Compare commits

..

10 commits

Author SHA1 Message Date
Todd Zullinger
2f437a4ebc Merge branch 'rawhide' into f35 2022-10-18 16:57:18 -04:00
Todd Zullinger
685a1f71f1 Merge branch 'rawhide' into f35 2022-08-31 10:11:19 -04:00
Todd Zullinger
3d6d9f40c2 Merge branch 'rawhide' into f35 2022-08-11 17:34:55 -04:00
Todd Zullinger
5f73382b45 Merge branch 'rawhide' into f35 2022-07-12 13:50:24 -04:00
Todd Zullinger
d4f20c985f update to 2.35.3 (#2073414, CVE-2022-24765)
Per the upstream release notes from 2.30.3¹:

    This release addresses the security issue CVE-2022-24765.

     * CVE-2022-24765:
       On multi-user machines, Git users might find themselves
       unexpectedly in a Git worktree, e.g. when another user created a
       repository in `C:\.git`, in a mounted network drive or in a
       scratch space. Merely having a Git-aware prompt that runs `git
       status` (or `git diff`) and navigating to a directory which is
       supposedly not a Git worktree, or opening such a directory in an
       editor or IDE such as VS Code or Atom, will potentially run
       commands defined by that other user.

and 2.30.4²:

    This release contains minor fix-ups for the changes that went into
    Git 2.30.3, which was made to address CVE-2022-24765.

     * The code that was meant to parse the new `safe.directory`
       configuration variable was not checking what configuration
       variable was being fed to it, which has been corrected.

     * '*' can be used as the value for the `safe.directory` variable to
       signal that the user considers that any directory is safe.

¹ https://github.com/git/git/raw/v2.30.3/Documentation/RelNotes/2.30.3.txt
² https://github.com/git/git/raw/v2.30.4/Documentation/RelNotes/2.30.4.txt
2022-04-18 15:01:50 -04:00
Todd Zullinger
a36bccdebb Merge branch 'rawhide' into f35 2022-02-06 10:45:05 -05:00
Todd Zullinger
b70f1b73ef Merge branch 'rawhide' into f35 2022-01-01 23:38:34 -05:00
Ondřej Pohořelský
09bdf41b74 add Perl requires to git-email
Resolves: rhbz#2020487

In git version 2.33.0, git-send-email.perl has optimized modules
loading[1]. This resulted in perl.req not detecting requires properly,
because it doesn't detect requires that are not at the start of new line.
This commit adds explicit Requires into the spec file.

[1]f4dc9432fd
2021-11-11 16:28:59 +01:00
Todd Zullinger
f4cb043825 update to 2.33.1
Release notes:
https://github.com/git/git/raw/v2.33.1/Documentation/RelNotes/2.33.1.txt
2021-10-14 14:53:01 +02:00
Ondřej Pohořelský
83e961ad61 update to 2.33.0
contrib/hooks/multimail is no longer distributed with git

The multimail hook was removed from the git contrib tree.  From the
upstream commit f74d11471f (multimail: stop shipping a copy,
2021-06-10):

The multimail project is developed independently and has its own project
page. Traditionally, we shipped a copy in contrib/.
However, such a copy is prone to become stale, and users are much better
served to be directed to the actual project instead.
2021-10-05 18:39:33 +02:00
10 changed files with 80 additions and 589 deletions

View file

@ -1,4 +1,4 @@
From 89ccbc15948db9ddbf74530e3fd66dd78ae897ae Mon Sep 17 00:00:00 2001
From aedeaaf788bd8a7fc5a1887196b6f6d8a5c31362 Mon Sep 17 00:00:00 2001
From: Todd Zullinger <tmz@pobox.com>
Date: Sun, 21 Aug 2022 13:49:57 -0400
Subject: [PATCH] t/lib-httpd: try harder to find a port for apache
@ -30,10 +30,10 @@ Signed-off-by: Todd Zullinger <tmz@pobox.com>
1 file changed, 18 insertions(+), 11 deletions(-)
diff --git a/t/lib-httpd.sh b/t/lib-httpd.sh
index 2fb1b2ae56..4afdf5a6aa 100644
index 1f6b9b08d1..9279dcd659 100644
--- a/t/lib-httpd.sh
+++ b/t/lib-httpd.sh
@@ -206,19 +206,26 @@ enable_cgipassauth () {
@@ -175,19 +175,26 @@ prepare_httpd() {
}
start_httpd() {

View file

@ -1,4 +1,4 @@
From e90e1068ddc9cfa3badd23b16a46c57ed6d8308a Mon Sep 17 00:00:00 2001
From 16750d024ce038b019ab2e9ee5639901e445af37 Mon Sep 17 00:00:00 2001
From: Todd Zullinger <tmz@pobox.com>
Date: Fri, 26 Aug 2022 18:28:44 -0400
Subject: [PATCH] t/lib-git-daemon: try harder to find a port

View file

@ -1,4 +1,4 @@
From 41423d666fd52eaa6aa2b44a0de1b81d0857ca06 Mon Sep 17 00:00:00 2001
From aa5105dc115b43edc6c9c11714b092583f1221aa Mon Sep 17 00:00:00 2001
From: Todd Zullinger <tmz@pobox.com>
Date: Fri, 26 Aug 2022 18:28:44 -0400
Subject: [PATCH] t/lib-git-svn: try harder to find a port

