Skip to main content

Browse the archive

https://github.com/git/git
05 April 2024, 19:32:26 UTC
sort by:
Revision Author Date Message Commit Date
abd4d67 Taylor Blau 30 September 2022, 20:32:10 UTC Git 2.30.6 Signed-off-by: Taylor Blau <me@ttaylorr.com> 06 October 2022, 21:38:16 UTC
0ca6ead Kevin Backhouse 28 September 2022, 22:53:32 UTC alias.c: reject too-long cmdline strings in split_cmdline() This function improperly uses an int to represent the number of entries in the resulting argument array. This allows a malicious actor to intentionally overflow the return value, leading to arbitrary heap writes. Because the resulting argv array is typically passed to execv(), it may be possible to leverage this attack to gain remote code execution on a victim machine. This was almost certainly the case for certain configurations of git-shell until the previous commit limited the size of input it would accept. Other calls to split_cmdline() are typically limited by the size of argv the OS is willing to hand us, so are similarly protected. So this is not strictly fixing a known vulnerability, but is a hardening of the function that is worth doing to protect against possible unknown vulnerabilities. One approach to fixing this would be modifying the signature of `split_cmdline()` to look something like: int split_cmdline(char *cmdline, const char ***argv, size_t *argc); Where the return value of `split_cmdline()` is negative for errors, and zero otherwise. If non-NULL, the `*argc` pointer is modified to contain the size of the `**argv` array. But this implies an absurdly large `argv` array, which more than likely larger than the system's argument limit. So even if split_cmdline() allowed this, it would fail immediately afterwards when we called execv(). So instead of converting all of `split_cmdline()`'s callers to work with `size_t` types in this patch, instead pursue the minimal fix here to prevent ever returning an array with more than INT_MAX entries in it. Signed-off-by: Kevin Backhouse <kevinbackhouse@github.com> Signed-off-by: Taylor Blau <me@ttaylorr.com> Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
71ad7fe Jeff King 28 September 2022, 22:52:48 UTC shell: limit size of interactive commands When git-shell is run in interactive mode (which must be enabled by creating $HOME/git-shell-commands), it reads commands from stdin, one per line, and executes them. We read the commands with git_read_line_interactively(), which uses a strbuf under the hood. That means we'll accept an input of arbitrary size (limited only by how much heap we can allocate). That creates two problems: - the rest of the code is not prepared to handle large inputs. The most serious issue here is that split_cmdline() uses "int" for most of its types, which can lead to integer overflow and out-of-bounds array reads and writes. But even with that fixed, we assume that we can feed the command name to snprintf() (via xstrfmt()), which is stuck for historical reasons using "int", and causes it to fail (and even trigger a BUG() call). - since the point of git-shell is to take input from untrusted or semi-trusted clients, it's a mild denial-of-service. We'll allocate as many bytes as the client sends us (actually twice as many, since we immediately duplicate the buffer). We can fix both by just limiting the amount of per-command input we're willing to receive. We should also fix split_cmdline(), of course, which is an accident waiting to happen, but that can come on top. Most calls to split_cmdline(), including the other one in git-shell, are OK because they are reading from an OS-provided argv, which is limited in practice. This patch should eliminate the immediate vulnerabilities. I picked 4MB as an arbitrary limit. It's big enough that nobody should ever run into it in practice (since the point is to run the commands via exec, we're subject to OS limits which are typically much lower). But it's small enough that allocating it isn't that big a deal. The code is mostly just swapping out fgets() for the strbuf call, but we have to add a few niceties like flushing and trimming line endings. We could simplify things further by putting the buffer on the stack, but 4MB is probably a bit much there. Note that we'll _always_ allocate 4MB, which for normal, non-malicious requests is more than we would before this patch. But on the other hand, other git programs are happy to use 96MB for a delta cache. And since we'd never touch most of those pages, on a lazy-allocating OS like Linux they won't even get allocated to actual RAM. The ideal would be a version of strbuf_getline() that accepted a maximum value. But for a minimal vulnerability fix, let's keep things localized and simple. We can always refactor further on top. The included test fails in an obvious way with ASan or UBSan (which notice the integer overflow and out-of-bounds reads). Without them, it fails in a less obvious way: we may segfault, or we may try to xstrfmt() a long string, leading to a BUG(). Either way, it fails reliably before this patch, and passes with it. Note that we don't need an EXPENSIVE prereq on it. It does take 10-15s to fail before this patch, but with the new limit, we fail almost immediately (and the perl process generating 2GB of data exits via SIGPIPE). Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
32696a4 Jeff King 28 September 2022, 22:50:36 UTC shell: add basic tests We have no tests of even basic functionality of git-shell. Let's add a couple of obvious ones. This will serve as a framework for adding tests for new things we fix, as well as making sure we don't screw anything up too badly while doing so. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
a1d4f67 Taylor Blau 29 July 2022, 19:22:13 UTC transport: make `protocol.file.allow` be "user" by default An earlier patch discussed and fixed a scenario where Git could be used as a vector to exfiltrate sensitive data through a Docker container when a potential victim clones a suspicious repository with local submodules that contain symlinks. That security hole has since been plugged, but a similar one still exists. Instead of convincing a would-be victim to clone an embedded submodule via the "file" protocol, an attacker could convince an individual to clone a repository that has a submodule pointing to a valid path on the victim's filesystem. For example, if an individual (with username "foo") has their home directory ("/home/foo") stored as a Git repository, then an attacker could exfiltrate data by convincing a victim to clone a malicious repository containing a submodule pointing at "/home/foo/.git" with `--recurse-submodules`. Doing so would expose any sensitive contents in stored in "/home/foo" tracked in Git. For systems (such as Docker) that consider everything outside of the immediate top-level working directory containing a Dockerfile as inaccessible to the container (with the exception of volume mounts, and so on), this is a violation of trust by exposing unexpected contents in the working copy. To mitigate the likelihood of this kind of attack, adjust the "file://" protocol's default policy to be "user" to prevent commands that execute without user input (including recursive submodule initialization) from taking place by default. Suggested-by: Jeff King <peff@peff.net> Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
