.adoc
+++ b/Documentation/config.adoc
@@ -523,6 +523,8 @@ include::config/sequencer.adoc[]
include::config/showbranch.adoc[]
+include::config/sideband.adoc[]
+
include::config/sparse.adoc[]
include::config/splitindex.adoc[]
diff --git a/Documentation/config/sideband.adoc b/Documentation/config/sideband.adoc
new file mode 100644
index 0000000000..c9ba24a02c
--- /dev/null
+++ b/Documentation/config/sideband.adoc
@@ -0,0 +1,16 @@
+sideband.allowControlCharacters::
+ By default, control characters that are delivered via the sideband
+ are NOT masked. Use this config setting to prevent potentially
+ unwanted ANSI escape sequences from being sent to the terminal:
++
+--
+ color::
+ Allow ANSI color sequences, line feeds and horizontal tabs,
+ but mask all other control characters.
+ false::
+ Mask all control characters other than line feeds and
+ horizontal tabs.
+ true::
+ Allow all control characters to be sent to the terminal.
+ This is the default.
+--
\ No newline at end of file
diff --git a/sideband.c b/sideband.c
index ea7c25211e..88d1b44a7a 100644
--- a/sideband.c
+++ b/sideband.c
@@ -26,6 +26,12 @@ static struct keyword_entry keywords[] = {
{ "error", GIT_COLOR_BOLD_RED },
};
+static enum {
+ ALLOW_NO_CONTROL_CHARACTERS = 0,
+ ALLOW_ALL_CONTROL_CHARACTERS = 1,
+ ALLOW_ANSI_COLOR_SEQUENCES = 2
+} allow_control_characters = ALLOW_ALL_CONTROL_CHARACTERS;
+
/* Returns a color setting (GIT_COLOR_NEVER, etc). */
static enum git_colorbool use_sideband_colors(void)
{
@@ -39,6 +45,25 @@ static enum git_colorbool use_sideband_colors(void)
if (use_sideband_colors_cached != GIT_COLOR_UNKNOWN)
return use_sideband_colors_cached;
+ switch (repo_config_get_maybe_bool(the_repository, "sideband.allowcontrolcharacters", &i)) {
+ case 0: /* Boolean value */
+ allow_control_characters = i ? ALLOW_ALL_CONTROL_CHARACTERS :
+ ALLOW_NO_CONTROL_CHARACTERS;
+ break;
+ case -1: /* non-Boolean value */
+ if (repo_config_get_string_tmp(the_repository, "sideband.allowcontrolcharacters",
+ &value))
+ ; /* huh? `get_maybe_bool()` returned -1 */
+ else if (!strcmp(value, "color"))
+ allow_control_characters = ALLOW_ANSI_COLOR_SEQUENCES;
+ else
+ warning(_("unrecognized value for `sideband."
+ "allowControlCharacters`: '%s'"), value);
+ break;
+ default:
+ break; /* not configured */
+ }
+
if (!repo_config_get_string_tmp(the_repository, key, &value))
use_sideband_colors_cached = git_config_colorbool(key, value);
else if (!repo_config_get_string_tmp(the_repository, "color.ui", &value))
@@ -66,6 +91,55 @@ void list_config_color_sideband_slots(struct string_list *list, const char *pref
list_config_item(list, prefix, keywords[i].keyword);
}
+static int handle_ansi_color_sequence(struct strbuf *dest, const char *src, int n)
+{
+ int i;
+
+ /*
+ * Valid ANSI color sequences are of the form
+ *
+ * ESC [ [<n> [; <n>]*] m
+ */
+
+ if (allow_control_characters != ALLOW_ANSI_COLOR_SEQUENCES ||
+ n < 3 || src[0] != '\x1b' || src[1] != '[')
+ return 0;
+
+ for (i = 2; i < n; i++) {
+ if (src[i] == 'm') {
+ strbuf_add(dest, src, i + 1);
+ return i;
+ }
+ if (!isdigit(src[i]) && src[i] != ';')
+ break;
+ }
+
+ return 0;
+}
+
+static void strbuf_add_sanitized(struct strbuf *dest, const char *src, int n)
+{
+ int i;
+
+ if (allow_control_characters == ALLOW_ALL_CONTROL_CHARACTERS) {
+ strbuf_add(dest, src, n);
+ return;
+ }
+
+ strbuf_grow(dest, n);
+ for (; n && *src; src++, n--) {
+ if (!iscntrl(*src) || *src == '\t' || *src == '\n')
+ strbuf_addch(dest, *src);
+ else if ((i = handle_ansi_color_sequence(dest, src, n))) {
+ src += i;
+ n -= i;
+ } else {
+ strbuf_addch(dest, '^');
+ strbuf_addch(dest, 0x40 + *src);
+ }
+ }
+}
+
/*
* Optionally highlight one keyword in remote output if it appears at the start
* of the line. This should be called for a single line only, which is
@@ -81,7 +155,7 @@ static void maybe_colorize_sideband(struct strbuf *dest, const char *src, int n)
int i;
if (!want_color_stderr(use_sideband_colors())) {
- strbuf_add(dest, src, n);
+ strbuf_add_sanitized(dest, src, n);
return;
}
@@ -114,7 +188,7 @@ static void maybe_colorize_sideband(struct strbuf *dest, const char *src, int n)
}
}
- strbuf_add(dest, src, n);
+ strbuf_add_sanitized(dest, src, n);
}
diff --git a/t/t5409-colorize-remote-messages.sh b/t/t5409-colorize-remote-messages.sh
index fa5de4500a..2d40d8c640 100755
--- a/t/t5409-colorize-remote-messages.sh
+++ b/t/t5409-colorize-remote-messages.sh
@@ -98,4 +98,35 @@ test_expect_success 'fallback to color.ui' '
grep "<BOLD;RED>error<RESET>: error" decoded
'
+test_expect_success 'disallow (color) control sequences in sideband' '
+ write_script .git/color-me-surprised <<-\EOF &&
+ printf "error: Have you \\033[31mread\\033[m this?\\a\\n" >&2
+ exec "$@"
+ EOF