View file

@ -1,275 +0,0 @@
From 65e88e659008e2cbf79cf44975406ff0d569a3a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Poho=C5=99elsk=C3=BD?= <opohorel@redhat.com>
Date: Thu, 20 Nov 2025 12:24:59 +0100
Subject: [PATCH] sideband: mask control characters
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The output of `git clone` is a vital component for understanding what
has happened when things go wrong. However, these logs are partially
under the control of the remote server (via the "sideband", which
typically contains what the remote `git pack-objects` process sends to
`stderr`), and is currently not sanitized by Git.
This makes Git susceptible to ANSI escape sequence injection (see
CWE-150, https://cwe.mitre.org/data/definitions/150.html), which allows
attackers to corrupt terminal state, to hide information, and even to
insert characters into the input buffer (i.e. as if the user had typed
those characters).
To plug this vulnerability, disallow any control character in the
sideband, replacing them instead with the common `^<letter/symbol>`
(e.g. `^[` for `\x1b`, `^A` for `\x01`).
There is likely a need for more fine-grained controls instead of using a
"heavy hammer" like this, which will be introduced subsequently.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
sideband: introduce an "escape hatch" to allow control characters
The preceding commit fixed the vulnerability whereas sideband messages
(that are under the control of the remote server) could contain ANSI
escape sequences that would be sent to the terminal verbatim.
However, this fix may not be desirable under all circumstances, e.g.
when remote servers deliberately add coloring to their messages to
increase their urgency.
To help with those use cases, give users a way to opt-out of the
protections: `sideband.allowControlCharacters`.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
sideband: do allow ANSI color sequences by default
The preceding two commits introduced special handling of the sideband
channel to neutralize ANSI escape sequences before sending the payload
to the terminal, and `sideband.allowControlCharacters` to override that
behavior.
However, some `pre-receive` hooks that are actively used in practice
want to color their messages and therefore rely on the fact that Git
passes them through to the terminal.
In contrast to other ANSI escape sequences, it is highly unlikely that
coloring sequences can be essential tools in attack vectors that mislead
Git users e.g. by hiding crucial information.
Therefore we can have both: Continue to allow ANSI coloring sequences to
be passed to the terminal, and neutralize all other ANSI escape
sequences.
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
sideband: default to allowControlCharacters=true
We don't want to change the default Git behaviour, just add the option
to filter control characters.
Signed-off-by: Ondřej Pohořelský <opohorel@redhat.com>
---
Documentation/config.adoc | 2 +
Documentation/config/sideband.adoc | 16 ++++++
sideband.c | 78 ++++++++++++++++++++++++++++-
t/t5409-colorize-remote-messages.sh | 31 ++++++++++++
4 files changed, 125 insertions(+), 2 deletions(-)
create mode 100644 Documentation/config/sideband.adoc
diff --git a/Documentation/config.adoc b/Documentation/config.adoc
index 62eebe7c54..dcea3c0c15 100644
--- a/Documentation/config.adoc
+++ b/Documentation/config.adoc
@@ -523,6 +523,8 @@ include::config/sequencer.adoc[]
include::config/showbranch.adoc[]
+include::config/sideband.adoc[]
+
include::config/sparse.adoc[]
include::config/splitindex.adoc[]
diff --git a/Documentation/config/sideband.adoc b/Documentation/config/sideband.adoc
new file mode 100644
index 0000000000..c9ba24a02c
--- /dev/null
+++ b/Documentation/config/sideband.adoc
@@ -0,0 +1,16 @@
+sideband.allowControlCharacters::
+ By default, control characters that are delivered via the sideband
+ are NOT masked. Use this config setting to prevent potentially
+ unwanted ANSI escape sequences from being sent to the terminal:
++
+--
+ color::
+ Allow ANSI color sequences, line feeds and horizontal tabs,
+ but mask all other control characters.
+ false::
+ Mask all control characters other than line feeds and
+ horizontal tabs.
+ true::
+ Allow all control characters to be sent to the terminal.
+ This is the default.
+--
\ No newline at end of file
diff --git a/sideband.c b/sideband.c
index ea7c25211e..88d1b44a7a 100644
--- a/sideband.c
+++ b/sideband.c
@@ -26,6 +26,12 @@ static struct keyword_entry keywords[] = {
{ "error", GIT_COLOR_BOLD_RED },
};
+static enum {
+ ALLOW_NO_CONTROL_CHARACTERS = 0,
+ ALLOW_ALL_CONTROL_CHARACTERS = 1,
+ ALLOW_ANSI_COLOR_SEQUENCES = 2
+} allow_control_characters = ALLOW_ALL_CONTROL_CHARACTERS;
+
/* Returns a color setting (GIT_COLOR_NEVER, etc). */
static enum git_colorbool use_sideband_colors(void)
{
@@ -39,6 +45,25 @@ static enum git_colorbool use_sideband_colors(void)
if (use_sideband_colors_cached != GIT_COLOR_UNKNOWN)
return use_sideband_colors_cached;
+ switch (repo_config_get_maybe_bool(the_repository, "sideband.allowcontrolcharacters", &i)) {
+ case 0: /* Boolean value */
+ allow_control_characters = i ? ALLOW_ALL_CONTROL_CHARACTERS :
+ ALLOW_NO_CONTROL_CHARACTERS;
+ break;
+ case -1: /* non-Boolean value */
+ if (repo_config_get_string_tmp(the_repository, "sideband.allowcontrolcharacters",
+ &value))
+ ; /* huh? `get_maybe_bool()` returned -1 */
+ else if (!strcmp(value, "color"))
+ allow_control_characters = ALLOW_ANSI_COLOR_SEQUENCES;
+ else
+ warning(_("unrecognized value for `sideband."
+ "allowControlCharacters`: '%s'"), value);
+ break;
+ default:
+ break; /* not configured */
+ }
+
if (!repo_config_get_string_tmp(the_repository, key, &value))
use_sideband_colors_cached = git_config_colorbool(key, value);
else if (!repo_config_get_string_tmp(the_repository, "color.ui", &value))
@@ -66,6 +91,55 @@ void list_config_color_sideband_slots(struct string_list *list, const char *pref
list_config_item(list, prefix, keywords[i].keyword);
}
+static int handle_ansi_color_sequence(struct strbuf *dest, const char *src, int n)
+{
+ int i;
+
+ /*
+ * Valid ANSI color sequences are of the form
+ *
+ * ESC [ [<n> [; <n>]*] m
+ */
+
+ if (allow_control_characters != ALLOW_ANSI_COLOR_SEQUENCES ||
+ n < 3 || src[0] != '\x1b' || src[1] != '[')
+ return 0;
+
+ for (i = 2; i < n; i++) {
+ if (src[i] == 'm') {
+ strbuf_add(dest, src, i + 1);
+ return i;
+ }
+ if (!isdigit(src[i]) && src[i] != ';')
+ break;
+ }
+
+ return 0;
+}
+
+static void strbuf_add_sanitized(struct strbuf *dest, const char *src, int n)
+{
+ int i;
+
+ if (allow_control_characters == ALLOW_ALL_CONTROL_CHARACTERS) {
+ strbuf_add(dest, src, n);
+ return;
+ }
+
+ strbuf_grow(dest, n);
+ for (; n && *src; src++, n--) {
+ if (!iscntrl(*src) || *src == '\t' || *src == '\n')
+ strbuf_addch(dest, *src);
+ else if ((i = handle_ansi_color_sequence(dest, src, n))) {
+ src += i;
+ n -= i;
+ } else {
+ strbuf_addch(dest, '^');
+ strbuf_addch(dest, 0x40 + *src);
+ }
+ }
+}
+
/*
* Optionally highlight one keyword in remote output if it appears at the start
* of the line. This should be called for a single line only, which is
@@ -81,7 +155,7 @@ static void maybe_colorize_sideband(struct strbuf *dest, const char *src, int n)
int i;
if (!want_color_stderr(use_sideband_colors())) {
- strbuf_add(dest, src, n);
+ strbuf_add_sanitized(dest, src, n);
return;
}
@@ -114,7 +188,7 @@ static void maybe_colorize_sideband(struct strbuf *dest, const char *src, int n)
}
}
- strbuf_add(dest, src, n);
+ strbuf_add_sanitized(dest, src, n);
}
diff --git a/t/t5409-colorize-remote-messages.sh b/t/t5409-colorize-remote-messages.sh
index fa5de4500a..2d40d8c640 100755
--- a/t/t5409-colorize-remote-messages.sh
+++ b/t/t5409-colorize-remote-messages.sh
@@ -98,4 +98,35 @@ test_expect_success 'fallback to color.ui' '
grep "<BOLD;RED>error<RESET>: error" decoded
'
+test_expect_success 'disallow (color) control sequences in sideband' '
+ write_script .git/color-me-surprised <<-\EOF &&
+ printf "error: Have you \\033[31mread\\033[m this?\\a\\n" >&2
+ exec "$@"
+ EOF
+ test_config_global uploadPack.packObjectshook ./color-me-surprised &&
+ test_commit need-at-least-one-commit &&
+
+ git -c sideband.allowControlCharacters=color \
+ clone --no-local . throw-away 2>stderr &&
+ test_decode_color <stderr >decoded &&
+ test_grep RED decoded &&
+ test_grep "\\^G" stderr &&
+ tr -dc "\\007" <stderr >actual &&
+ test_must_be_empty actual &&
+
+ rm -rf throw-away &&
+ git -c sideband.allowControlCharacters=false \
+ clone --no-local . throw-away 2>stderr &&
+ test_decode_color <stderr >decoded &&
+ test_grep ! RED decoded &&
+ test_grep "\\^G" stderr &&
+
+ rm -rf throw-away &&
+ git -c sideband.allowControlCharacters clone --no-local . throw-away 2>stderr &&
+ test_decode_color <stderr >decoded &&
+ test_grep RED decoded &&
+ tr -dc "\\007" <stderr >actual &&
+ test_file_not_empty actual
+'
+
test_done
--
2.51.1