f4a32a5 Taylor Blau 29 July 2022, 19:21:53 UTC t/t9NNN: allow local submodules To prepare for the default value of `protocol.file.allow` to change to "user", ensure tests that rely on local submodules can initialize them over the file protocol. Tests that interact with submodules a handful of times use `test_config_global`. Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
0d3beb7 Taylor Blau 29 July 2022, 19:21:40 UTC t/t7NNN: allow local submodules To prepare for the default value of `protocol.file.allow` to change to "user", ensure tests that rely on local submodules can initialize them over the file protocol. Tests that only need to interact with submodules in a limited capacity have individual Git commands annotated with the appropriate configuration via `-c`. Tests that interact with submodules a handful of times use `test_config_global` instead. Test scripts that rely on submodules throughout use a `git config --global` during a setup test towards the beginning of the script. Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
0f21b8f Taylor Blau 29 July 2022, 19:21:18 UTC t/t6NNN: allow local submodules To prepare for the default value of `protocol.file.allow` to change to "user", ensure tests that rely on local submodules can initialize them over the file protocol. Tests that only need to interact with submodules in a limited capacity have individual Git commands annotated with the appropriate configuration via `-c`. Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
225d2d5 Taylor Blau 29 July 2022, 19:21:06 UTC t/t5NNN: allow local submodules To prepare for the default value of `protocol.file.allow` to change to "user", ensure tests that rely on local submodules can initialize them over the file protocol. Tests that only need to interact with submodules in a limited capacity have individual Git commands annotated with the appropriate configuration via `-c`. Tests that interact with submodules a handful of times use `test_config_global` instead. Test scripts that rely on submodules throughout use a `git config --global` during a setup test towards the beginning of the script. Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
ac7e57f Taylor Blau 29 July 2022, 19:20:43 UTC t/t4NNN: allow local submodules To prepare for the default value of `protocol.file.allow` to change to "user", ensure tests that rely on local submodules can initialize them over the file protocol. Tests that only need to interact with submodules in a limited capacity have individual Git commands annotated with the appropriate configuration via `-c`. Tests that interact with submodules a handful of times use `test_config_global` instead. Test scripts that rely on submodules throughout use a `git config --global` during a setup test towards the beginning of the script. Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
f8d510e Taylor Blau 29 July 2022, 19:20:28 UTC t/t3NNN: allow local submodules To prepare for the default value of `protocol.file.allow` to change to "user", ensure tests that rely on local submodules can initialize them over the file protocol. Tests that only need to interact with submodules in a limited capacity have individual Git commands annotated with the appropriate configuration via `-c`. Tests that interact with submodules a handful of times use `test_config_global` instead. Test scripts that rely on submodules throughout use a `git config --global` during a setup test towards the beginning of the script. Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
99f4abb Taylor Blau 29 July 2022, 19:20:03 UTC t/2NNNN: allow local submodules To prepare for the default value of `protocol.file.allow` to change to "user", ensure tests that rely on local submodules can initialize them over the file protocol. Tests that only need to interact with submodules in a limited capacity have individual Git commands annotated with the appropriate configuration via `-c`. Tests that interact with submodules a handful of times use `test_config_global` instead. Test scripts that rely on submodules throughout use a `git config --global` during a setup test towards the beginning of the script. Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
8a96dbc Taylor Blau 29 July 2022, 19:16:10 UTC t/t1NNN: allow local submodules To prepare for the default value of `protocol.file.allow` to change to "user", ensure tests that rely on local submodules can initialize them over the file protocol. Tests that only need to interact with submodules in a limited capacity have individual Git commands annotated with the appropriate configuration via `-c`. Tests that interact with submodules a handful of times use `test_config_global` instead. Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
7de0c30 Taylor Blau 29 July 2022, 19:13:58 UTC t/lib-submodule-update.sh: allow local submodules To prepare for changing the default value of `protocol.file.allow` to "user", update the `prolog()` function in lib-submodule-update to allow submodules to be cloned over the file protocol. This is used by a handful of submodule-related test scripts, which themselves will have to tweak the value of `protocol.file.allow` in certain locations. Those will be done in subsequent commits. Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
6f054f9 Taylor Blau 28 July 2022, 21:35:17 UTC builtin/clone.c: disallow `--local` clones with symlinks When cloning a repository with `--local`, Git relies on either making a hardlink or copy to every file in the "objects" directory of the source repository. This is done through the callpath `cmd_clone()` -> `clone_local()` -> `copy_or_link_directory()`. The way this optimization works is by enumerating every file and directory recursively in the source repository's `$GIT_DIR/objects` directory, and then either making a copy or hardlink of each file. The only exception to this rule is when copying the "alternates" file, in which case paths are rewritten to be absolute before writing a new "alternates" file in the destination repo. One quirk of this implementation is that it dereferences symlinks when cloning. This behavior was most recently modified in 36596fd2df (clone: better handle symlinked files at .git/objects/, 2019-07-10), which attempted to support `--local` clones of repositories with symlinks in their objects directory in a platform-independent way. Unfortunately, this behavior of dereferencing symlinks (that is, creating a hardlink or copy of the source's link target in the destination repository) can be used as a component in attacking a victim by inadvertently exposing the contents of file stored outside of the repository. Take, for example, a repository that stores a Dockerfile and is used to build Docker images. When building an image, Docker copies the directory