{"thread":{"id":"57717","subject":"What's cooking in git.git (Apr 2022, #03; Tue, 12)","startedAt":"2022-04-12T17:04:15Z","lastAt":"2022-04-14T18:33:19Z","messageCount":10,"participants":["Junio C Hamano","Philippe Blain","Ævar Arnfjörð Bjarmason","demerphq"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"453452","messageId":"xmqq8rsab5do.fsf@gitster.g","threadId":"57717","inReplyTo":null,"subject":"What's cooking in git.git (Apr 2022, #03; Tue, 12)","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-04-12T17:04:03Z","receivedAt":"2022-04-12T17:04:15Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Here are the topics that have been cooking in my tree. Commits\nprefixed with '+' are in 'next' (being in 'next' is a sign that a\ntopic is stable enough to be used and are candidate to be in a\nfuture release). Commits prefixed with '-' are only in 'seen',\nwhich means nothing more than that I have found them of interest for\nsome reason (like \"it may have hard-to-resolve conflicts with\nanother topic already in flight\" or \"this may turn out to be\nuseful\"). Do not read too much into a topic being in (or not in)\n'seen'. The ones marked with '.' do not appear in any of the\nintegration branches, but I am still holding onto them.\n\nSecurity releases for the 2.30-2.35 maintenance tracks have been\ntagged to address CVE-2022-24765, which allows a user to trick other\nusers into running a command of their choice easily on multi-user\nmachines with a shared \"mob\" directory. The fix has been also\nmerged to Git 2.36-rc2 and to all integration branches.\n\nCopies of the source code to Git live in many repositories, and the\nfollowing is a list of the ones I push into or their mirrors. Some\nrepositories have only a subset of branches.\n\nWith maint, master, next, seen, todo:\n\n\tgit://git.kernel.org/pub/scm/git/git.git/\n\tgit://repo.or.cz/alt-git.git/\n\thttps://kernel.googlesource.com/pub/scm/git/git/\n\thttps://github.com/git/git/\n\thttps://gitlab.com/git-vcs/git/\n\nWith all the integration branches and topics broken out:\n\n\thttps://github.com/gitster/git/\n\nEven though the preformatted documentation in HTML and man format\nare not sources, they are published in these repositories for\nconvenience (replace \"htmldocs\" with \"manpages\" for the manual\npages):\n\n\tgit://git.kernel.org/pub/scm/git/git-htmldocs.git/\n\thttps://github.com/gitster/git-htmldocs.git/\n\nRelease tarballs are available at:\n\n\thttps://www.kernel.org/pub/software/scm/git/\n\n--------------------------------------------------\n[Graduated to 'master']\n\n* ja/i18n-fix-for-2.36 (2022-04-11) 1 commit\n (merged to 'next' on 2022-04-11 at 0953a117dc)\n + i18n: fix some badly formatted i18n strings\n\n Fixes to some localizable strings.\n source: \n\n--------------------------------------------------\n[New Topics]\n\n* pw/test-malloc-with-sanitize-address (2022-04-11) 1 commit\n - tests: make SANITIZE=address imply TEST_NO_MALLOC_CHECK\n\n Avoid problems from interaction between malloc_check and address\n sanitizer.\n\n Will merge to 'next'.\n source: \n\n\n* rs/t7812-pcre2-ws-bug-test (2022-04-11) 1 commit\n - t7812: test PCRE2 whitespace bug\n\n A test to ensure workaround for an earlier pcre2 bug does work.\n\n Will merge to 'next'.\n source: <3a49649d-8ff9-e5a7-e3fd-33fee5068ae8@web.de>\n\n--------------------------------------------------\n[Stalled]\n\n* ab/commit-plug-leaks (2022-02-16) 2 commits\n - commit: use strbuf_release() instead of UNLEAK()\n - commit: fix \"author_ident\" leak\n\n Leakfixes in the top-level called-once function.\n\n Expecting a reroll.\n I think UNLEAK->strbuf_release() is a regression.\n source: \n\n\n* dl/prompt-pick-fix (2022-03-25) 1 commit\n . git-prompt: fix sequencer/todo detection\n\n Fix shell prompt script (in contrib/) for those who set\n rebase.abbreviateCommands; we failed to recognize that we were in a\n multi-step cherry-pick session.