View file

@ -1,14 +0,0 @@
diff -ur b/t/lib-httpd/apache.conf a/t/lib-httpd/apache.conf
--- b/t/lib-httpd/apache.conf 2024-01-09 11:06:46.660868023 +0100
+++ a/t/lib-httpd/apache.conf 2024-01-09 11:09:09.572713625 +0100
@@ -272,7 +272,9 @@
<IfDefine DAV>
LoadModule dav_module modules/mod_dav.so
LoadModule dav_fs_module modules/mod_dav_fs.so
-
+ <IfDirective DavLockDBType>
+ DavLockDBType sdbm
+ </IfDirective>
DAVLockDB DAVLock
<Location /dumb/>
Dav on

View file

@ -5,9 +5,6 @@ addFilter("git-subtree.* spelling-error %description .* (subdirectory|subproject
# git-core-doc requires git-core, which provides the symlink target
addFilter("git(-core-doc)?\..*: W: dangling-relative-symlink /usr/share/doc/git/contrib/hooks ../../../git-core/contrib/hooks")
# gitk requires git, which provides the symlink target
addFilter("gitk\.noarch: W: dangling-relative-symlink /usr/share/bash-completion/completions/gitk git")
# git-gui requires git, which provides the git binary
addFilter("git-gui.noarch: W: desktopfile-without-binary /usr/share/applications/git-gui.desktop git")

View file

@ -1,10 +1,8 @@
^ok 1 # SKIP enable client-side http/2 \(missing HTTP2\)$
expensive 2GB clone test; enable with GIT_TEST_CLONE_2GB=true
filesystem does not corrupt utf-8
fsmonitor--daemon is not supported on this platform
GIT_SKIP_TESTS
missing AUTOIDENT
missing BUILTIN_TXT_
missing CASE_INSENSITIVE_FS
missing DONTHAVEIT
missing ([!]LONG_IS_64BIT,)?EXPENSIVE
@ -22,7 +20,6 @@ missing SYMLINKS_WINDOWS
missing TAR_NEEDS_PAX_FALLBACK
missing UTF8_NFD_TO_NFC
missing WINDOWS
skipped: skip all tests in t5559
skipping case insensitive tests
skipping git p4 tests
skipping remote-svn tests, python not available