contents into the VM, and then instructs the VM to execute the Dockerfile at the root of the copied directory. This protects against directory traversal attacks by copying symbolic links as-is without dereferencing them. That is, if a user has a symlink pointing at their private key material (where the symlink is present in the same directory as the Dockerfile, but the key itself is present outside of that directory), the key is unreadable to a Docker image, since the link will appear broken from the container's point of view. This behavior enables an attack whereby a victim is convinced to clone a repository containing an embedded submodule (with a URL like "file:///proc/self/cwd/path/to/submodule") which has a symlink pointing at a path containing sensitive information on the victim's machine. If a user is tricked into doing this, the contents at the destination of those symbolic links are exposed to the Docker image at runtime. One approach to preventing this behavior is to recreate symlinks in the destination repository. But this is problematic, since symlinking the objects directory are not well-supported. (One potential problem is that when sharing, e.g. a "pack" directory via symlinks, different writers performing garbage collection may consider different sets of objects to be reachable, enabling a situation whereby garbage collecting one repository may remove reachable objects in another repository). Instead, prohibit the local clone optimization when any symlinks are present in the `$GIT_DIR/objects` directory of the source repository. Users may clone the repository again by prepending the "file://" scheme to their clone URL, or by adding the `--no-local` option to their `git clone` invocation. The directory iterator used by `copy_or_link_directory()` must no longer dereference symlinks (i.e., it *must* call `lstat()` instead of `stat()` in order to discover whether or not there are symlinks present). This has no bearing on the overall behavior, since we will immediately `die()` on encounter a symlink. Note that t5604.33 suggests that we do support local clones with symbolic links in the source repository's objects directory, but this was likely unintentional, or at least did not take into consideration the problem with sharing parts of the objects directory with symbolic links at the time. Update this test to reflect which options are and aren't supported. Helped-by: Johannes Schindelin <Johannes.Schindelin@gmx.de> Signed-off-by: Taylor Blau <me@ttaylorr.com> 01 October 2022, 04:23:38 UTC
88b7be6 Johannes Schindelin 27 May 2022, 21:38:36 UTC Git 2.30.5 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 23 June 2022, 10:31:05 UTC
3b0bf27 Carlo Marcelo Arenas Belón 10 May 2022, 19:35:29 UTC setup: tighten ownership checks post CVE-2022-24765 8959555cee7 (setup_git_directory(): add an owner check for the top-level directory, 2022-03-02), adds a function to check for ownership of repositories using a directory that is representative of it, and ways to add exempt a specific repository from said check if needed, but that check didn't account for owership of the gitdir, or (when used) the gitfile that points to that gitdir. An attacker could create a git repository in a directory that they can write into but that is owned by the victim to work around the fix that was introduced with CVE-2022-24765 to potentially run code as the victim. An example that could result in privilege escalation to root in *NIX would be to set a repository in a shared tmp directory by doing (for example): $ git -C /tmp init To avoid that, extend the ensure_valid_ownership function to be able to check for all three paths. This will have the side effect of tripling the number of stat() calls when a repository is detected, but the effect is expected to be likely minimal, as it is done only once during the directory walk in which Git looks for a repository. Additionally make sure to resolve the gitfile (if one was used) to find the relevant gitdir for checking. While at it change the message printed on failure so it is clear we are referring to the repository by its worktree (or gitdir if it is bare) and not to a specific directory. Helped-by: Junio C Hamano <junio@pobox.com> Helped-by: Johannes Schindelin <Johannes.Schindelin@gmx.de> Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> 23 June 2022, 10:31:05 UTC
b779214 Junio C Hamano 26 May 2022, 21:51:32 UTC Merge branch 'cb/path-owner-check-with-sudo' With a recent update to refuse access to repositories of other people by default, "sudo make install" and "sudo git describe" stopped working. This series intends to loosen it while keeping the safety. * cb/path-owner-check-with-sudo: t0034: add negative tests and allow git init to mostly work under sudo git-compat-util: avoid failing dir ownership checks if running privileged t: regression git needs safe.directory when using sudo Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 23 June 2022, 10:31:04 UTC
6b11e3d Carlo Marcelo Arenas Belón 17 June 2022, 20:23:38 UTC git-compat-util: allow root to access both SUDO_UID and root owned Previous changes introduced a regression which will prevent root for accessing repositories owned by thyself if using sudo because SUDO_UID takes precedence. Loosen that restriction by allowing root to access repositories owned by both uid by default and without having to add a safe.directory exception. A previous workaround that was documented in the tests is no longer needed so it has been removed together with its specially crafted prerequisite. Helped-by: Johanness Schindelin <Johannes.Schindelin@gmx.de> Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 17 June 2022, 21:03:08 UTC
b9063af Carlo Marcelo Arenas Belón 13 May 2022, 01:00:19 UTC t0034: add negative tests and allow git init to mostly work under sudo Add a support library that provides one function that can be used to run a "scriplet" of commands through sudo and that helps invoking sudo in the slightly awkward way that is required to ensure it doesn't block the call (if shell was allowed as tested in the prerequisite) and it doesn't run the command through a different shell than the one we intended. Add additional negative tests as suggested by Junio and that use a new workspace that is owned by root. Document a regression that was introduced by previous commits where root won't be able anymore to access directories they own unless SUDO_UID is removed from their environment. The tests document additional ways that this new restriction could be worked around and the documentation explains why it might be instead considered a feature, but a "fix" is planned for a future change. Helped-by: Junio C Hamano <gitster@pobox.com> Helped-by: Phillip Wood <phillip.wood123@gmail.com> Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 13 May 2022, 01:12:23 UTC