\n\n Is this even needed? How?\n cf. \n source: <20220325145301.3370-1-danny0838@gmail.com>\n\n\n* es/superproject-aware-submodules (2022-03-09) 3 commits\n . rev-parse: short-circuit superproject worktree when config unset\n . introduce submodule.hasSuperproject record\n . t7400-submodule-basic: modernize inspect() helper\n\n A configuration variable in a repository tells if it is (or is not)\n a submodule of a superproject.\n\n Expecting a reroll.\n cf. \n source: <20220310004423.2627181-1-emilyshaffer@google.com>\n\n\n* cw/remote-object-info (2022-03-30) 5 commits\n . fixup! transfer.advertiseObjectInfo: add object-info config\n . fixup! object-info: add option for retrieving object info\n . object-info: add option for retrieving object info\n . transfer.advertiseObjectInfo: add object-info config\n . fetch-pack: refactor packet writing and fetch options\n\n Attempt to add a client component to talk with object-info\n endpoint.\n\n Expecting a reroll.\n source: <20220328191112.3092139-1-calvinwan@google.com>\n\n--------------------------------------------------\n[Cooking]\n\n* ah/convert-warning-message (2022-04-08) 1 commit\n - convert: clarify line ending conversion warning\n\n Update a few end-user facing messages around eol conversion.\n\n Will merge to 'next'.\n source: <20220408044154.9947-1-alexhenrie24@gmail.com>\n\n\n* cg/vscode-with-gdb (2022-04-08) 1 commit\n - contrib/vscode/: debugging with VS Code and gdb\n\n VS code configuration updates.\n\n Will merge to 'next'.\n source: <20220407204001.112287-2-cogoni.guillaume@gmail.com>\n\n\n* gf/unused-includes (2022-04-06) 2 commits\n - apply.c: remove unnecessary include\n - serve.c: remove unnecessary include\n\n Remove unused includes.\n\n Will merge to 'next'.\n source: <20220331194436.58005-1-garrit@slashdev.space>\n\n\n* km/t3501-use-test-helpers (2022-04-06) 1 commit\n - t3501: remove test -f and stop ignoring git exit code\n\n Test script updates.\n\n Will merge to 'next'.\n source: <20220405134742.17526-2-khalid.masum.92@gmail.com>\n\n\n* pb/submodule-recurse-mode-enum (2022-04-06) 1 commit\n - submodule.h: use a named enum for RECURSE_SUBMODULES_*\n\n Small code clean-up.\n\n Will merge to 'next'.\n source: \n\n\n* rs/commit-summary-wo-break-rewrite (2022-04-06) 1 commit\n - commit, sequencer: turn off break_opt for commit summary\n\n The commit summary shown after making a commit is matched to what\n is given in \"git status\" not to use the break-rewrite heuristics.\n\n Will merge to 'next'.\n source: \n\n\n* tk/p4-utf8-bom (2022-04-06) 1 commit\n - git-p4: preserve utf8 BOM when importing from p4 to git\n\n \"git p4\" update.\n\n Will merge to 'next'.\n source: \n\n\n* tk/p4-with-explicity-sync (2022-04-06) 1 commit\n - git-p4: support explicit sync of arbitrary existing git-p4 refs\n\n \"git p4\" update.\n\n Will merge to 'next'.\n source: \n\n\n* ab/env-array (2022-04-06) 3 commits\n - run-command API users: use \"env\" not \"env_array\" in comments & names\n - run-command API: rename \"env_array\" to \"env\"\n - cocci: add a rename of \"struct child_process\"'s \"env_array\" to \"env\"\n\n Rename .env_array member to .env in the child_process structure.\n\n On hold.\n source: \n\n\n* ab/misc-cleanup (2022-04-01) 6 commits\n (merged to 'next' on 2022-04-04 at c5fb674865)\n + alloc.[ch]: remove alloc_report() function\n + object-store.h: remove unused has_sha1_file*()\n + pack-bitmap-write: remove unused bitmap_reset() function\n + xdiff/xmacros.h: remove unused XDL_PTRFREE\n + configure.ac: remove USE_PIC comment\n + run-command.h: remove always unused \"clean_on_exit_handler_cbdata\"\n\n Code clean-up.\n\n Will cook in 'next'.\n source: \n\n\n* gf/shorthand-version-and-help (2022-03-31) 1 commit\n - cli: add -v and -h shorthands\n\n \"git -v\" and \"git -h\" are now understood as \"git --version\" and\n \"git --help\".