347
git.spec
View file

@ -14,16 +14,8 @@
%bcond_with linkcheck
%endif
# Settings for Fedora >= 38 and EL >= 10
%if 0%{?fedora} >= 38 || 0%{?rhel} >= 10
%bcond_with perl_modcompat
%else
%bcond_without perl_modcompat
%endif
# Settings for Fedora and EL == 9
# In EL >= 10 docbook5-style-xsl, needed by asciidoctor, is unwanted package
%if 0%{?fedora} || 0%{?rhel} == 9
# Settings for Fedora and EL >= 9
%if 0%{?fedora} || 0%{?rhel} >= 9
%bcond_without asciidoctor
%else
%bcond_with asciidoctor
@ -47,6 +39,12 @@
%global use_perl_interpreter 0
%endif
# Settings for Fedora and EL >= 7
%if 0%{?fedora} || 0%{?rhel} >= 7
%global bashcompdir %(pkg-config --variable=completionsdir bash-completion 2>/dev/null)
%global bashcomproot %(dirname %{bashcompdir} 2>/dev/null)
%endif
# Allow cvs subpackage to be toggled via --with/--without
# Disable cvs subpackage by default on EL >= 8
%if 0%{?rhel} >= 8
@ -59,11 +57,11 @@
%bcond_without libsecret
# Allow p4 subpackage to be toggled via --with/--without
# Disable p4 package by default on EL >= 10
%if 0%{?rhel} >= 10
%bcond_with p4
%else
# Disable by default if we lack python2 or python3 support
%if %{with python2} || %{with python3}
%bcond_without p4
%else
%bcond_with p4
%endif
# Hardening flags for EL-7
@ -71,27 +69,20 @@
%global _hardened_build 1
%endif
# Define %%bash_completions_dir for EL <= 9
%{?!bash_completions_dir:%global bash_completions_dir %{_datadir}/bash-completion/completions}
# Define for release candidates
#global rcrev .rc0
# Set path to the package-notes linker script
%global _package_note_file %{_builddir}/%{name}-%{real_version}/.package_note-%{name}-%{version}-%{release}.%{_arch}.ld
%global _package_note_file %{_builddir}/%{name}-%{version}%{?rcrev}/.package_note-%{name}-%{version}-%{release}.%{_arch}.ld
Name: git
Version: 2.52.0
Release: 1%{?dist}
Version: 2.38.1
Release: 1%{?rcrev}%{?dist}
Summary: Fast Version Control System
License: BSD-3-Clause AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later AND MIT
License: GPLv2
URL: https://git-scm.com/
# Note: real_version must be defined _after_ Version
%global real_version %(echo %{version} | tr '~' '.')
# Adjust Source URL path for release candidates
%global rcpath %(test "%{version}" = "%{real_version}" || echo testing/)
Source0: https://www.kernel.org/pub/software/scm/git/%{rcpath}%{name}-%{real_version}.tar.xz
Source1: https://www.kernel.org/pub/software/scm/git/%{rcpath}%{name}-%{real_version}.tar.sign
Source0: https://www.kernel.org/pub/software/scm/git/%{?rcrev:testing/}%{name}-%{version}%{?rcrev}.tar.xz
Source1: https://www.kernel.org/pub/software/scm/git/%{?rcrev:testing/}%{name}-%{version}%{?rcrev}.tar.sign
# Junio C Hamano's key is used to sign git releases, it can be found in the
# junio-gpg-pub tag within git.
@ -128,20 +119,9 @@ Patch2: 0002-t-lib-git-daemon-try-harder-to-find-a-port.patch
# https://github.com/tmzullinger/git/commit/aa5105dc11
Patch3: 0003-t-lib-git-svn-try-harder-to-find-a-port.patch
# Configurates Apache test server to use `DavLockDBType sdbm`
# Prevents t5540 failures on i686, s390x and ppc64le
Patch5: git-test-apache-davlockdbtype-config.patch
# Adds the option to sanitize sideband channel messages
# CVE-2024-52005 wasn't fixed by upstream. This patch adds the option to harden Git against it.
# The default behaviour of Git remains unchanged.
#
# https://github.com/gitgitgadget/git/pull/1853
Patch6: git-2.52-sanitize-sideband-channel-messages.patch
%if %{with docs}
# pod2man is needed to build Git.3pm
BuildRequires: perl-podlators
BuildRequires: %{_bindir}/pod2man
%if %{with asciidoctor}
BuildRequires: docbook5-style-xsl
BuildRequires: rubygem-asciidoctor
@ -149,6 +129,7 @@ BuildRequires: rubygem-asciidoctor
BuildRequires: asciidoc >= 8.4.1
%endif
# endif with asciidoctor
BuildRequires: perl(File::Compare)
BuildRequires: xmlto
%if %{with linkcheck}
BuildRequires: linkchecker
@ -170,7 +151,6 @@ BuildRequires: findutils
BuildRequires: gawk
BuildRequires: gcc
BuildRequires: gettext
BuildRequires: glibc-utils
BuildRequires: gnupg2
BuildRequires: libcurl-devel
BuildRequires: make
@ -178,6 +158,7 @@ BuildRequires: openssl-devel
BuildRequires: pcre2-devel
BuildRequires: perl(Error)
BuildRequires: perl(lib)
BuildRequires: perl(Test)
%if %{use_perl_generators}
BuildRequires: perl-generators
%endif
@ -203,13 +184,9 @@ BuildRequires: zlib-devel >= 1.2
%if %{with tests}
# Test suite requirements
BuildRequires: acl
%if (0%{?fedora} && 0%{?fedora} < 40) || (0%{?rhel} >= 8 && 0%{?rhel} < 10)
# Needed by t5540-http-push-webdav.sh; recent httpd obviates this
BuildRequires: apr-util-bdb
%endif
%if 0%{?fedora} || 0%{?rhel} >= 8
# Needed by t5559-http-fetch-smart-http2.sh
BuildRequires: mod_http2
# Needed by t5540-http-push-webdav.sh
BuildRequires: apr-util-bdb
%endif
# endif fedora or rhel >= 8
BuildRequires: bash
@ -230,7 +207,7 @@ BuildRequires: glibc-langpack-is
BuildRequires: gnupg2-smime
%endif
# endif fedora or el >= 9
%if 0%{?fedora} || 0%{?rhel} >= 8 || ( 0%{?rhel} == 7 && ( "%{_arch}" == "ppc64le" || "%{_arch}" == "x86_64" ) )
%if 0%{?fedora} || ( 0%{?rhel} >= 7 && ( "%{_arch}" == "ppc64le" || "%{_arch}" == "x86_64" ) )
BuildRequires: highlight
%endif
# endif fedora or el7+ (ppc64le/x86_64)
@ -281,7 +258,6 @@ BuildRequires: subversion-perl
BuildRequires: tar
BuildRequires: time
BuildRequires: zip
BuildRequires: zstd
%endif