ae9abbb Carlo Marcelo Arenas Belón 13 May 2022, 01:00:18 UTC git-compat-util: avoid failing dir ownership checks if running privileged bdc77d1d685 (Add a function to determine whether a path is owned by the current user, 2022-03-02) checks for the effective uid of the running process using geteuid() but didn't account for cases where that user was root (because git was invoked through sudo or a compatible tool) and the original uid that repository trusted for its config was no longer known, therefore failing the following otherwise safe call: guy@renard ~/Software/uncrustify $ sudo git describe --always --dirty [sudo] password for guy: fatal: unsafe repository ('/home/guy/Software/uncrustify' is owned by someone else) Attempt to detect those cases by using the environment variables that those tools create to keep track of the original user id, and do the ownership check using that instead. This assumes the environment the user is running on after going privileged can't be tampered with, and also adds code to restrict that the new behavior only applies if running as root, therefore keeping the most common case, which runs unprivileged, from changing, but because of that, it will miss cases where sudo (or an equivalent) was used to change to another unprivileged user or where the equivalent tool used to raise privileges didn't track the original id in a sudo compatible way. Because of compatibility with sudo, the code assumes that uid_t is an unsigned integer type (which is not required by the standard) but is used that way in their codebase to generate SUDO_UID. In systems where uid_t is signed, sudo might be also patched to NOT be unsigned and that might be able to trigger an edge case and a bug (as described in the code), but it is considered unlikely to happen and even if it does, the code would just mostly fail safely, so there was no attempt either to detect it or prevent it by the code, which is something that might change in the future, based on expected user feedback. Reported-by: Guy Maurel <guy.j@maurel.de> Helped-by: SZEDER Gábor <szeder.dev@gmail.com> Helped-by: Randall Becker <rsbecker@nexbridge.com> Helped-by: Phillip Wood <phillip.wood123@gmail.com> Suggested-by: Johannes Schindelin <Johannes.Schindelin@gmx.de> Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 13 May 2022, 01:12:23 UTC
5f1a3fe Carlo Marcelo Arenas Belón 13 May 2022, 01:00:17 UTC t: regression git needs safe.directory when using sudo Originally reported after release of v2.35.2 (and other maint branches) for CVE-2022-24765 and blocking otherwise harmless commands that were done using sudo in a repository that was owned by the user. Add a new test script with very basic support to allow running git commands through sudo, so a reproduction could be implemented and that uses only `git status` as a proxy of the issue reported. Note that because of the way sudo interacts with the system, a much more complete integration with the test framework will require a lot more work and that was therefore intentionally punted for now. The current implementation requires the execution of a special cleanup function which should always be kept as the last "test" or otherwise the standard cleanup functions will fail because they can't remove the root owned directories that are used. This also means that if failures are found while running, the specifics of the failure might not be kept for further debugging and if the test was interrupted, it will be necessary to clean the working directory manually before restarting by running: $ sudo rm -rf trash\ directory.t0034-root-safe-directory/ The test file also uses at least one initial "setup" test that creates a parallel execution directory under the "root" sub directory, which should be used as top level directory for all repositories that are used in this test file. Unlike all other tests the repository provided by the test framework should go unused. Special care should be taken when invoking commands through sudo, since the environment is otherwise independent from what the test framework setup and might have changed the values for HOME, SHELL and dropped several relevant environment variables for your test. Indeed `git status` was used as a proxy because it doesn't even require commits in the repository to work and usually doesn't require much from the environment to run, but a future patch will add calls to `git init` and that will fail to honor the default branch name, unless that setting is NOT provided through an environment variable (which means even a CI run could fail that test if enabled incorrectly). A new SUDO prerequisite is provided that does some sanity checking to make sure the sudo command that will be used allows for passwordless execution as root without restrictions and doesn't mess with git's execution path. This matches what is provided by the macOS agents that are used as part of GitHub actions and probably nowhere else. Most of those characteristics make this test mostly only suitable for CI, but it might be executed locally if special care is taken to provide for all of them in the local configuration and maybe making use of the sudo credential cache by first invoking sudo, entering your password if needed, and then invoking the test with: $ GIT_TEST_ALLOW_SUDO=YES ./t0034-root-safe-directory.sh If it fails to run, then it means your local setup wouldn't work for the test because of the configuration sudo has or other system settings, and things that might help are to comment out sudo's secure_path config, and make sure that the account you are using has no restrictions on the commands it can run through sudo, just like is provided for the user in the CI. For example (assuming a username of marta for you) something probably similar to the following entry in your /etc/sudoers (or equivalent) file: marta ALL=(ALL:ALL) NOPASSWD: ALL Reported-by: SZEDER Gábor <szeder.dev@gmail.com> Helped-by: Phillip Wood <phillip.wood123@gmail.com> Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 13 May 2022, 01:12:23 UTC
17083c7 Junio C Hamano 13 April 2022, 20:31:29 UTC Git 2.30.4 Signed-off-by: Junio C Hamano <gitster@pobox.com> 13 April 2022, 20:31:29 UTC
0f85c4a Derrick Stolee 13 April 2022, 15:32:31 UTC setup: opt-out of check with safe.directory=* With the addition of the safe.directory in 8959555ce (setup_git_directory(): add an owner check for the top-level directory, 2022-03-02) released in v2.35.2, we are receiving feedback from a variety of users about the feature. Some users have a very large list of shared repositories and find it cumbersome to add this config for every one of them. In a more difficult case, certain workflows involve running Git commands within containers. The container boundary prevents any global or system config from communicating `safe.directory` values from the host into the container. Further, the container almost always runs as a different user than the owner of the directory in the host. To simplify the reactions necessary for these users, extend the definition of the safe.directory config value to include a possible '*' value. This value implies that all directories are safe, providing a single setting to opt-out of this protection. Note that an empty assignment of safe.directory clears all previous values, and this is already the case with the "if (!value || !*value)" condition. Signed-off-by: Derrick Stolee <derrickstolee@github.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 13 April 2022, 19:42:51 UTC