+ test_config_global uploadPack.packObjectshook ./color-me-surprised &&
+ test_commit need-at-least-one-commit &&
+
+ git -c sideband.allowControlCharacters=color \
+ clone --no-local . throw-away 2>stderr &&
+ test_decode_color <stderr >decoded &&
+ test_grep RED decoded &&
+ test_grep "\\^G" stderr &&
+ tr -dc "\\007" <stderr >actual &&
+ test_must_be_empty actual &&
+
+ rm -rf throw-away &&
+ git -c sideband.allowControlCharacters=false \
+ clone --no-local . throw-away 2>stderr &&
+ test_decode_color <stderr >decoded &&
+ test_grep ! RED decoded &&
+ test_grep "\\^G" stderr &&
+
+ rm -rf throw-away &&
+ git -c sideband.allowControlCharacters clone --no-local . throw-away 2>stderr &&
+ test_decode_color <stderr >decoded &&
+ test_grep RED decoded &&
+ tr -dc "\\007" <stderr >actual &&
+ test_file_not_empty actual
+'
+
test_done
--
2.51.1

View file

@ -0,0 +1,14 @@
diff -ur b/t/lib-httpd/apache.conf a/t/lib-httpd/apache.conf
--- b/t/lib-httpd/apache.conf 2024-01-09 11:06:46.660868023 +0100
+++ a/t/lib-httpd/apache.conf 2024-01-09 11:09:09.572713625 +0100
@@ -272,7 +272,9 @@
<IfDefine DAV>
LoadModule dav_module modules/mod_dav.so
LoadModule dav_fs_module modules/mod_dav_fs.so
-
+ <IfDirective DavLockDBType>
+ DavLockDBType sdbm
+ </IfDirective>
DAVLockDB DAVLock
<Location /dumb/>
Dav on

View file

@ -5,6 +5,9 @@ addFilter("git-subtree.* spelling-error %description .* (subdirectory|subproject
# git-core-doc requires git-core, which provides the symlink target # git-core-doc requires git-core, which provides the symlink target
addFilter("git(-core-doc)?\..*: W: dangling-relative-symlink /usr/share/doc/git/contrib/hooks ../../../git-core/contrib/hooks") addFilter("git(-core-doc)?\..*: W: dangling-relative-symlink /usr/share/doc/git/contrib/hooks ../../../git-core/contrib/hooks")
# gitk requires git, which provides the symlink target
addFilter("gitk\.noarch: W: dangling-relative-symlink /usr/share/bash-completion/completions/gitk git")
# git-gui requires git, which provides the git binary # git-gui requires git, which provides the git binary
addFilter("git-gui.noarch: W: desktopfile-without-binary /usr/share/applications/git-gui.desktop git") addFilter("git-gui.noarch: W: desktopfile-without-binary /usr/share/applications/git-gui.desktop git")

View file

@ -1,8 +1,10 @@
^ok 1 # SKIP enable client-side http/2 \(missing HTTP2\)$
expensive 2GB clone test; enable with GIT_TEST_CLONE_2GB=true expensive 2GB clone test; enable with GIT_TEST_CLONE_2GB=true
filesystem does not corrupt utf-8 filesystem does not corrupt utf-8
fsmonitor--daemon is not supported on this platform fsmonitor--daemon is not supported on this platform
GIT_SKIP_TESTS GIT_SKIP_TESTS
missing AUTOIDENT missing AUTOIDENT
missing BUILTIN_TXT_
missing CASE_INSENSITIVE_FS missing CASE_INSENSITIVE_FS
missing DONTHAVEIT missing DONTHAVEIT
missing ([!]LONG_IS_64BIT,)?EXPENSIVE missing ([!]LONG_IS_64BIT,)?EXPENSIVE
@ -20,6 +22,7 @@ missing SYMLINKS_WINDOWS
missing TAR_NEEDS_PAX_FALLBACK missing TAR_NEEDS_PAX_FALLBACK
missing UTF8_NFD_TO_NFC missing UTF8_NFD_TO_NFC
missing WINDOWS missing WINDOWS
skipped: skip all tests in t5559
skipping case insensitive tests skipping case insensitive tests
skipping git p4 tests skipping git p4 tests
skipping remote-svn tests, python not available skipping remote-svn tests, python not available

347
git.spec
View file

@ -14,8 +14,16 @@
%bcond_with linkcheck %bcond_with linkcheck
%endif %endif
# Settings for Fedora and EL >= 9 # Settings for Fedora >= 38 and EL >= 10
%if 0%{?fedora} || 0%{?rhel} >= 9 %if 0%{?fedora} >= 38 || 0%{?rhel} >= 10
%bcond_with perl_modcompat
%else
%bcond_without perl_modcompat
%endif
# Settings for Fedora and EL == 9
# In EL >= 10 docbook5-style-xsl, needed by asciidoctor, is unwanted package
%if 0%{?fedora} || 0%{?rhel} == 9
%bcond_without asciidoctor %bcond_without asciidoctor
%else %else
%bcond_with asciidoctor %bcond_with asciidoctor
@ -39,12 +47,6 @@
%global use_perl_interpreter 0 %global use_perl_interpreter 0
%endif %endif
# Settings for Fedora and EL >= 7
%if 0%{?fedora} || 0%{?rhel} >= 7
%global bashcompdir %(pkg-config --variable=completionsdir bash-completion 2>/dev/null)
%global bashcomproot %(dirname %{bashcompdir} 2>/dev/null)
%endif
# Allow cvs subpackage to be toggled via --with/--without # Allow cvs subpackage to be toggled via --with/--without
# Disable cvs subpackage by default on EL >= 8 # Disable cvs subpackage by default on EL >= 8
%if 0%{?rhel} >= 8 %if 0%{?rhel} >= 8
@ -57,11 +59,11 @@
%bcond_without libsecret %bcond_without libsecret
# Allow p4 subpackage to be toggled via --with/--without # Allow p4 subpackage to be toggled via --with/--without
# Disable by default if we lack python2 or python3 support # Disable p4 package by default on EL >= 10
%if %{with python2} || %{with python3} %if 0%{?rhel} >= 10