# endif with tests
@ -407,10 +383,7 @@ BuildArch: noarch
Requires: git = %{version}-%{release}
Requires: perl(Authen::SASL)
Requires: perl(Cwd)
%if ! 0%{?rhel}
# RHEL lacks perl-Email-Valid (rhbz#2166718)
Requires: perl(Email::Valid)
%endif
Requires: perl(File::Spec)
Requires: perl(File::Spec::Functions)
Requires: perl(File::Temp)
@ -434,7 +407,7 @@ Summary: Git repository browser
BuildArch: noarch
Requires: git = %{version}-%{release}
Requires: git-gui = %{version}-%{release}
Requires: tk
Requires: tk >= 8.4
%description -n gitk
%{summary}.
@ -491,9 +464,7 @@ Requires: git = %{version}-%{release}
Summary: Perl interface to Git
BuildArch: noarch
Requires: git = %{version}-%{release}
%if %{with perl_modcompat}
Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
%endif
%description -n perl-Git
%{summary}.
@ -501,9 +472,7 @@ Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $versi
Summary: Perl interface to Git::SVN
BuildArch: noarch
Requires: git = %{version}-%{release}
%if %{with perl_modcompat}
Requires: perl(:MODULE_COMPAT_%(eval "`%{__perl} -V:version`"; echo $version))
%endif
%description -n perl-Git-SVN
%{summary}.
@ -533,7 +502,7 @@ Requires: subversion
# Verify GPG signatures
xz -dc '%{SOURCE0}' | %{gpgverify} --keyring='%{SOURCE2}' --signature='%{SOURCE1}' --data=-
%autosetup -p1 -n %{name}-%{real_version}
%autosetup -p1 -n %{name}-%{version}%{?rcrev}
# Install print-failed-test-output script
install -p -m 755 %{SOURCE99} print-failed-test-output
@ -541,7 +510,7 @@ install -p -m 755 %{SOURCE99} print-failed-test-output
# Remove git-archimport
sed -i '/^SCRIPT_PERL += git-archimport\.perl$/d' Makefile
sed -i '/^git-archimport/d' command-list.txt
rm git-archimport.perl Documentation/git-archimport.adoc
rm git-archimport.perl Documentation/git-archimport.txt
%if %{without cvs}
# Remove git-cvs* from command list
@ -603,9 +572,6 @@ EOF
%endif
# endif ! defined perl_bootstrap
# Exclude sample hook files from automatic dependency detection
%global __requires_exclude_from ^%{_datadir}/git-core/templates/hooks/.*sample$
# Remove Git::LoadCPAN to ensure we use only system perl modules. This also
# allows the dependencies to be automatically processed by rpm.
rm -rf perl/Git/LoadCPAN{.pm,/}
@ -617,7 +583,7 @@ sed -i 's@"++GITWEB_HOME_LINK_STR++"@$ENV{"SERVER_NAME"} ? "git://" . $ENV{"SERV
# Move contrib/{contacts,subtree} docs to Documentation so they build with the
# proper asciidoc/docbook/xmlto options
mv contrib/{contacts,subtree}/git-*.adoc Documentation/
mv contrib/{contacts,subtree}/git-*.txt Documentation/
%build
# Improve build reproducibility
@ -649,6 +615,13 @@ rm -rf contrib/fast-import/import-zips.py
%endif
# endif with python2
# Use python3 to avoid an unnecessary python2 dependency, if possible.
%if %{with python3}
sed -i -e '1s@#!\( */usr/bin/env python\|%{__python2}\)$@#!%{__python3}@' \
contrib/hg-to-git/hg-to-git.py
%endif
# endif with python3
%install
%make_install %{?with_docs:install-doc}
@ -677,10 +650,6 @@ install -Dpm 0755 contrib/diff-highlight/diff-highlight \
%{buildroot}%{_datadir}/git-core/contrib/diff-highlight
rm -rf contrib/diff-highlight/{Makefile,diff-highlight,*.perl,t}
# Remove contrib/persistent-https; a) this code requires compilation; and b) it
# is licensed differently than git
rm -rf contrib/persistent-https
# Remove contrib/scalar to avoid cruft in the git-core-doc docdir
rm -rf contrib/scalar
@ -727,14 +696,21 @@ perl -p \
%{SOURCE15} > %{buildroot}%{_unitdir}/git@.service
# Setup bash completion
install -Dpm 644 contrib/completion/git-completion.bash %{buildroot}%{bash_completions_dir}/git
ln -s git %{buildroot}%{bash_completions_dir}/gitk
install -Dpm 644 contrib/completion/git-completion.bash %{buildroot}%{bashcompdir}/git
ln -s git %{buildroot}%{bashcompdir}/gitk
# Install tcsh completion
mkdir -p %{buildroot}%{_datadir}/git-core/contrib/completion
install -pm 644 contrib/completion/git-completion.tcsh \
%{buildroot}%{_datadir}/git-core/contrib/completion/
# Move contrib/hooks out of %%docdir
mkdir -p %{buildroot}%{_datadir}/git-core/contrib
mv contrib/hooks %{buildroot}%{_datadir}/git-core/contrib
pushd contrib > /dev/null
ln -s ../../../git-core/contrib/hooks
popd > /dev/null
# Install git-prompt.sh
mkdir -p %{buildroot}%{_datadir}/git-core/contrib/completion
install -pm 644 contrib/completion/git-prompt.sh \
@ -777,7 +753,7 @@ grep -E "$not_core_re" bin-man-doc-files > bin-man-doc-git-files
# contrib
not_core_doc_re="(git-(cvs|gui|citool|daemon|instaweb|subtree))|p4|svn|email|gitk|gitweb"
mkdir -p %{buildroot}%{_pkgdocdir}/
cp -pr CODE_OF_CONDUCT.md README.md Documentation/*.adoc Documentation/RelNotes contrib %{buildroot}%{_pkgdocdir}/
cp -pr CODE_OF_CONDUCT.md README.md Documentation/*.txt Documentation/RelNotes contrib %{buildroot}%{_pkgdocdir}/
# Remove contrib/ files/dirs which have nothing useful for documentation
rm -rf %{buildroot}%{_pkgdocdir}/contrib/{contacts,credential}/
cp -p gitweb/INSTALL %{buildroot}%{_pkgdocdir}/INSTALL.gitweb
@ -816,17 +792,7 @@ find %{buildroot}%{_pkgdocdir} -name "*.html" -print0 | xargs -r0 linkchecker
# endif with docs && with linkcheck
# Tests to skip on all releases and architectures
#
# t5559-http-fetch-smart-http2 runs t5551-http-fetch-smart with
# HTTP_PROTO=HTTP/2. Unfortunately, it fails quite regularly.
# https://lore.kernel.org/git/Y4fUntdlc1mqwad5@pobox.com/
GIT_SKIP_TESTS="t5559"