bb50ec3 Matheus Valadares 13 April 2022, 15:32:30 UTC setup: fix safe.directory key not being checked It seems that nothing is ever checking to make sure the safe directories in the configs actually have the key safe.directory, so some unrelated config that has a value with a certain directory would also make it a safe directory. Signed-off-by: Matheus Valadares <me@m28.io> Signed-off-by: Derrick Stolee <derrickstolee@github.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 13 April 2022, 19:42:51 UTC
e47363e Derrick Stolee 13 April 2022, 15:32:29 UTC t0033: add tests for safe.directory It is difficult to change the ownership on a directory in our test suite, so insert a new GIT_TEST_ASSUME_DIFFERENT_OWNER environment variable to trick Git into thinking we are in a differently-owned directory. This allows us to test that the config is parsed correctly. Signed-off-by: Derrick Stolee <derrickstolee@github.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 13 April 2022, 19:42:49 UTC
cb95038 Johannes Schindelin 17 March 2022, 09:15:15 UTC Git 2.30.3 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 23 March 2022, 23:22:17 UTC
fdcad5a Johannes Schindelin 23 March 2022, 22:00:41 UTC Fix `GIT_CEILING_DIRECTORIES` with `C:\` and the likes When determining the length of the longest ancestor of a given path with respect to to e.g. `GIT_CEILING_DIRECTORIES`, we special-case the root directory by returning 0 (i.e. we pretend that the path `/` does not end in a slash by virtually stripping it). That is the correct behavior because when normalizing paths, the root directory is special: all other directory paths have their trailing slash stripped, but not the root directory's path (because it would become the empty string, which is not a legal path). However, this special-casing of the root directory in `longest_ancestor_length()` completely forgets about Windows-style root directories, e.g. `C:\`. These _also_ get normalized with a trailing slash (because `C:` would actually refer to the current directory on that drive, not necessarily to its root directory). In fc56c7b34b (mingw: accomodate t0060-path-utils for MSYS2, 2016-01-27), we almost got it right. We noticed that `longest_ancestor_length()` expects a slash _after_ the matched prefix, and if the prefix already ends in a slash, the normalized path won't ever match and -1 is returned. But then that commit went astray: The correct fix is not to adjust the _tests_ to expect an incorrect -1 when that function is fed a prefix that ends in a slash, but instead to treat such a prefix as if the trailing slash had been removed. Likewise, that function needs to handle the case where it is fed a path that ends in a slash (not only a prefix that ends in a slash): if it matches the prefix (plus trailing slash), we still need to verify that the path does not end there, otherwise the prefix is not actually an ancestor of the path but identical to it (and we need to return -1 in that case). With these two adjustments, we no longer need to play games in t0060 where we only add `$rootoff` if the passed prefix is different from the MSYS2 pseudo root, instead we also add it for the MSYS2 pseudo root itself. We do have to be careful to skip that logic entirely for Windows paths, though, because they do are not subject to that MSYS2 pseudo root treatment. This patch fixes the scenario where a user has set `GIT_CEILING_DIRECTORIES=C:\`, which would be ignored otherwise. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 23 March 2022, 23:21:08 UTC
8959555 Johannes Schindelin 02 March 2022, 11:23:04 UTC setup_git_directory(): add an owner check for the top-level directory It poses a security risk to search for a git directory outside of the directories owned by the current user. For example, it is common e.g. in computer pools of educational institutes to have a "scratch" space: a mounted disk with plenty of space that is regularly swiped where any authenticated user can create a directory to do their work. Merely navigating to such a space with a Git-enabled `PS1` when there is a maliciously-crafted `/scratch/.git/` can lead to a compromised account. The same holds true in multi-user setups running Windows, as `C:\` is writable to every authenticated user by default. To plug this vulnerability, we stop Git from accepting top-level directories owned by someone other than the current user. We avoid looking at the ownership of each and every directories between the current and the top-level one (if there are any between) to avoid introducing a performance bottleneck. This new default behavior is obviously incompatible with the concept of shared repositories, where we expect the top-level directory to be owned by only one of its legitimate users. To re-enable that use case, we add support for adding exceptions from the new default behavior via the config setting `safe.directory`. The `safe.directory` config setting is only respected in the system and global configs, not from repository configs or via the command-line, and can have multiple values to allow for multiple shared repositories. We are particularly careful to provide a helpful message to any user trying to use a shared repository. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 21 March 2022, 12:16:26 UTC
bdc77d1 Johannes Schindelin 02 March 2022, 10:06:24 UTC Add a function to determine whether a path is owned by the current user This function will be used in the next commit to prevent `setup_git_directory()` from discovering a repository in a directory that is owned by someone other than the current user. Note: We cannot simply use `st.st_uid` on Windows just like we do on Linux and other Unix-like platforms: according to https://docs.microsoft.com/en-us/cpp/c-runtime-library/reference/stat-functions this field is always zero on Windows (because Windows' idea of a user ID does not fit into a single numerical value). Therefore, we have to do something a little involved to replicate the same functionality there. Also note: On Windows, a user's home directory is not actually owned by said user, but by the administrator. For all practical purposes, it is under the user's control, though, therefore we pretend that it is owned by the user. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 21 March 2022, 12:16:26 UTC
2a9a586 Johannes Schindelin 17 March 2022, 11:52:12 UTC Merge branch 'cb/mingw-gmtime-r' Build fix on Windows. * cb/mingw-gmtime-r: mingw: avoid fallback for {local,gm}time_r() Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 17 March 2022, 11:52:12 UTC