%bcond_without p4
%else
%bcond_with p4 %bcond_with p4
%else
%bcond_without p4
%endif %endif
# Hardening flags for EL-7 # Hardening flags for EL-7
@ -69,20 +71,27 @@
%global _hardened_build 1 %global _hardened_build 1
%endif %endif
# Define for release candidates # Define %%bash_completions_dir for EL <= 9
#global rcrev .rc0 %{?!bash_completions_dir:%global bash_completions_dir %{_datadir}/bash-completion/completions}
# Set path to the package-notes linker script # Set path to the package-notes linker script
%global _package_note_file %{_builddir}/%{name}-%{version}%{?rcrev}/.package_note-%{name}-%{version}-%{release}.%{_arch}.ld %global _package_note_file %{_builddir}/%{name}-%{real_version}/.package_note-%{name}-%{version}-%{release}.%{_arch}.ld
Name: git Name: git
Version: 2.38.1 Version: 2.52.0
Release: 1%{?rcrev}%{?dist} Release: 1%{?dist}
Summary: Fast Version Control System Summary: Fast Version Control System
License: GPLv2 License: BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT
URL: https://git-scm.com/ URL: https://git-scm.com/
Source0: https://www.kernel.org/pub/software/scm/git/%{?rcrev:testing/}%{name}-%{version}%{?rcrev}.tar.xz
Source1: https://www.kernel.org/pub/software/scm/git/%{?rcrev:testing/}%{name}-%{version}%{?rcrev}.tar.sign # Note: real_version must be defined _after_ Version
%global real_version %(echo %{version} | tr '~' '.')
# Adjust Source URL path for release candidates
%global rcpath %(test "%{version}" = "%{real_version}" || echo testing/)
Source0: https://www.kernel.org/pub/software/scm/git/%{rcpath}%{name}-%{real_version}.tar.xz
Source1: https://www.kernel.org/pub/software/scm/git/%{rcpath}%{name}-%{real_version}.tar.sign
# Junio C Hamano's key is used to sign git releases, it can be found in the # Junio C Hamano's key is used to sign git releases, it can be found in the
# junio-gpg-pub tag within git. # junio-gpg-pub tag within git.
@ -119,9 +128,20 @@ Patch2: 0002-t-lib-git-daemon-try-harder-to-find-a-port.patch
# https://github.com/tmzullinger/git/commit/aa5105dc11 # https://github.com/tmzullinger/git/commit/aa5105dc11
Patch3: 0003-t-lib-git-svn-try-harder-to-find-a-port.patch Patch3: 0003-t-lib-git-svn-try-harder-to-find-a-port.patch
# Configurates Apache test server to use `DavLockDBType sdbm`
# Prevents t5540 failures on i686, s390x and ppc64le
Patch5: git-test-apache-davlockdbtype-config.patch
# Adds the option to sanitize sideband channel messages
# CVE-2024-52005 wasn't fixed by upstream. This patch adds the option to harden Git against it.
# The default behaviour of Git remains unchanged.
#
# https://github.com/gitgitgadget/git/pull/1853
Patch6: git-2.52-sanitize-sideband-channel-messages.patch
%if %{with docs} %if %{with docs}
# pod2man is needed to build Git.3pm # pod2man is needed to build Git.3pm
BuildRequires: %{_bindir}/pod2man BuildRequires: perl-podlators
%if %{with asciidoctor} %if %{with asciidoctor}
BuildRequires: docbook5-style-xsl BuildRequires: docbook5-style-xsl
BuildRequires: rubygem-asciidoctor BuildRequires: rubygem-asciidoctor
@ -129,7 +149,6 @@ BuildRequires: rubygem-asciidoctor
BuildRequires: asciidoc >= 8.4.1 BuildRequires: asciidoc >= 8.4.1
%endif %endif
# endif with asciidoctor # endif with asciidoctor
BuildRequires: perl(File::Compare)
BuildRequires: xmlto BuildRequires: xmlto
%if %{with linkcheck} %if %{with linkcheck}
BuildRequires: linkchecker BuildRequires: linkchecker
@ -151,6 +170,7 @@ BuildRequires: findutils
BuildRequires: gawk BuildRequires: gawk
BuildRequires: gcc BuildRequires: gcc
BuildRequires: gettext BuildRequires: gettext
BuildRequires: glibc-utils
BuildRequires: gnupg2 BuildRequires: gnupg2
BuildRequires: libcurl-devel BuildRequires: libcurl-devel
BuildRequires: make BuildRequires: make
@ -158,7 +178,6 @@ BuildRequires: openssl-devel
BuildRequires: pcre2-devel BuildRequires: pcre2-devel
BuildRequires: perl(Error) BuildRequires: perl(Error)
BuildRequires: perl(lib) BuildRequires: perl(lib)
BuildRequires: perl(Test)
%if %{use_perl_generators} %if %{use_perl_generators}
BuildRequires: perl-generators BuildRequires: perl-generators
%endif %endif
@ -184,10 +203,14 @@ BuildRequires: zlib-devel >= 1.2
%if %{with tests} %if %{with tests}
# Test suite requirements # Test suite requirements
BuildRequires: acl BuildRequires: acl
%if 0%{?fedora} || 0%{?rhel} >= 8 %if (0%{?fedora} && 0%{?fedora} < 40) || (0%{?rhel} >= 8 && 0%{?rhel} < 10)
# Needed by t5540-http-push-webdav.sh # Needed by t5540-http-push-webdav.sh; recent httpd obviates this
BuildRequires: apr-util-bdb BuildRequires: apr-util-bdb
%endif %endif
%if 0%{?fedora} || 0%{?rhel} >= 8
# Needed by t5559-http-fetch-smart-http2.sh
BuildRequires: mod_http2
%endif