%if 0%{?rhel} && 0%{?rhel} < 8
# Skip tests which require mod_http2 on el7
GIT_SKIP_TESTS="$GIT_SKIP_TESTS t5559"
%endif
# endif rhel < 8
GIT_SKIP_TESTS=""
%ifarch aarch64 %{arm} %{power64}
# Skip tests which fail on aarch64, arm, and ppc
@ -869,17 +835,6 @@ GIT_SKIP_TESTS="$GIT_SKIP_TESTS t5300.1[02348] t5300.2[03459] t5300.30 t5300.4[5
%endif
# endif rhel == 8 && arch == s390x
%if "%{_arch}" == "s390x"
# Skip tests which fail on s390x
#
# The following tests are failing on s390x.
# https://lore.kernel.org/git/4dc4c8cd-c0cc-4784-8fcf-defa3a051087@mit.edu/
#
# t8020.16 'cross merge boundaries in blaming'
# t8020.19 'last-modified merge undoes changes'
GIT_SKIP_TESTS="$GIT_SKIP_TESTS t8020.16 t8020.19"
%endif
# endif "%{_arch}" == "s390x"
export GIT_SKIP_TESTS
# Set LANG so various UTF-8 tests are run
@ -896,7 +851,7 @@ export GIT_TEST_SVN_HTTPD=true
# Create tmpdir for test output and update GIT_TEST_OPTS
# Also update GIT-BUILD-OPTIONS to keep make from any needless rebuilding
export testdir=$(mktemp -d -p /tmp git-t.XXXX)
testdir=$(mktemp -d -p /tmp git-t.XXXX)
sed -i "s@^GIT_TEST_OPTS = .*@& --root=$testdir@" config.mak
touch -r GIT-BUILD-OPTIONS ts
sed -i "s@\(GIT_TEST_OPTS='.*\)'@\1 --root=$testdir'@" GIT-BUILD-OPTIONS
@ -925,6 +880,11 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%files -f bin-man-doc-git-files
%{_datadir}/git-core/contrib/diff-highlight
%{_datadir}/git-core/contrib/hooks/update-paranoid
%{_datadir}/git-core/contrib/hooks/setgitperms.perl
%{_datadir}/git-core/templates/hooks/fsmonitor-watchman.sample
%{_datadir}/git-core/templates/hooks/pre-rebase.sample
%{_datadir}/git-core/templates/hooks/prepare-commit-msg.sample
%files all
# No files for you!
@ -936,7 +896,12 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%license COPYING
# exclude is best way here because of troubles with symlinks inside git-core/
%exclude %{_datadir}/git-core/contrib/diff-highlight
%{bash_completions_dir}/git
%exclude %{_datadir}/git-core/contrib/hooks/update-paranoid
%exclude %{_datadir}/git-core/contrib/hooks/setgitperms.perl
%exclude %{_datadir}/git-core/templates/hooks/fsmonitor-watchman.sample
%exclude %{_datadir}/git-core/templates/hooks/pre-rebase.sample
%exclude %{_datadir}/git-core/templates/hooks/prepare-commit-msg.sample
%{bashcomproot}
%{_datadir}/git-core/
%files core-doc -f man-doc-files-core
@ -945,6 +910,7 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%exclude %{_pkgdocdir}/contrib/*/*.py[co]
%endif
# endif rhel <= 7
%{_pkgdocdir}/contrib/hooks
%if %{with libsecret}
%files credential-libsecret
@ -954,7 +920,7 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%if %{with cvs}
%files cvs
%{_pkgdocdir}/*git-cvs*.adoc
%{_pkgdocdir}/*git-cvs*.txt
%{_bindir}/git-cvsserver
%{gitexecdir}/*cvs*
%{?with_docs:%{_mandir}/man1/*cvs*.1*}
@ -963,31 +929,30 @@ rmdir --ignore-fail-on-non-empty "$testdir"
# endif with cvs
%files daemon
%{_pkgdocdir}/git-daemon*.adoc
%{_pkgdocdir}/git-daemon*.txt
%{_unitdir}/git.socket
%config(noreplace) %{_unitdir}/git@.service
%{_unitdir}/git@.service
%{gitexecdir}/git-daemon
%{_localstatedir}/lib/git
%{?with_docs:%{_mandir}/man1/git-daemon*.1*}
%{?with_docs:%{_pkgdocdir}/git-daemon*.html}
%files email
%{_pkgdocdir}/*email*.adoc
%{_pkgdocdir}/*email*.txt
%{gitexecdir}/*email*
%{?with_docs:%{_mandir}/man1/*email*.1*}
%{?with_docs:%{_pkgdocdir}/*email*.html}
%files -n gitk
%{_pkgdocdir}/*gitk*.adoc
%{_pkgdocdir}/*gitk*.txt
%{_bindir}/*gitk*
%{_datadir}/gitk
%{bash_completions_dir}/gitk
%{?with_docs:%{_mandir}/man1/*gitk*.1*}
%{?with_docs:%{_pkgdocdir}/*gitk*.html}
%files -n gitweb
%{_pkgdocdir}/*.gitweb
%{_pkgdocdir}/gitweb*.adoc
%{_pkgdocdir}/gitweb*.txt
%{?with_docs:%{_mandir}/man1/gitweb.1*}
%{?with_docs:%{_mandir}/man5/gitweb.conf.5*}
%{?with_docs:%{_pkgdocdir}/gitweb*.html}
@ -1000,8 +965,8 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%{gitexecdir}/git-citool
%{_datadir}/applications/*git-gui.desktop
%{_datadir}/git-gui/
%{_pkgdocdir}/git-gui.adoc
%{_pkgdocdir}/git-citool.adoc
%{_pkgdocdir}/git-gui.txt
%{_pkgdocdir}/git-citool.txt
%{?with_docs:%{_mandir}/man1/git-gui.1*}
%{?with_docs:%{_pkgdocdir}/git-gui.html}
%{?with_docs:%{_mandir}/man1/git-citool.1*}
@ -1009,7 +974,7 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%files instaweb
%{gitexecdir}/git-instaweb
%{_pkgdocdir}/git-instaweb.adoc
%{_pkgdocdir}/git-instaweb.txt
%{?with_docs:%{_mandir}/man1/git-instaweb.1*}
%{?with_docs:%{_pkgdocdir}/git-instaweb.html}
@ -1017,7 +982,7 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%files p4
%{gitexecdir}/*p4*
%{gitexecdir}/mergetools/p4merge
%{_pkgdocdir}/*p4*.adoc
%{_pkgdocdir}/*p4*.txt
%{?with_docs:%{_mandir}/man1/*p4*.1*}
%{?with_docs:%{_pkgdocdir}/*p4*.html}
%endif
@ -1030,183 +995,17 @@ rmdir --ignore-fail-on-non-empty "$testdir"
%files subtree
%{gitexecdir}/git-subtree
%{_pkgdocdir}/git-subtree.adoc
%{_pkgdocdir}/git-subtree.txt
%{?with_docs:%{_mandir}/man1/git-subtree.1*}
%{?with_docs:%{_pkgdocdir}/git-subtree.html}
%files svn
%{gitexecdir}/git-svn
%{_pkgdocdir}/git-svn.adoc
%{_pkgdocdir}/git-svn.txt
%{?with_docs:%{_mandir}/man1/git-svn.1*}
%{?with_docs:%{_pkgdocdir}/git-svn.html}
%changelog
* Thu Nov 20 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.52.0-1
- update to 2.52.0
* Thu Oct 23 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.51.1-1
- update to 2.51.1