\n\n Will merge to 'next'.\n source: <20220331212709.36036-1-garrit@slashdev.space>\n\n\n* ea/progress-partial-blame (2022-04-06) 1 commit\n (merged to 'next' on 2022-04-07 at 7df8392d71)\n + blame: report correct number of lines in progress when using ranges\n\n The progress meter of \"git blame\" was showing incorrect numbers\n when processing only parts of the file.\n\n Will cook in 'next'.\n source: <20220406181320.16911-1-eantoranz@gmail.com>\n\n\n* ab/plug-leak-in-revisions (2022-04-03) 28 commits\n - revisions API: add a TODO for diff_free(&revs->diffopt)\n - revisions API: have release_revisions() release \"topo_walk_info\"\n - revisions API: have release_revisions() release \"date_mode\"\n - revisions API: call diff_free(&revs->pruning) in revisions_release()\n - revisions API: release \"reflog_info\" in release revisions()\n - revisions API: clear \"boundary_commits\" in release_revisions()\n - revisions API: have release_revisions() release \"prune_data\"\n - revisions API: have release_revisions() release \"grep_filter\"\n - revisions API: have release_revisions() release \"filter\"\n - revisions API: have release_revisions() release \"cmdline\"\n - revisions API: have release_revisions() release \"mailmap\"\n - revisions API: have release_revisions() release \"commits\"\n - revisions API users: use release_revisions() for \"prune_data\" users\n - revisions API users: use release_revisions() with UNLEAK()\n - revisions API users: use release_revisions() in builtin/log.c\n - revisions API users: use release_revisions() in http-push.c\n - revisions API users: add \"goto cleanup\" for release_revisions()\n - stash: always have the owner of \"stash_info\" free it\n - revisions API users: use release_revisions() needing REV_INFO_INIT\n - revision.[ch]: document and move code declared around \"init\"\n - revisions API users: add straightforward release_revisions()\n - revision.[ch]: provide and start using a release_revisions()\n - cocci: add and apply free_commit_list() rules\n - format-patch: don't leak \"extra_headers\" or \"ref_message_ids\"\n - string_list API users: use string_list_init_{no,}dup\n - blame: use \"goto cleanup\" for cleanup_scoreboard()\n - t/helper/test-fast-rebase.c: don't leak \"struct strbuf\"\n - Merge branch 'ds/partial-bundle-more' into ab/plug-leak-in-revisions\n\n Plug the memory leaks from the trickiest API of all, the revision\n walker.\n\n Will merge to 'next'?\n source: \n\n\n* ab/ci-github-workflow-markup (2022-03-27) 7 commits\n - ci: call `finalize_test_case_output` a little later\n - ci: use `--github-workflow-markup` in the GitHub workflow\n - ci: optionally mark up output in the GitHub workflow\n - test(junit): avoid line feeds in XML attributes\n - tests: refactor --write-junit-xml code\n - ci: make it easier to find failed tests' logs in the GitHub workflow\n - Merge branch 'ab/ci-setup-simplify' into ab/ci-github-workflow-markup\n (this branch uses ab/ci-setup-simplify.)\n\n Build a moral equivalent of js/ci-github-workflow-markup on top of\n ab/ci-setup-simplify.\n\n How does this compare feature-wise with js/ci-github-workflow-markup?\n source: \n\n\n* ab/ci-setup-simplify (2022-03-27) 25 commits\n - CI: don't use \"set -x\" in \"ci/lib.sh\" output\n - CI: set PYTHON_PATH setting for osx-{clang,gcc} into \"$jobname\" case\n - CI: set CC in MAKEFLAGS directly, don't add it to the environment\n - CI: add more variables to MAKEFLAGS, except under vs-build\n - CI: narrow down variable definitions in --build and --test\n - CI: only invoke ci/lib.sh as \"steps\" in main.yml\n - CI: pre-select test slice in Windows & VS tests\n - ci/run-test-slice.sh: replace shelling out with \"echo\"\n - CI: move \"env\" definitions into ci/lib.sh\n - CI: combine ci/install{,-docker}-dependencies.sh\n - CI: split up and reduce \"ci/test-documentation.sh\"\n - CI: invoke \"make artifacts-tar\" directly in windows-build\n - CI: check ignored unignored build artifacts in \"win[+VS] build\" too\n - CI: remove \"run-build-and-tests.sh\", run \"make [test]\" directly\n - CI: export variables via a wrapper\n - CI: consistently use \"export\" in ci/lib.sh\n - CI: move p4 and git-lfs variables to ci/install-dependencies.sh\n - CI: have \"static-analysis\" run \"check-builtins\", not \"documentation\"\n - CI: have \"static-analysis\" run a \"make ci-static-analysis\" target\n - CI: don't have \"git grep\" invoke a pager in tree content check\n - CI: remove unused Azure ci/* code\n - CI: remove dead \"tree skipping\" code\n - CI: remove more dead Travis CI support\n - CI: make \"$jobname\" explicit, remove fallback\n - CI: run \"set -ex\" early in ci/lib.sh\n (this branch is used by ab/ci-github-workflow-markup.)\n\n Drive more actions done in CI via the Makefile instead of shell\n commands sprinkled in .github/workflows/main.yml\n\n Unless \"doing more in Makefile\" is fundamentally undesirable, I am\n inclined to take this, together with ab/ci-github-workflow-markup\n to replace js/ci-github-workflow-markup\n cf. \n source: \n\n\n* kf/p4-multiple-remotes (2022-03-21) 1 commit\n - git-p4: fix issue with multiple perforce remotes\n\n \"git p4\" update.\n\n Will merge to 'next'?\n source: \n\n\n* fr/vimdiff-layout (2022-04-03) 4 commits\n (merged to 'next' on 2022-04-04 at 5d1c8197d0)\n + mergetools: add description to all diff/merge tools\n + vimdiff: add tool documentation\n + vimdiff: integrate layout tests in the unit tests framework ('t' folder)\n + vimdiff: new implementation with layout support\n\n Reimplement \"vimdiff[123]\" mergetool drivers with a more generic\n layout mechanism.\n\n Will cook in 'next'.\n source: <20220330191909.294610-1-greenfoo@u92.eu>\n\n\n* bc/stash-export (2022-04-08) 4 commits\n - builtin/stash: provide a way to import stashes from a ref\n - builtin/stash: provide a way to export stashes to a ref\n - builtin/stash: factor out revision parsing into a function\n - object-name: make get_oid quietly return an error\n\n A mechanism to export and import stash entries to and from a normal\n commit to transfer it across repositories has been introduced.\n\n Will merge to 'next'?\n source: <20220407215352.3491567-1-sandals@crustytoothpaste.net>\n\n\n* ns/batch-fsync (2022-04-06) 13 commits\n - core.fsyncmethod: performance tests for batch mode\n - t/perf: add iteration setup mechanism to perf-lib\n - core.fsyncmethod: tests for batch mode\n - test-lib-functions: add parsing helpers for ls-files and ls-tree\n - core.fsync: use batch mode and sync loose objects by default on Windows\n - unpack-objects: use the bulk-checkin infrastructure\n - update-index: use the bulk-checkin infrastructure\n - builtin/add: add ODB transaction around add_files_to_cache\n - cache-tree: use ODB transaction around writing a tree\n - core.fsyncmethod: batched disk flushes for loose-objects\n - bulk-checkin: rebrand plug/unplug APIs as 'odb transactions'\n - bulk-checkin: rename 'state' variable and separate 'plugged' boolean\n - Merge branch 'ns/core-fsyncmethod' into ns/batch-fsync\n\n Introduce a filesystem-dependent mechanism to optimize the way the\n bits for many loose object files are ensured to hit the disk\n platter.\n\n Will merge to 'next'?\n source: \n\n\n* en/sparse-cone-becomes-default (2022-03-13) 9 commits\n - Documentation: some sparsity wording clarifications\n - git-sparse-checkout.txt: mark non-cone mode as deprecated\n - git-sparse-checkout.txt: flesh out non-cone mode pattern discussion a bit\n - git-sparse-checkout.txt: add a new EXAMPLES section\n - git-sparse-checkout.txt: shuffle some sections and mark as internal\n - git-sparse-checkout.txt: update docs for deprecation of 'init'\n - git-sparse-checkout.txt: wording updates for the cone mode default\n - sparse-checkout: make --cone the default\n - tests: stop assuming --no-cone is the default mode for sparse-checkout\n\n Deprecate non-cone mode of the sparse-checkout feature.