# endif fedora or rhel >= 8 # endif fedora or rhel >= 8
BuildRequires: bash BuildRequires: bash
%if %{with cvs} %if %{with cvs}
@ -207,7 +230,7 @@ BuildRequires: glibc-langpack-is
BuildRequires: gnupg2-smime BuildRequires: gnupg2-smime
%endif %endif
# endif fedora or el >= 9 # endif fedora or el >= 9
%if 0%{?fedora} || ( 0%{?rhel} >= 7 && ( "%{_arch}" == "ppc64le" || "%{_arch}" == "x86_64" ) ) %if 0%{?fedora} || 0%{?rhel} >= 8 || ( 0%{?rhel} == 7 && ( "%{_arch}" == "ppc64le" || "%{_arch}" == "x86_64" ) )
BuildRequires: highlight BuildRequires: highlight
%endif %endif
# endif fedora or el7+ (ppc64le/x86_64) # endif fedora or el7+ (ppc64le/x86_64)
@ -258,6 +281,7 @@ BuildRequires: subversion-perl
BuildRequires: tar BuildRequires: tar
BuildRequires: time BuildRequires: time
BuildRequires: zip BuildRequires: zip
BuildRequires: zstd
%endif %endif
# endif with tests # endif with tests
@ -383,7 +407,10 @@ BuildArch: noarch
Requires: git = %{version}-%{release} Requires: git = %{version}-%{release}
Requires: perl(Authen::SASL) Requires: perl(Authen::SASL)
Requires: perl(Cwd) Requires: perl(Cwd)
%if ! 0%{?rhel}
# RHEL lacks perl-Email-Valid (rhbz#2166718)
Requires: perl(Email::Valid) Requires: perl(Email::Valid)
%endif
Requires: perl(File::Spec) Requires: perl(File::Spec)
Requires: perl(File::Spec::Functions) Requires: perl(File::Spec::Functions)
Requires: perl(File::Temp) Requires: perl(File::Temp)
@ -407,7 +434,7 @@ Summary: Git repository browser
BuildArch: noarch BuildArch: noarch
Requires: git = %{version}-%{release} Requires: git = %{version}-%{release}
Requires: git-gui = %{version}-%{release} Requires: git-gui = %{version}-%{release}
Requires: tk >= 8.4 Requires: tk
%description -n gitk %description -n gitk
%{summary}. %{summary}.
@ -464,7 +491,9 @@ Requires: git = %{version}-%{release}
Summary: Perl interface to Git Summary: Perl interface to Git
BuildArch: noarch BuildArch: noarch
Requires: git = %{version}-%{release} Requires: git = %{version}-%{release}
%if %{with perl_modcompat}
Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
%endif
%description -n perl-Git %description -n perl-Git
%{summary}. %{summary}.
@ -472,7 +501,9 @@ Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $versi
Summary: Perl interface to Git::SVN Summary: Perl interface to Git::SVN
BuildArch: noarch BuildArch: noarch
Requires: git = %{version}-%{release} Requires: git = %{version}-%{release}
%if %{with perl_modcompat}
Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version)) Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
%endif
%description -n perl-Git-SVN %description -n perl-Git-SVN
%{summary}. %{summary}.
@ -502,7 +533,7 @@ Requires: subversion
# Verify GPG signatures # Verify GPG signatures
xz -dc '%{SOURCE0}' | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data=- xz -dc '%{SOURCE0}' | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data=-
%autosetup -p1 -n %{name}-%{version}%{?rcrev} %autosetup -p1 -n %{name}-%{real_version}
# Install print-failed-test-output script # Install print-failed-test-output script
install -p -m 755 %{SOURCE99} print-failed-test-output install -p -m 755 %{SOURCE99} print-failed-test-output
@ -510,7 +541,7 @@ install -p -m 755 %{SOURCE99} print-failed-test-output
# Remove git-archimport # Remove git-archimport
sed -i '/^SCRIPT_PERL += git-archimport\.perl$/d' Makefile sed -i '/^SCRIPT_PERL += git-archimport\.perl$/d' Makefile
sed -i '/^git-archimport/d' command-list.txt sed -i '/^git-archimport/d' command-list.txt
rm git-archimport.perl Documentation/git-archimport.txt rm git-archimport.perl Documentation/git-archimport.adoc
%if %{without cvs} %if %{without cvs}
# Remove git-cvs* from command list # Remove git-cvs* from command list
@ -572,6 +603,9 @@ EOF
%endif %endif
# endif ! defined perl_bootstrap # endif ! defined perl_bootstrap
# Exclude sample hook files from automatic dependency detection
%global __requires_exclude_from ^%{_datadir}/git-core/templates/hooks/.*sample$
# Remove Git::LoadCPAN to ensure we use only system perl modules. This also # Remove Git::LoadCPAN to ensure we use only system perl modules. This also
# allows the dependencies to be automatically processed by rpm. # allows the dependencies to be automatically processed by rpm.
rm -rf perl/Git/LoadCPAN{.pm,/} rm -rf perl/Git/LoadCPAN{.pm,/}
@ -583,7 +617,7 @@ sed -i 's@"++GITWEB_HOME_LINK_STR++"@$ENV{"SERVER_NAME"} ? "git://" . $ENV{"SERV
# Move contrib/{contacts,subtree} docs to Documentation so they build with the # Move contrib/{contacts,subtree} docs to Documentation so they build with the
# proper asciidoc/docbook/xmlto options # proper asciidoc/docbook/xmlto options
mv contrib/{contacts,subtree}/git-*.txt Documentation/ mv contrib/{contacts,subtree}/git-*.adoc Documentation/