* Sun Oct 12 2025 Yaakov Selkowitz <yselkowi@redhat.com> - 2.51.0-3
- Revbump for tcl/tk 9
* Thu Aug 21 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.51.0-2
- exclude sample hook files from automatic dependency detection
* Wed Aug 20 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.51.0-1
- update to 2.51.0
* Wed Jul 23 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.50.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
* Tue Jul 08 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.50.1-1
- update to 2.50.1
* Mon Jun 23 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.50.0-1
- update to 2.50.0
* Mon Mar 24 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.49.0-2
- add the option to sanitize sideband channel messages
* Mon Mar 17 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.49.0-1
- update to 2.49.0
* Thu Feb 6 2025 Yanko Kaneti <yaneti@declera.com> - 2.48.1-3
- Keep gitk on tcl/tk 8.x until its ready for 9
* Thu Jan 16 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.48.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
* Wed Jan 15 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.48.1-1
- update to 2.48.1
* Mon Jan 13 2025 Ondřej Pohořelský <opohorel@redhat.com> - 2.48.0-1
- update to 2.48.0
* Mon Nov 25 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.47.1-1
- update to 2.47.1
* Tue Oct 08 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.47.0-1
- update to 2.47.0
* Tue Sep 24 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.46.2-1
- update to 2.46.2
* Mon Sep 16 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.46.1-1
- update to 2.46.1
* Mon Aug 05 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.46.0-1
- update to 2.46.0
* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.45.2-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
* Mon Jun 03 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.45.2-2
- add glibc-utils BuildRequires
* Mon Jun 03 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.45.2-1
- update to 2.45.2
* Wed May 15 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.45.1-1
- update to 2.45.1
* Tue Apr 30 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.45.0-1
- update to 2.45.0
* Mon Feb 26 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.44.0-1
- update to 2.44.0
* Thu Feb 15 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.43.2-1
- update to 2.43.2
- Resolves: #2264318
* Mon Feb 12 2024 Ondřej Pohořelský <opohorel@redhat.com> - 2.43.1-1
- update to 2.43.1
- resolves: #2263575
* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.43.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Fri Jan 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.43.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
* Tue Nov 21 2023 Ondřej Pohořelský <opohorel@redhat.com> - 2.43.0-1
- update to 2.43.0
* Tue Nov 14 2023 Ondřej Pohořelský <opohorel@redhat.com> - 2.42.1-1
- update to 2.42.1
* Wed Nov 1 2023 Joe Orton <jorton@redhat.com> - 2.42.0-2
- remove explicit BR for apr-util-bdb (#2247532)
* Tue Oct 03 2023 Ondřej Pohořelský <opohorel@redhat.com> - 2.42.0-1
- update to 2.42.0
* Wed Jul 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.41.0-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
* Thu Jun 01 2023 Todd Zullinger <tmz@pobox.com> - 2.41.0-1
- update to 2.41.0
* Wed May 24 2023 Todd Zullinger <tmz@pobox.com> - 2.41.0~rc2-1
- update to 2.41.0-rc2
* Fri May 19 2023 Todd Zullinger <tmz@pobox.com> - 2.41.0~rc1-1
- update to 2.41.0-rc1
* Mon May 15 2023 Todd Zullinger <tmz@pobox.com> - 2.41.0~rc0-1
- update to 2.41.0-rc0
* Fri May 12 2023 Todd Zullinger <tmz@pobox.com> - 2.40.1-2
- use tilde versioning for release candidates
* Tue Apr 25 2023 Todd Zullinger <tmz@pobox.com> - 2.40.1-1
- update to 2.40.1 (CVE-2023-25652, CVE-2023-25815, CVE-2023-29007)
* Mon Mar 13 2023 Todd Zullinger <tmz@pobox.com> - 2.40.0-1
- update to 2.40.0
* Tue Mar 07 2023 Todd Zullinger <tmz@pobox.com> - 2.40.0-0.2.rc2
- update to 2.40.0-rc2
* Wed Mar 01 2023 Todd Zullinger <tmz@pobox.com> - 2.40.0-0.1.rc1
- update to 2.40.0-rc1
* Fri Feb 24 2023 Todd Zullinger <tmz@pobox.com> - 2.40.0-0.0.rc0
- update to 2.40.0-rc0
* Tue Feb 14 2023 Todd Zullinger <tmz@pobox.com> - 2.39.2-1
- update to 2.39.2 (CVE-2023-22490, CVE-2023-23946)
* Fri Feb 03 2023 Todd Zullinger <tmz@pobox.com> - 2.39.1-2
- drop perl Email::Valid dep on RHEL (#2166718)
* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.39.1-1.1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
* Tue Jan 17 2023 Todd Zullinger <tmz@pobox.com> - 2.39.1-1
- update to 2.39.1 (CVE-2022-41903, CVE-2022-23521)
* Mon Dec 12 2022 Todd Zullinger <tmz@pobox.com> - 2.39.0-1
- update to 2.39.0
* Mon Dec 05 2022 Todd Zullinger <tmz@pobox.com> - 2.39.0-0.2.rc2
- update to 2.39.0-rc2
* Wed Nov 30 2022 Todd Zullinger <tmz@pobox.com> - 2.39.0-0.1.rc1
- update to 2.39.0-rc1
* Wed Nov 23 2022 Todd Zullinger <tmz@pobox.com> - 2.39.0-0.0.rc0
- update to 2.39.0-rc0
- add mod_http2 BuildRequires for tests
* Sat Nov 12 2022 Todd Zullinger <tmz@pobox.com> - 2.38.1-3
- use %%bash_completions_dir
* Mon Nov 07 2022 Todd Zullinger <tmz@pobox.com> - 2.38.1-2
- don't ship contrib/persistent-https as documentation
- update license data and convert to SPDX format
* Tue Oct 18 2022 Todd Zullinger <tmz@pobox.com> - 2.38.1-1
- update to 2.38.1 (CVE-2022-39253, CVE-2022-39260)