\n\n Will merge to 'next'?\n source: \n\n\n* tb/cruft-packs (2022-03-02) 17 commits\n - sha1-file.c: don't freshen cruft packs\n - builtin/gc.c: conditionally avoid pruning objects via loose\n - builtin/repack.c: add cruft packs to MIDX during geometric repack\n - builtin/repack.c: use named flags for existing_packs\n - builtin/repack.c: allow configuring cruft pack generation\n - builtin/repack.c: support generating a cruft pack\n - builtin/pack-objects.c: --cruft with expiration\n - reachable: report precise timestamps from objects in cruft packs\n - reachable: add options to add_unseen_recent_objects_to_traversal\n - builtin/pack-objects.c: --cruft without expiration\n - builtin/pack-objects.c: return from create_object_entry()\n - t/helper: add 'pack-mtimes' test-tool\n - pack-mtimes: support writing pack .mtimes files\n - chunk-format.h: extract oid_version()\n - pack-write: pass 'struct packing_data' to 'stage_tmp_packfiles'\n - pack-mtimes: support reading .mtimes files\n - Documentation/technical: add cruft-packs.txt\n\n A mechanism to pack unreachable objects into a \"cruft pack\",\n instead of ejecting them into loose form to be reclaimed later, has\n been introduced.\n\n Waiting for discussion to settle.\n cf. \n source: \n\n\n* js/ci-github-workflow-markup (2022-03-01) 9 commits\n . ci: call `finalize_test_case_output` a little later\n . ci: use `--github-workflow-markup` in the GitHub workflow\n . ci: optionally mark up output in the GitHub workflow\n . test(junit): avoid line feeds in XML attributes\n . tests: refactor --write-junit-xml code\n . ci/run-build-and-tests: add some structure to the GitHub workflow output\n . ci: make it easier to find failed tests' logs in the GitHub workflow\n . ci/run-build-and-tests: take a more high-level view\n . ci: fix code style\n\n Update the GitHub workflow support to make it quicker to get to the\n failing test.\n\n Waiting for discussion to settle.\n cf. <220309.86tuc6lwpj.gmgdl@evledraar.gmail.com>\n cf. <220302.86mti87cj2.gmgdl@evledraar.gmail.com>\n cf. <30dbc8fb-a1db-05bc-3dcb-070e11cf4715@gmail.com>\n source: \n\n\n* et/xdiff-indirection (2022-02-17) 1 commit\n - xdiff: provide indirection to git functions\n\n Insert a layer of preprocessor macros for common functions in xdiff\n codebase.\n\n Expecting a reroll.\n cf. \n source: <20220217225408.GB7@edef91d97c94>\n\n\n* ab/http-gcc-12-workaround (2022-03-25) 1 commit\n - http API: fix dangling pointer issue noted by GCC 12.0\n\n Work around false warning pre-release of GCC 12.\n source: \n\n\n* tk/simple-autosetupmerge (2022-02-25) 2 commits\n - t3200: tests for new branch.autosetupmerge option \"simple\"\n - merge: new autosetupmerge option 'simple' for matching branches\n\n \"git -c branch.autosetupmerge=simple branch $A $B\" will set the $B\n as $A's upstream only when $A and $B shares the same name, and \"git\n -c push.default=simple\" on branch $A would push to update the\n branch $A at the remote $B came from.\n\n Needs review.\n source: \n\n\n* tk/untracked-cache-with-uall (2022-04-01) 2 commits\n (merged to 'next' on 2022-04-04 at 2e11f1ac0c)\n + untracked-cache: support '--untracked-files=all' if configured\n + untracked-cache: test untracked-cache-bypassing behavior with -uall\n\n The performance of the \"untracked cache\" feature has been improved\n when \"--untracked-files=\" and \"status.showUntrackedFiles\"\n are combined.\n\n Will cook in 'next'.