%build %build
# Improve build reproducibility # Improve build reproducibility
@ -615,13 +649,6 @@ rm -rf contrib/fast-import/import-zips.py
%endif %endif
# endif with python2 # endif with python2
# Use python3 to avoid an unnecessary python2 dependency, if possible.
%if %{with python3}
sed -i -e '1s@#!\( */usr/bin/env python\|%{__python2}\)$@#!%{__python3}@' \
contrib/hg-to-git/hg-to-git.py
%endif
# endif with python3
%install %install
%make_install %{?with_docs:install-doc} %make_install %{?with_docs:install-doc}
@ -650,6 +677,10 @@ install -Dpm 0755 contrib/diff-highlight/diff-highlight \
%{buildroot}%{_datadir}/git-core/contrib/diff-highlight %{buildroot}%{_datadir}/git-core/contrib/diff-highlight
rm -rf contrib/diff-highlight/{Makefile,diff-highlight,*.perl,t} rm -rf contrib/diff-highlight/{Makefile,diff-highlight,*.perl,t}
# Remove contrib/persistent-https; a) this code requires compilation; and b) it
# is licensed differently than git
rm -rf contrib/persistent-https
# Remove contrib/scalar to avoid cruft in the git-core-doc docdir # Remove contrib/scalar to avoid cruft in the git-core-doc docdir
rm -rf contrib/scalar rm -rf contrib/scalar
@ -696,21 +727,14 @@ perl -p \
%{SOURCE15} > %{buildroot}%{_unitdir}/git@.service %{SOURCE15} > %{buildroot}%{_unitdir}/git@.service
# Setup bash completion # Setup bash completion
install -Dpm 644 contrib/completion/git-completion.bash %{buildroot}%{bashcompdir}/git install -Dpm 644 contrib/completion/git-completion.bash %{buildroot}%{bash_completions_dir}/git
ln -s git %{buildroot}%{bashcompdir}/gitk ln -s git %{buildroot}%{bash_completions_dir}/gitk
# Install tcsh completion # Install tcsh completion
mkdir -p %{buildroot}%{_datadir}/git-core/contrib/completion mkdir -p %{buildroot}%{_datadir}/git-core/contrib/completion
install -pm 644 contrib/completion/git-completion.tcsh \ install -pm 644 contrib/completion/git-completion.tcsh \
%{buildroot}%{_datadir}/git-core/contrib/completion/ %{buildroot}%{_datadir}/git-core/contrib/completion/
# Move contrib/hooks out of %%docdir
mkdir -p %{buildroot}%{_datadir}/git-core/contrib
mv contrib/hooks %{buildroot}%{_datadir}/git-core/contrib
pushd contrib > /dev/null
ln -s ../../../git-core/contrib/hooks
popd > /dev/null
# Install git-prompt.sh # Install git-prompt.sh
mkdir -p %{buildroot}%{_datadir}/git-core/contrib/completion mkdir -p %{buildroot}%{_datadir}/git-core/contrib/completion
install -pm 644 contrib/completion/git-prompt.sh \ install -pm 644 contrib/completion/git-prompt.sh \
@ -753,7 +777,7 @@ grep -E "$not_core_re" bin-man-doc-files > bin-man-doc-git-files
# contrib # contrib
not_core_doc_re="(git-(cvs|gui|citool|daemon|instaweb|subtree))|p4|svn|email|gitk|gitweb" not_core_doc_re="(git-(cvs|gui|citool|daemon|instaweb|subtree))|p4|svn|email|gitk|gitweb"
mkdir -p %{buildroot}%{_pkgdocdir}/ mkdir -p %{buildroot}%{_pkgdocdir}/
cp -pr CODE_OF_CONDUCT.md README.md Documentation/*.txt Documentation/RelNotes contrib %{buildroot}%{_pkgdocdir}/ cp -pr CODE_OF_CONDUCT.md README.md Documentation/*.adoc Documentation/RelNotes contrib %{buildroot}%{_pkgdocdir}/
# Remove contrib/ files/dirs which have nothing useful for documentation # Remove contrib/ files/dirs which have nothing useful for documentation
rm -rf %{buildroot}%{_pkgdocdir}/contrib/{contacts,credential}/ rm -rf %{buildroot}%{_pkgdocdir}/contrib/{contacts,credential}/
cp -p gitweb/INSTALL %{buildroot}%{_pkgdocdir}/INSTALL.gitweb cp -p gitweb/INSTALL %{buildroot}%{_pkgdocdir}/INSTALL.gitweb
@ -792,7 +816,17 @@ find %{buildroot}%{_pkgdocdir} -name "*.html" -print0 | xargs -r0 linkchecker
# endif with docs && with linkcheck # endif with docs && with linkcheck
# Tests to skip on all releases and architectures # Tests to skip on all releases and architectures
GIT_SKIP_TESTS="" #
# t5559-http-fetch-smart-http2 runs t5551-http-fetch-smart with
# HTTP_PROTO=HTTP/2. Unfortunately, it fails quite regularly.
# https://lore.kernel.org/git/Y4fUntdlc1mqwad5@pobox.com/
GIT_SKIP_TESTS="t5559"
%if 0%{?rhel} && 0%{?rhel} < 8
# Skip tests which require mod_http2 on el7
GIT_SKIP_TESTS="$GIT_SKIP_TESTS t5559"
%endif
# endif rhel < 8
%ifarch aarch64 %{arm} %{power64} %ifarch aarch64 %{arm} %{power64}
# Skip tests which fail on aarch64, arm, and ppc # Skip tests which fail on aarch64, arm, and ppc
@ -835,6 +869,17 @@ GIT_SKIP_TESTS="$GIT_SKIP_TESTS t5300.1[02348] t5300.2[03459] t5300.30 t5300.4[5
%endif %endif
# endif rhel == 8 && arch == s390x # endif rhel == 8 && arch == s390x
%if "%{_arch}" == "s390x"