6e7ad1e Carlo Marcelo Arenas Belón 27 November 2021, 10:15:32 UTC mingw: avoid fallback for {local,gm}time_r() mingw-w64's pthread_unistd.h had a bug that mistakenly (because there is no support for the *lockfile() functions required[1]) defined _POSIX_THREAD_SAFE_FUNCTIONS and that was being worked around since 3ecd153a3b (compat/mingw: support MSys2-based MinGW build, 2016-01-14). The bug was fixed in winphtreads, but as a side effect, leaves the reentrant functions from time.h no longer visible and therefore breaks the build. Since the intention all along was to avoid using the fallback functions, formalize the use of POSIX by setting the corresponding feature flag and compile out the implementation for the fallback functions. [1] https://unix.org/whitepapers/reentrant.html Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com> Acked-by: Johannes Schindelin <Johannes.Schindelin@gmx.de> Signed-off-by: Junio C Hamano <gitster@pobox.com> 17 March 2022, 11:52:12 UTC
94f6e3e Johannes Schindelin 12 February 2021, 14:51:13 UTC Git 2.30.2 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:51:13 UTC
e4e6808 Johannes Schindelin 12 February 2021, 14:51:12 UTC Sync with 2.29.3 * maint-2.29: Git 2.29.3 Git 2.28.1 Git 2.27.1 Git 2.26.3 Git 2.25.5 Git 2.24.4 Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path 12 February 2021, 14:51:12 UTC
0628636 Johannes Schindelin 12 February 2021, 14:50:15 UTC Git 2.29.3 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:50:15 UTC
d7bdabe Johannes Schindelin 12 February 2021, 14:50:14 UTC Sync with 2.28.1 * maint-2.28: Git 2.28.1 Git 2.27.1 Git 2.26.3 Git 2.25.5 Git 2.24.4 Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path 12 February 2021, 14:50:14 UTC
e4f4299 Johannes Schindelin 12 February 2021, 14:50:10 UTC Git 2.28.1 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:50:10 UTC
3f01e56 Johannes Schindelin 12 February 2021, 14:50:09 UTC Sync with 2.27.1 * maint-2.27: Git 2.27.1 Git 2.26.3 Git 2.25.5 Git 2.24.4 Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path 12 February 2021, 14:50:09 UTC
6ff7f46 Johannes Schindelin 12 February 2021, 14:50:05 UTC Git 2.27.1 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:50:05 UTC
2d1142a Johannes Schindelin 12 February 2021, 14:50:04 UTC Sync with 2.26.3 * maint-2.26: Git 2.26.3 Git 2.25.5 Git 2.24.4 Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path 12 February 2021, 14:50:04 UTC
a79fd20 Johannes Schindelin 12 February 2021, 14:50:00 UTC Git 2.26.3 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:50:00 UTC
8f80393 Johannes Schindelin 12 February 2021, 14:49:59 UTC Sync with 2.25.5 * maint-2.25: Git 2.25.5 Git 2.24.4 Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path 12 February 2021, 14:49:59 UTC
42ce4c7 Johannes Schindelin 12 February 2021, 14:49:55 UTC Git 2.25.5 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:49:55 UTC
97d1dcb Johannes Schindelin 12 February 2021, 14:49:55 UTC Sync with 2.24.4 * maint-2.24: Git 2.24.4 Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path 12 February 2021, 14:49:55 UTC
06214d1 Johannes Schindelin 12 February 2021, 14:49:50 UTC Git 2.24.4 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:49:50 UTC
92ac04b Johannes Schindelin 12 February 2021, 14:49:50 UTC Sync with 2.23.4 * maint-2.23: Git 2.23.4 Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path 12 February 2021, 14:49:50 UTC
d60b6a9 Johannes Schindelin 12 February 2021, 14:49:46 UTC Git 2.23.4 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:49:46 UTC
4bd06fd Johannes Schindelin 12 February 2021, 14:49:45 UTC Sync with 2.22.5 * maint-2.22: Git 2.22.5 Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path 12 February 2021, 14:49:45 UTC
c753e2a Johannes Schindelin 12 February 2021, 14:49:41 UTC Git 2.22.5 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:49:41 UTC
bcf08f3 Johannes Schindelin 12 February 2021, 14:49:41 UTC Sync with 2.21.4 * maint-2.21: Git 2.21.4 Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path 12 February 2021, 14:49:41 UTC
c735d74 Johannes Schindelin 12 February 2021, 14:49:36 UTC Git 2.21.4 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:49:36 UTC
b1726b1 Johannes Schindelin 12 February 2021, 14:49:35 UTC Sync with 2.20.5 * maint-2.20: Git 2.20.5 Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path 12 February 2021, 14:49:35 UTC
8b1a5f3 Johannes Schindelin 12 February 2021, 14:49:17 UTC Git 2.20.5 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:49:17 UTC
8049638 Johannes Schindelin 12 February 2021, 14:49:17 UTC Sync with 2.19.6 * maint-2.19: Git 2.19.6 Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path 12 February 2021, 14:49:17 UTC
9fb2a1f Johannes Schindelin 12 February 2021, 14:47:48 UTC Git 2.19.6 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:47:48 UTC
fb049fd Johannes Schindelin 12 February 2021, 14:47:47 UTC Sync with 2.18.5 * maint-2.18: Git 2.18.5 Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path 12 February 2021, 14:47:47 UTC
6eed462 Johannes Schindelin 12 February 2021, 14:47:43 UTC Git 2.18.5 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:47:43 UTC
9b77cec Johannes Schindelin 12 February 2021, 14:47:42 UTC Sync with 2.17.6 * maint-2.17: Git 2.17.6 unpack_trees(): start with a fresh lstat cache run-command: invalidate lstat cache after a command finished checkout: fix bug that makes checkout follow symlinks in leading path 12 February 2021, 14:47:42 UTC
6b82d3e Johannes Schindelin 29 January 2021, 18:13:11 UTC Git 2.17.6 Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:47:02 UTC
22539ec Matheus Tavares 02 February 2021, 21:37:10 UTC unpack_trees(): start with a fresh lstat cache We really want to avoid relying on stale information. Signed-off-by: Matheus Tavares <matheus.bernardino@usp.br> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:47:02 UTC
0d58fef Johannes Schindelin 02 February 2021, 21:09:52 UTC run-command: invalidate lstat cache after a command finished In the previous commit, we intercepted calls to `rmdir()` to invalidate the lstat cache in the successful case, so that the lstat cache could not have the idea that a directory exists where there is none. The same situation can arise, of course, when a separate process is spawned (most notably, this is the case in `submodule_move_head()`). Obviously, we cannot know whether a directory was removed in that process, therefore we must invalidate the lstat cache afterwards. Note: in contrast to `lstat_cache_aware_rmdir()`, we invalidate the lstat cache even in case of an error: the process might have removed a directory and still have failed afterwards. Co-authored-by: Matheus Tavares <matheus.bernardino@usp.br> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de> 12 February 2021, 14:47:02 UTC
