From dc4fddb3b3afee81d1cdcac425a0441e75cb887b Mon Sep 17 00:00:00 2001 From: bsiegert Date: Sat, 25 Nov 2017 08:49:05 +0000 Subject: Pullup ticket #5646 - requested by he devel/git-base: security fix Revisions pulled up: - devel/git-base/Makefile 1.46 - devel/git-base/distinfo 1.71-1.72 - devel/git/Makefile.version 1.62-1.63 --- Module Name: pkgsrc Committed By: adam Date: Wed Sep 27 06:37:47 UTC 2017 Modified Files: pkgsrc/devel/git: Makefile.version pkgsrc/devel/git-base: Makefile distinfo Log Message: git: update to 2.14.2 Fixes since v2.14.1 * Because recent Git for Windows do come with a real msgfmt, the build procedure for git-gui has been updated to use it instead of a hand-rolled substitute. * "%C(color name)" in the pretty print format always produced ANSI color escape codes, which was an early design mistake. They now honor the configuration (e.g. "color.ui = never") and also tty-ness of the output medium. * The http.{sslkey,sslCert} configuration variables are to be interpreted as a pathname that honors "~[username]/" prefix, but weren't, which has been fixed. * Numerous bugs in walking of reflogs via "log -g" and friends have been fixed. * "git commit" when seeing an totally empty message said "you did not edit the message", which is clearly wrong. The message has been corrected. * When a directory is not readable, "gitweb" fails to build the project list. Work this around by skipping such a directory. * A recently added test for the "credential-cache" helper revealed that EOF detection done around the time the connection to the cache daemon is torn down were flaky. This was fixed by reacting to ECONNRESET and behaving as if we got an EOF. * Some versions of GnuPG fail to kill gpg-agent it auto-spawned and such a left-over agent can interfere with a test. Work it around by attempting to kill one before starting a new test. * "git log --tag=no-such-tag" showed log starting from HEAD, which has been fixed---it now shows nothing. * The "tag.pager" configuration variable was useless for those who actually create tag objects, as it interfered with the use of an editor. A new mechanism has been introduced for commands to enable pager depending on what operation is being carried out to fix this, and then "git tag -l" is made to run pager by default. * "git push --recurse-submodules $there HEAD:$target" was not propagated down to the submodules, but now it is. * Commands like "git rebase" accepted the --rerere-autoupdate option from the command line, but did not always use it. This has been fixed. * "git clone --recurse-submodules --quiet" did not pass the quiet option down to submodules. * "git am -s" has been taught that some input may end with a trailer block that is not Signed-off-by: and it should refrain from adding an extra blank line before adding a new sign-off in such a case. * "git svn" used with "--localtime" option did not compute the tz offset for the timestamp in question and instead always used the current time, which has been corrected. * Memory leaks in a few error codepaths have been plugged. * bash 4.4 or newer gave a warning on NUL byte in command substitution done in "git stash"; this has been squelched. * "git grep -L" and "git grep --quiet -L" reported different exit codes; this has been corrected. * When handshake with a subprocess filter notices that the process asked for an unknown capability, Git did not report what program the offending subprocess was running. This has been corrected. * "git apply" that is used as a better "patch -p1" failed to apply a taken from a file with CRLF line endings to a file with CRLF line endings. The root cause was because it misused convert_to_git() that tried to do "safe-crlf" processing by looking at the index entry at the same path, which is a nonsense---in that mode, "apply" is not working on the data in (or derived from) the index at all. This has been fixed. * Killing "git merge --edit" before the editor returns control left the repository in a state with MERGE_MSG but without MERGE_HEAD, which incorrectly tells the subsequent "git commit" that there was a squash merge in progress. This has been fixed. * "git archive" did not work well with pathspecs and the export-ignore attribute. * "git cvsserver" no longer is invoked by "git daemon" by default, as it is old and largely unmaintained. * Various Perl scripts did not use safe_pipe_capture() instead of backticks, leaving them susceptible to end-user input. They have been corrected. --- Module Name: pkgsrc Committed By: adam Date: Tue Oct 24 06:43:24 UTC 2017 Modified Files: pkgsrc/devel/git: Makefile.version pkgsrc/devel/git-base: distinfo Log Message: git: updated to 2.14.3 Git v2.14.3 Release Notes Fixes since v2.14.2 * A helper function to read a single whole line into strbuf mistakenly triggered OOM error at EOF under certain conditions, which has been fixed. * In addition to "cc: # cruft", "cc: a@dd.re.ss # cruft" was taught to "git send-email" as a valid way to tell it that it needs to also send a carbon copy to in the trailer section. * Fix regression to "gitk --bisect" by a recent update. * Unlike "git commit-tree < file", "git commit-tree -F file" did not pass the contents of the file verbatim and instead completed an incomplete line at the end, if exists. The latter has been updated to match the behaviour of the former. * "git archive", especially when used with pathspec, stored an empty directory in its output, even though Git itself never does so. This has been fixed. * API error-proofing which happens to also squelch warnings from GCC. * "git gc" tries to avoid running two instances at the same time by reading and writing pid/host from and to a lock file; it used to use an incorrect fscanf() format when reading, which has been corrected. * The test linter has been taught that we do not like "echo -e". * Code cmp.std.c nitpick. * "git describe --match" learned to take multiple patterns in v2.13 series, but the feature ignored the patterns after the first one and did not work at all. This has been fixed. * "git cat-file --textconv" started segfaulting recently, which has been corrected. * The built-in pattern to detect the "function header" for HTML did not match

..

elements without any attributes, which has been fixed. * "git mailinfo" was loose in decoding quoted printable and produced garbage when the two letters after the equal sign are not hexadecimal. This has been fixed. * The documentation for '-X