# Skip tests which fail on s390x
#
# The following tests are failing on s390x.
# https://lore.kernel.org/git/4dc4c8cd-c0cc-4784-8fcf-defa3a051087@mit.edu/
#
# t8020.16 'cross merge boundaries in blaming'
# t8020.19 'last-modified merge undoes changes'
GIT_SKIP_TESTS="$GIT_SKIP_TESTS t8020.16 t8020.19"
%endif
# endif "%{_arch}" == "s390x"
export GIT_SKIP_TESTS export GIT_SKIP_TESTS
# Set LANG so various UTF-8 tests are run # Set LANG so various UTF-8 tests are run
@ -851,7 +896,7 @@ export GIT_TEST_SVN_HTTPD=true
# Create tmpdir for test output and update GIT_TEST_OPTS # Create tmpdir for test output and update GIT_TEST_OPTS
# Also update GIT-BUILD-OPTIONS to keep make from any needless rebuilding # Also update GIT-BUILD-OPTIONS to keep make from any needless rebuilding
testdir=$(mktemp -d -p /tmp git-t.XXXX) export testdir=$(mktemp -d -p /tmp git-t.XXXX)
sed -i "s@^GIT_TEST_OPTS = .*@& --root=$testdir@" config.mak sed -i "s@^GIT_TEST_OPTS = .*@& --root=$testdir@" config.mak
touch -r GIT-BUILD-OPTIONS ts touch -r GIT-BUILD-OPTIONS ts
sed -i "s@\(GIT_TEST_OPTS='.*\)'@\1 --root=$testdir'@" GIT-BUILD-OPTIONS sed -i "s@\(GIT_TEST_OPTS='.*\)'@\1 --root=$testdir'@" GIT-BUILD-OPTIONS
@ -880,11 +925,6 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%files -f bin-man-doc-git-files %files -f bin-man-doc-git-files
%{_datadir}/git-core/contrib/diff-highlight %{_datadir}/git-core/contrib/diff-highlight
%{_datadir}/git-core/contrib/hooks/update-paranoid
%{_datadir}/git-core/contrib/hooks/setgitperms.perl
%{_datadir}/git-core/templates/hooks/fsmonitor-watchman.sample
%{_datadir}/git-core/templates/hooks/pre-rebase.sample
%{_datadir}/git-core/templates/hooks/prepare-commit-msg.sample
%files all %files all
# No files for you! # No files for you!
@ -896,12 +936,7 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%license COPYING %license COPYING
# exclude is best way here because of troubles with symlinks inside git-core/ # exclude is best way here because of troubles with symlinks inside git-core/
%exclude %{_datadir}/git-core/contrib/diff-highlight %exclude %{_datadir}/git-core/contrib/diff-highlight
%exclude %{_datadir}/git-core/contrib/hooks/update-paranoid %{bash_completions_dir}/git
%exclude %{_datadir}/git-core/contrib/hooks/setgitperms.perl
%exclude %{_datadir}/git-core/templates/hooks/fsmonitor-watchman.sample
%exclude %{_datadir}/git-core/templates/hooks/pre-rebase.sample
%exclude %{_datadir}/git-core/templates/hooks/prepare-commit-msg.sample
%{bashcomproot}
%{_datadir}/git-core/ %{_datadir}/git-core/
%files core-doc -f man-doc-files-core %files core-doc -f man-doc-files-core
@ -910,7 +945,6 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%exclude %{_pkgdocdir}/contrib/*/*.py[co] %exclude %{_pkgdocdir}/contrib/*/*.py[co]
%endif %endif
# endif rhel <= 7 # endif rhel <= 7
%{_pkgdocdir}/contrib/hooks
%if %{with libsecret} %if %{with libsecret}
%files credential-libsecret %files credential-libsecret
@ -920,7 +954,7 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%if %{with cvs} %if %{with cvs}
%files cvs %files cvs
%{_pkgdocdir}/*git-cvs*.txt %{_pkgdocdir}/*git-cvs*.adoc
%{_bindir}/git-cvsserver %{_bindir}/git-cvsserver
%{gitexecdir}/*cvs* %{gitexecdir}/*cvs*
%{?with_docs:%{_mandir}/man1/*cvs*.1*} %{?with_docs:%{_mandir}/man1/*cvs*.1*}
@ -929,30 +963,31 @@ rmdir --ignore-fail-on-non-empty "$testdir"
# endif with cvs # endif with cvs
%files daemon %files daemon
%{_pkgdocdir}/git-daemon*.txt %{_pkgdocdir}/git-daemon*.adoc
%{_unitdir}/git.socket %{_unitdir}/git.socket
%{_unitdir}/git@.service %config(noreplace) %{_unitdir}/git@.service
%{gitexecdir}/git-daemon %{gitexecdir}/git-daemon
%{_localstatedir}/lib/git %{_localstatedir}/lib/git
%{?with_docs:%{_mandir}/man1/git-daemon*.1*} %{?with_docs:%{_mandir}/man1/git-daemon*.1*}
%{?with_docs:%{_pkgdocdir}/git-daemon*.html} %{?with_docs:%{_pkgdocdir}/git-daemon*.html}
%files email %files email
%{_pkgdocdir}/*email*.txt %{_pkgdocdir}/*email*.adoc
%{gitexecdir}/*email* %{gitexecdir}/*email*
%{?with_docs:%{_mandir}/man1/*email*.1*} %{?with_docs:%{_mandir}/man1/*email*.1*}
%{?with_docs:%{_pkgdocdir}/*email*.html} %{?with_docs:%{_pkgdocdir}/*email*.html}
%files -n gitk %files -n gitk
%{_pkgdocdir}/*gitk*.txt %{_pkgdocdir}/*gitk*.adoc
%{_bindir}/*gitk* %{_bindir}/*gitk*
%{_datadir}/gitk %{_datadir}/gitk
%{bash_completions_dir}/gitk
%{?with_docs:%{_mandir}/man1/*gitk*.1*} %{?with_docs:%{_mandir}/man1/*gitk*.1*}
%{?with_docs:%{_pkgdocdir}/*gitk*.html} %{?with_docs:%{_pkgdocdir}/*gitk*.html}
%files -n gitweb %files -n gitweb
%{_pkgdocdir}/*.gitweb %{_pkgdocdir}/*.gitweb
%{_pkgdocdir}/gitweb*.txt %{_pkgdocdir}/gitweb*.adoc