View file

@ -10,17 +10,4 @@ for exit_file in t/test-results/*.exit; do
printf '\n%s\n%s\n%s\n' "$sep" "$out_file" "$sep"
cat "$out_file"
done
# tar up test-results & $testdir, then print base64 encoded output
#
# copy $testdir contents to test-results to avoid absolute paths with tar
cp -a $testdir/* t/test-results/
begin='-----BEGIN BASE64 MESSAGE-----'
end='-----END BASE64 MESSAGE-----'
printf '\n%s\n' 'test-results and trash directory output follows; decode via:'
printf '%s\n' "sed -n '/^${begin}$/,/^${end}$/{/^${begin}$/!{/^${end}$/!p}}' build.log | base64 -d >output.tar.zst"
printf '%s\n' "$begin"
tar -C t -cf - test-results/ | zstdmt -17 | base64
printf '%s\n' "$end"
exit 1

View file

@ -1,2 +1,2 @@
SHA512 (git-2.52.0.tar.xz) = 965e5ebb72d1f080d64e34bdb75f0bb1689c9dd41dcf63b020d986bad49808ac09bfb1115962bc0c5b95bac8622367ac4cd09aa89266f73d2137fe94c90dd3ed
SHA512 (git-2.52.0.tar.sign) = a5a68ce131a5763650c477ec01a4de958dd6a946bdea0f613e26bdab41d2df6b3ca63f9028bbe603bf0c834bd415c86e6c616b1ff08cc48aa7c3c61a37b24b74
SHA512 (git-2.38.1.tar.xz) = e62ca6f54f01d2e4ccffb5f94e8e5cd2f3e098b766d909c694a8daf4d00d5cdeb9cc5ff8e9bc55d888406f292ba99433d334d4da9689c0ce5d7299a3c67c90e0
SHA512 (git-2.38.1.tar.sign) = a10fa332d5d5ea96bf6a0ed0c2a568212dd033acd539d07efbb73def13dd0144640a5a17477ea5cfe4104f1fa166237d7b251de275307eac7b91c6e60ca3de5d