684dd4c Matheus Tavares 10 December 2020, 13:27:55 UTC checkout: fix bug that makes checkout follow symlinks in leading path Before checking out a file, we have to confirm that all of its leading components are real existing directories. And to reduce the number of lstat() calls in this process, we cache the last leading path known to contain only directories. However, when a path collision occurs (e.g. when checking out case-sensitive files in case-insensitive file systems), a cached path might have its file type changed on disk, leaving the cache on an invalid state. Normally, this doesn't bring any bad consequences as we usually check out files in index order, and therefore, by the time the cached path becomes outdated, we no longer need it anyway (because all files in that directory would have already been written). But, there are some users of the checkout machinery that do not always follow the index order. In particular: checkout-index writes the paths in the same order that they appear on the CLI (or stdin); and the delayed checkout feature -- used when a long-running filter process replies with "status=delayed" -- postpones the checkout of some entries, thus modifying the checkout order. When we have to check out an out-of-order entry and the lstat() cache is invalid (due to a previous path collision), checkout_entry() may end up using the invalid data and thrusting that the leading components are real directories when, in reality, they are not. In the best case scenario, where the directory was replaced by a regular file, the user will get an error: "fatal: unable to create file 'foo/bar': Not a directory". But if the directory was replaced by a symlink, checkout could actually end up following the symlink and writing the file at a wrong place, even outside the repository. Since delayed checkout is affected by this bug, it could be used by an attacker to write arbitrary files during the clone of a maliciously crafted repository. Some candidate solutions considered were to disable the lstat() cache during unordered checkouts or sort the entries before passing them to the checkout machinery. But both ideas include some performance penalty and they don't future-proof the code against new unordered use cases. Instead, we now manually reset the lstat cache whenever we successfully remove a directory. Note: We are not even checking whether the directory was the same as the lstat cache points to because we might face a scenario where the paths refer to the same location but differ due to case folding, precomposed UTF-8 issues, or the presence of `..` components in the path. Two regression tests, with case-collisions and utf8-collisions, are also added for both checkout-index and delayed checkout. Note: to make the previously mentioned clone attack unfeasible, it would be sufficient to reset the lstat cache only after the remove_subtree() call inside checkout_entry(). This is the place where we would remove a directory whose path collides with the path of another entry that we are currently trying to check out (possibly a symlink). However, in the interest of a thorough fix that does not leave Git open to similar-but-not-identical attack vectors, we decided to intercept all `rmdir()` calls in one fell swoop. This addresses CVE-2021-21300. Co-authored-by: Johannes Schindelin <johannes.schindelin@gmx.de> Signed-off-by: Matheus Tavares <matheus.bernardino@usp.br> 12 February 2021, 14:47:02 UTC
59ec224 Junio C Hamano 11 February 2021, 21:57:36 UTC Merge branch 'tb/ci-run-cocci-with-18.04' into maint * tb/ci-run-cocci-with-18.04: .github/workflows/main.yml: run static-analysis on bionic 11 February 2021, 21:57:36 UTC
d051ed7 Taylor Blau 08 February 2021, 21:22:34 UTC .github/workflows/main.yml: run static-analysis on bionic GitHub Actions is transitioning workflow steps that run on 'ubuntu-latest' from 18.04 to 20.04 [1]. This works fine in all steps except the static-analysis one, since Coccinelle isn't available on Ubuntu focal (it is only available in the universe suite). Until Coccinelle can be installed from 20.04's main suite, pin the static-analysis build to run on 18.04, where it can be installed by default. [1]: https://github.com/actions/virtual-environments/issues/1816 Reported-by: Junio C Hamano <gitster@pobox.com> Signed-off-by: Taylor Blau <me@ttaylorr.com> Signed-off-by: Junio C Hamano <gitster@pobox.com> 08 February 2021, 22:38:07 UTC
773e25a Junio C Hamano 08 February 2021, 22:05:35 UTC Git 2.30.1 Signed-off-by: Junio C Hamano <gitster@pobox.com> 08 February 2021, 22:05:55 UTC
dadf9e5 Junio C Hamano 08 February 2021, 22:05:55 UTC Merge branch 'pb/ci-matrix-wo-shortcut' into maint Our setting of GitHub CI test jobs were a bit too eager to give up once there is even one failure found. Tweak the knob to allow other jobs keep running even when we see a failure, so that we can find more failures in a single run. * pb/ci-matrix-wo-shortcut: ci: do not cancel all jobs of a matrix if one fails 08 February 2021, 22:05:55 UTC
f20aeed Junio C Hamano 08 February 2021, 22:05:55 UTC Merge branch 'pb/blame-funcname-range-userdiff' into maint Test fix. * pb/blame-funcname-range-userdiff: annotate-tests: quote variable expansions containing path names 08 February 2021, 22:05:55 UTC
6a7bf0d Junio C Hamano 08 February 2021, 22:05:55 UTC Merge branch 'jk/p5303-sed-portability-fix' into maint A perf script was made more portable. * jk/p5303-sed-portability-fix: p5303: avoid sed GNU-ism 08 February 2021, 22:05:55 UTC
f2d156d Junio C Hamano 08 February 2021, 22:05:55 UTC Merge branch 'ab/branch-sort' into maint The implementation of "git branch --sort" wrt the detached HEAD display has always been hacky, which has been cleaned up. * ab/branch-sort: branch: show "HEAD detached" first under reverse sort branch: sort detached HEAD based on a flag ref-filter: move ref_sorting flags to a bitfield ref-filter: move "cmp_fn" assignment into "else if" arm ref-filter: add braces to if/else if/else chain branch tests: add to --sort tests branch: change "--local" to "--list" in comment 08 February 2021, 22:05:55 UTC
171675a Junio C Hamano 08 February 2021, 22:05:54 UTC Merge branch 'ma/more-opaque-lock-file' into maint Code clean-up. * ma/more-opaque-lock-file: read-cache: try not to peek into `struct {lock_,temp}file` refs/files-backend: don't peek into `struct lock_file` midx: don't peek into `struct lock_file` commit-graph: don't peek into `struct lock_file` builtin/gc: don't peek into `struct lock_file` 08 February 2021, 22:05:55 UTC
6a20b9b Junio C Hamano 08 February 2021, 22:05:54 UTC Merge branch 'dl/p4-encode-after-kw-expansion' into maint Text encoding fix for "git p4". * dl/p4-encode-after-kw-expansion: git-p4: fix syncing file types with pattern 08 February 2021, 22:05:54 UTC
f0e3c7f Junio C Hamano 08 February 2021, 22:05:54 UTC Merge branch 'ar/t6016-modernise' into maint Test update. * ar/t6016-modernise: t6016: move to lib-log-graph.sh framework 08 February 2021, 22:05:54 UTC
3e52ab2 Junio C Hamano 08 February 2021, 22:05:54 UTC Merge branch 'zh/arg-help-format' into maint Clean up option descriptions in "git cmd --help". * zh/arg-help-format: builtin/*: update usage format parse-options: format argh like error messages 08 February 2021, 22:05:54 UTC
71e83b2 Junio C Hamano 08 February 2021, 22:05:53 UTC Merge branch 'ma/doc-pack-format-varint-for-sizes' into maint Doc update. * ma/doc-pack-format-varint-for-sizes: pack-format.txt: document sizes at start of delta data 08 February 2021, 22:05:54 UTC