%{?with_docs:%{_mandir}/man1/gitweb.1*} %{?with_docs:%{_mandir}/man1/gitweb.1*}
%{?with_docs:%{_mandir}/man5/gitweb.conf.5*} %{?with_docs:%{_mandir}/man5/gitweb.conf.5*}
%{?with_docs:%{_pkgdocdir}/gitweb*.html} %{?with_docs:%{_pkgdocdir}/gitweb*.html}
@ -965,8 +1000,8 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%{gitexecdir}/git-citool %{gitexecdir}/git-citool
%{_datadir}/applications/*git-gui.desktop %{_datadir}/applications/*git-gui.desktop
%{_datadir}/git-gui/ %{_datadir}/git-gui/
%{_pkgdocdir}/git-gui.txt %{_pkgdocdir}/git-gui.adoc
%{_pkgdocdir}/git-citool.txt %{_pkgdocdir}/git-citool.adoc
%{?with_docs:%{_mandir}/man1/git-gui.1*} %{?with_docs:%{_mandir}/man1/git-gui.1*}
%{?with_docs:%{_pkgdocdir}/git-gui.html} %{?with_docs:%{_pkgdocdir}/git-gui.html}
%{?with_docs:%{_mandir}/man1/git-citool.1*} %{?with_docs:%{_mandir}/man1/git-citool.1*}
@ -974,7 +1009,7 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%files instaweb %files instaweb
%{gitexecdir}/git-instaweb %{gitexecdir}/git-instaweb
%{_pkgdocdir}/git-instaweb.txt %{_pkgdocdir}/git-instaweb.adoc
%{?with_docs:%{_mandir}/man1/git-instaweb.1*} %{?with_docs:%{_mandir}/man1/git-instaweb.1*}
%{?with_docs:%{_pkgdocdir}/git-instaweb.html} %{?with_docs:%{_pkgdocdir}/git-instaweb.html}
@ -982,7 +1017,7 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%files p4 %files p4
%{gitexecdir}/*p4* %{gitexecdir}/*p4*
%{gitexecdir}/mergetools/p4merge %{gitexecdir}/mergetools/p4merge
%{_pkgdocdir}/*p4*.txt %{_pkgdocdir}/*p4*.adoc
%{?with_docs:%{_mandir}/man1/*p4*.1*} %{?with_docs:%{_mandir}/man1/*p4*.1*}
%{?with_docs:%{_pkgdocdir}/*p4*.html} %{?with_docs:%{_pkgdocdir}/*p4*.html}
%endif %endif
@ -995,17 +1030,183 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%files subtree %files subtree
%{gitexecdir}/git-subtree %{gitexecdir}/git-subtree
%{_pkgdocdir}/git-subtree.txt %{_pkgdocdir}/git-subtree.adoc
%{?with_docs:%{_mandir}/man1/git-subtree.1*} %{?with_docs:%{_mandir}/man1/git-subtree.1*}
%{?with_docs:%{_pkgdocdir}/git-subtree.html} %{?with_docs:%{_pkgdocdir}/git-subtree.html}
%files svn %files svn
%{gitexecdir}/git-svn %{gitexecdir}/git-svn
%{_pkgdocdir}/git-svn.txt %{_pkgdocdir}/git-svn.adoc
%{?with_docs:%{_mandir}/man1/git-svn.1*} %{?with_docs:%{_mandir}/man1/git-svn.1*}
%{?with_docs:%{_pkgdocdir}/git-svn.html} %{?with_docs:%{_pkgdocdir}/git-svn.html}
%changelog %changelog
* Thu Nov 20 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.52.0-1
- update to 2.52.0
* Thu Oct 23 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.51.1-1
- update to 2.51.1
* Sun Oct 12 2025 Yaakov Selkowitz <yselkowi@redhat.com> - 2.51.0-3
- Revbump for tcl/tk 9
* Thu Aug 21 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.51.0-2
- exclude sample hook files from automatic dependency detection
* Wed Aug 20 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.51.0-1
- update to 2.51.0
* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.50.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Tue Jul 08 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.50.1-1
- update to 2.50.1
* Mon Jun 23 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.50.0-1
- update to 2.50.0
* Mon Mar 24 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.49.0-2
- add the option to sanitize sideband channel messages
* Mon Mar 17 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.49.0-1
- update to 2.49.0
* Thu Feb 6 2025 Yanko Kaneti <yaneti@declera.com> - 2.48.1-3
- Keep gitk on tcl/tk 8.x until its ready for 9
* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.48.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Wed Jan 15 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.48.1-1
- update to 2.48.1
* Mon Jan 13 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.48.0-1
- update to 2.48.0
* Mon Nov 25 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.47.1-1
- update to 2.47.1
* Tue Oct 08 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.47.0-1
- update to 2.47.0
* Tue Sep 24 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.46.2-1
- update to 2.46.2
* Mon Sep 16 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.46.1-1
- update to 2.46.1
* Mon Aug 05 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.46.0-1
- update to 2.46.0
* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.45.2-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Mon Jun 03 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.45.2-2
- add glibc-utils BuildRequires
* Mon Jun 03 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.45.2-1
- update to 2.45.2
* Wed May 15 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.45.1-1
- update to 2.45.1
* Tue Apr 30 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.45.0-1
- update to 2.45.0
* Mon Feb 26 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.44.0-1
- update to 2.44.0
* Thu Feb 15 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.43.2-1
- update to 2.43.2
- Resolves: #2264318
* Mon Feb 12 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.43.1-1
- update to 2.43.1
- resolves: #2263575
* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.43.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.43.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Tue Nov 21 2023 Ondřej Pohořelský <opohorel@redhat.com> - 2.43.0-1
- update to 2.43.0
* Tue Nov 14 2023 Ondřej Pohořelský <opohorel@redhat.com> - 2.42.1-1
- update to 2.42.1
* Wed Nov 1 2023 Joe Orton <jorton@redhat.com> - 2.42.0-2
- remove explicit BR for apr-util-bdb (#2247532)
* Tue Oct 03 2023 Ondřej Pohořelský <opohorel@redhat.com> - 2.42.0-1
- update to 2.42.0
* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.41.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Thu Jun 01 2023 Todd Zullinger <tmz@pobox.com> - 2.41.0-1
- update to 2.41.0
* Wed May 24 2023 Todd Zullinger <tmz@pobox.com> - 2.41.0~rc2-1
- update to 2.41.0-rc2
* Fri May 19 2023 Todd Zullinger <tmz@pobox.com> - 2.41.0~rc1-1
- update to 2.41.0-rc1
* Mon May 15 2023 Todd Zullinger <tmz@pobox.com> - 2.41.0~rc0-1
- update to 2.41.0-rc0
* Fri May 12 2023 Todd Zullinger <tmz@pobox.com> - 2.40.1-2
- use tilde versioning for release candidates
* Tue Apr 25 2023 Todd Zullinger <tmz@pobox.com> - 2.40.1-1
- update to 2.40.1 (CVE-2023-25652, CVE-2023-25815, CVE-2023-29007)
* Mon Mar 13 2023 Todd Zullinger <tmz@pobox.com> - 2.40.0-1
- update to 2.40.0
* Tue Mar 07 2023 Todd Zullinger <tmz@pobox.com> - 2.40.0-0.2.rc2
- update to 2.40.0-rc2
* Wed Mar 01 2023 Todd Zullinger <tmz@pobox.com> - 2.40.0-0.1.rc1
- update to 2.40.0-rc1
* Fri Feb 24 2023 Todd Zullinger <tmz@pobox.com> - 2.40.0-0.0.rc0
- update to 2.40.0-rc0
* Tue Feb 14 2023 Todd Zullinger <tmz@pobox.com> - 2.39.2-1
- update to 2.39.2 (CVE-2023-22490, CVE-2023-23946)
* Fri Feb 03 2023 Todd Zullinger <tmz@pobox.com> - 2.39.1-2
- drop perl Email::Valid dep on RHEL (#2166718)
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.39.1-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Tue Jan 17 2023 Todd Zullinger <tmz@pobox.com> - 2.39.1-1
- update to 2.39.1 (CVE-2022-41903, CVE-2022-23521)
* Mon Dec 12 2022 Todd Zullinger <tmz@pobox.com> - 2.39.0-1
- update to 2.39.0
* Mon Dec 05 2022 Todd Zullinger <tmz@pobox.com> - 2.39.0-0.2.rc2
- update to 2.39.0-rc2
* Wed Nov 30 2022 Todd Zullinger <tmz@pobox.com> - 2.39.0-0.1.rc1
- update to 2.39.0-rc1
* Wed Nov 23 2022 Todd Zullinger <tmz@pobox.com> - 2.39.0-0.0.rc0
- update to 2.39.0-rc0
- add mod_http2 BuildRequires for tests
* Sat Nov 12 2022 Todd Zullinger <tmz@pobox.com> - 2.38.1-3
- use %%bash_completions_dir
* Mon Nov 07 2022 Todd Zullinger <tmz@pobox.com> - 2.38.1-2
- don't ship contrib/persistent-https as documentation
- update license data and convert to SPDX format
* Tue Oct 18 2022 Todd Zullinger <tmz@pobox.com> - 2.38.1-1 * Tue Oct 18 2022 Todd Zullinger <tmz@pobox.com> - 2.38.1-1
- update to 2.38.1 (CVE-2022-39253, CVE-2022-39260) - update to 2.38.1 (CVE-2022-39253, CVE-2022-39260)

View file

@ -10,4 +10,17 @@ for exit_file in t/test-results/*.exit; do
printf '\n%s\n%s\n%s\n' "$sep" "$out_file" "$sep" printf '\n%s\n%s\n%s\n' "$sep" "$out_file" "$sep"
cat "$out_file" cat "$out_file"
done done
# tar up test-results & $testdir, then print base64 encoded output
#
# copy $testdir contents to test-results to avoid absolute paths with tar
cp -a $testdir/* t/test-results/
begin='-----BEGIN BASE64 MESSAGE-----'
end='-----END BASE64 MESSAGE-----'
printf '\n%s\n' 'test-results and trash directory output follows; decode via:'
printf '%s\n' "sed -n '/^${begin}$/,/^${end}$/{/^${begin}$/!{/^${end}$/!p}}' build.log | base64 -d >output.tar.zst"
printf '%s\n' "$begin"
tar -C t -cf - test-results/ | zstdmt -17 | base64
printf '%s\n' "$end"
exit 1 exit 1

View file

@ -1,2 +1,2 @@
SHA512 (git-2.38.1.tar.xz) = e62ca6f54f01d2e4ccffb5f94e8e5cd2f3e098b766d909c694a8daf4d00d5cdeb9cc5ff8e9bc55d888406f292ba99433d334d4da9689c0ce5d7299a3c67c90e0 SHA512 (git-2.52.0.tar.xz) = 965e5ebb72d1f080d64e34bdb75f0bb1689c9dd41dcf63b020d986bad49808ac09bfb1115962bc0c5b95bac8622367ac4cd09aa89266f73d2137fe94c90dd3ed
SHA512 (git-2.38.1.tar.sign) = a10fa332d5d5ea96bf6a0ed0c2a568212dd033acd539d07efbb73def13dd0144640a5a17477ea5cfe4104f1fa166237d7b251de275307eac7b91c6e60ca3de5d SHA512 (git-2.52.0.tar.sign) = a5a68ce131a5763650c477ec01a4de958dd6a946bdea0f613e26bdab41d2df6b3ca63f9028bbe603bf0c834bd415c86e6c616b1ff08cc48aa7c3c61a37b24b74