5731e40 Junio C Hamano 08 February 2021, 22:05:53 UTC Merge branch 'ma/t1300-cleanup' into maint Code clean-up. * ma/t1300-cleanup: t1300: don't needlessly work with `core.foo` configs t1300: remove duplicate test for `--file no-such-file` t1300: remove duplicate test for `--file ../foo` 08 February 2021, 22:05:53 UTC
7734136 Junio C Hamano 08 February 2021, 22:05:53 UTC Merge branch 'fc/t6030-bisect-reset-removes-auxiliary-files' into maint A 3-year old test that was not testing anything useful has been corrected. * fc/t6030-bisect-reset-removes-auxiliary-files: test: bisect-porcelain: fix location of files 08 February 2021, 22:05:53 UTC
d592233 Junio C Hamano 06 February 2021, 00:30:42 UTC Prepare for 2.30.1 Signed-off-by: Junio C Hamano <gitster@pobox.com> 06 February 2021, 00:31:28 UTC
b778c1e Junio C Hamano 06 February 2021, 00:31:28 UTC Merge branch 'js/skip-dashed-built-ins-from-config-mak' into maint Build fix. * js/skip-dashed-built-ins-from-config-mak: SKIP_DASHED_BUILT_INS: respect `config.mak` 06 February 2021, 00:31:28 UTC
93da966 Junio C Hamano 06 February 2021, 00:31:28 UTC Merge branch 'jt/packfile-as-uri-doc' into maint Doc fix for packfile URI feature. * jt/packfile-as-uri-doc: Doc: clarify contents of packfile sent as URI 06 February 2021, 00:31:28 UTC
53ac9ac Junio C Hamano 06 February 2021, 00:31:28 UTC Merge branch 'ab/fsck-doc-fix' into maint Documentation for "git fsck" lost stale bits that has become incorrect. * ab/fsck-doc-fix: fsck doc: remove ancient out-of-date diagnostics 06 February 2021, 00:31:28 UTC
2d43667 Junio C Hamano 06 February 2021, 00:31:27 UTC Merge branch 'jk/log-cherry-pick-duplicate-patches' into maint When more than one commit with the same patch ID appears on one side, "git log --cherry-pick A...B" did not exclude them all when a commit with the same patch ID appears on the other side. Now it does. * jk/log-cherry-pick-duplicate-patches: patch-ids: handle duplicate hashmap entries 06 February 2021, 00:31:28 UTC
635ff67 Junio C Hamano 06 February 2021, 00:31:27 UTC Merge branch 'jk/forbid-lf-in-git-url' into maint Newline characters in the host and path part of git:// URL are now forbidden. * jk/forbid-lf-in-git-url: fsck: reject .gitmodules git:// urls with newlines git_connect_git(): forbid newlines in host and path 06 February 2021, 00:31:27 UTC
8ff9ec4 Junio C Hamano 06 February 2021, 00:31:26 UTC Merge branch 'jc/macos-install-dependencies-fix' into maint Fix for procedure to building CI test environment for mac. * jc/macos-install-dependencies-fix: ci/install-depends: attempt to fix "brew cask" stuff 06 February 2021, 00:31:26 UTC
9d36b1e Junio C Hamano 06 February 2021, 00:31:26 UTC Merge branch 'tb/local-clone-race-doc' into maint Doc update. * tb/local-clone-race-doc: Documentation/git-clone.txt: document race with --local 06 February 2021, 00:31:26 UTC
4f985d5 Junio C Hamano 06 February 2021, 00:31:26 UTC Merge branch 'bc/doc-status-short' into maint Doc update. * bc/doc-status-short: docs: rephrase and clarify the git status --short format 06 February 2021, 00:31:26 UTC
dfbdf8a Junio C Hamano 06 February 2021, 00:31:26 UTC Merge branch 'ab/gettext-charset-comment-fix' into maint Comments update. * ab/gettext-charset-comment-fix: gettext.c: remove/reword a mostly-useless comment Makefile: remove a warning about old GETTEXT_POISON flag 06 February 2021, 00:31:26 UTC
7121735 Junio C Hamano 06 February 2021, 00:31:25 UTC Merge branch 'ug/doc-lose-dircache' into maint Doc update. * ug/doc-lose-dircache: doc: remove "directory cache" from man pages 06 February 2021, 00:31:26 UTC
40a2eed Junio C Hamano 06 February 2021, 00:31:25 UTC Merge branch 'ad/t4129-setfacl-target-fix' into maint Test fix. * ad/t4129-setfacl-target-fix: t4129: fix setfacl-related permissions failure 06 February 2021, 00:31:25 UTC
13f6bea Junio C Hamano 06 February 2021, 00:31:25 UTC Merge branch 'jk/t5516-deflake' into maint Test fix. * jk/t5516-deflake: t5516: loosen "not our ref" error check 06 February 2021, 00:31:25 UTC
c8af1f4 Junio C Hamano 06 February 2021, 00:31:25 UTC Merge branch 'vv/send-email-with-less-secure-apps-access' into maint Doc update. * vv/send-email-with-less-secure-apps-access: git-send-email.txt: mention less secure app access with Gmail 06 February 2021, 00:31:25 UTC
64971f0 Junio C Hamano 06 February 2021, 00:31:24 UTC Merge branch 'pb/mergetool-tool-help-fix' into maint Fix 2.29 regression where "git mergetool --tool-help" fails to list all the available tools. * pb/mergetool-tool-help-fix: mergetool--lib: fix '--tool-help' to correctly show available tools 06 February 2021, 00:31:24 UTC
897d28b Junio C Hamano 06 February 2021, 00:31:23 UTC Merge branch 'ds/for-each-repo-noopfix' into maint "git for-each-repo --config=<var> <cmd>" should not run <cmd> for any repository when the configuration variable <var> is not defined even once. * ds/for-each-repo-noopfix: for-each-repo: do nothing on empty config 06 February 2021, 00:31:23 UTC
4fc7b22 Junio C Hamano 06 February 2021, 00:31:23 UTC Merge branch 'jc/sign-off' into maint Doc update. * jc/sign-off: SubmittingPatches: tighten wording on "sign-off" procedure 06 February 2021, 00:31:23 UTC
801e896 Junio C Hamano 06 February 2021, 00:31:22 UTC Merge branch 'mt/t4129-with-setgid-dir' into maint Some tests expect that "ls -l" output has either '-' or 'x' for group executable bit, but setgid bit can be inherited from parent directory and make these fields 'S' or 's' instead, causing test failures. * mt/t4129-with-setgid-dir: t4129: don't fail if setgid is set in the test directory 06 February 2021, 00:31:23 UTC
a4031f6 Junio C Hamano 06 February 2021, 00:31:22 UTC Merge branch 'en/stash-apply-sparse-checkout' into maint "git stash" did not work well in a sparsely checked out working tree. * en/stash-apply-sparse-checkout: stash: fix stash application in sparse-checkouts stash: remove unnecessary process forking t7012: add a testcase demonstrating stash apply bugs in sparse checkouts 06 February 2021, 00:31:22 UTC
e93f5c6 Junio C Hamano 06 February 2021, 00:31:22 UTC Merge branch 'nk/perf-fsmonitor-cleanup' into maint Test fix. * nk/perf-fsmonitor-cleanup: p7519: allow running without watchman prereq 06 February 2021, 00:31:22 UTC
a08832f Junio C Hamano 06 February 2021, 00:31:22 UTC Merge branch 'rs/rebase-commit-validation' into maint Diagnose command line error of "git rebase" early. * rs/rebase-commit-validation: rebase: verify commit parameter 06 February 2021, 00:31:22 UTC
9536d1b Junio C Hamano 06 February 2021, 00:31:21 UTC Merge branch 'pb/doc-modules-git-work-tree-typofix' into maint Doc fix. * pb/doc-modules-git-work-tree-typofix: gitmodules.txt: fix 'GIT_WORK_TREE' variable name 06 February 2021, 00:31:21 UTC
9874ff5 Junio C Hamano 06 February 2021, 00:31:21 UTC Merge branch 'ta/doc-typofix' into maint Doc fix. * ta/doc-typofix: doc: fix some typos 06 February 2021, 00:31:21 UTC
42df89b Junio C Hamano 06 February 2021, 00:31:20 UTC Merge branch 'pk/subsub-fetch-fix-take-2' into maint "git fetch --recurse-submodules" fix (second attempt). * pk/subsub-fetch-fix-take-2: submodules: fix of regression on fetching of non-init subsub-repo 06 February 2021, 00:31:21 UTC
back to top