\n source: \n\n\n* jh/builtin-fsmonitor-part3 (2022-03-25) 28 commits\n - t7527: test Unicode NFC/NFD handling on MacOS\n - t/lib-unicode-nfc-nfd: helper prereqs for testing unicode nfc/nfd\n - fsmonitor: on macOS also emit NFC spelling for NFD pathname\n - t7527: test FSMonitor on case insensitive+preserving file system\n - fsmonitor: never set CE_FSMONITOR_VALID on submodules\n - t/perf/p7527: add perf test for builtin FSMonitor\n - t7527: FSMonitor tests for directory moves\n - fsmonitor: optimize processing of directory events\n - fsm-listen-darwin: shutdown daemon if worktree root is moved/renamed\n - fsm-health-win32: force shutdown daemon if worktree root moves\n - fsm-health-win32: add polling framework to monitor daemon health\n - fsmonitor--daemon: stub in health thread\n - fsmonitor--daemon: rename listener thread related variables\n - fsmonitor--daemon: prepare for adding health thread\n - fsmonitor--daemon: cd out of worktree root\n - fsm-listen-darwin: ignore FSEvents caused by xattr changes on macOS\n - unpack-trees: initialize fsmonitor_has_run_once in o->result\n - fsmonitor-settings: NTFS and FAT32 on MacOS are incompatible\n - fsmonitor-settings: remote repos on Windows are incompatible\n - fsmonitor-settings: remote repos on macOS are incompatible\n - fsmonitor-settings: stub in macOS-specific incompatibility checking\n - fsmonitor-settings: VFS for Git virtual repos are incompatible\n - fsmonitor-settings: stub in Win32-specific incompatibility checking\n - fsmonitor-settings: bare repos are incompatible with FSMonitor\n - t/helper/fsmonitor-client: create stress test\n - t7527: test FSMonitor on repos with Unicode root paths\n - fsm-listen-win32: handle shortnames\n - Merge branch 'jh/builtin-fsmonitor-part2' into jh/builtin-fsmonitor-part3\n\n More fsmonitor--daemon.\n source: \n\n\n* js/bisect-in-c (2022-02-23) 14 commits\n - bisect: no longer try to clean up left-over `.git/head-name` files\n - bisect: remove Cogito-related code\n - bisect: turn `git bisect` into a full built-in\n - bisect: move even the option parsing to `bisect--helper`\n - bisect--helper: return only correct exit codes in `cmd_*()`\n - bisect--helper: move the `BISECT_STATE` case to the end\n - bisect--helper: make `--bisect-state` optional\n - bisect--helper: align the sub-command order with git-bisect.sh\n - bisect--helper: using `--bisect-state` without an argument is a bug\n - bisect--helper: really retire `--bisect-autostart`\n - bisect--helper: really retire --bisect-next-check\n - bisect--helper: retire the --no-log option\n - bisect: avoid double-quoting when printing the failed command\n - bisect run: fix the error message\n\n Final bits of \"git bisect.sh\" have been rewritten in C.\n\n Expecting a reroll.\n cf. <220225.86ilt27uln.gmgdl@evledraar.gmail.com>\n source: \n\n\n* js/scalar-diagnose (2022-02-06) 6 commits\n - scalar: teach `diagnose` to gather loose objects information\n - scalar: teach `diagnose` to gather packfile info\n - scalar diagnose: include disk space information\n - scalar: add `diagnose`\n - scalar: validate the optional enlistment argument\n - archive: optionally add \"virtual\" files\n\n Implementation of \"scalar diagnose\" subcommand.\n\n On hold.\n cf. \n source: \n\n\n* en/merge-tree (2022-02-23) 13 commits\n - git-merge-tree.txt: add a section on potentional usage mistakes\n - merge-tree: add a --allow-unrelated-histories flag\n - merge-tree: allow `ls-files -u` style info to be NUL terminated\n - merge-tree: provide easy access to `ls-files -u` style info\n - merge-tree: provide a list of which files have conflicts\n - merge-ort: provide a merge_get_conflicted_files() helper function\n - merge-tree: support including merge messages in output\n - merge-ort: split out a separate display_update_messages() function\n - merge-tree: implement real merges\n - merge-tree: add option parsing and initial shell for real merge function\n - merge-tree: move logic for existing merge into new function\n - merge-tree: rename merge_trees() to trivial_merge_trees()\n - Merge branch 'en/remerge-diff' into en/merge-trees\n\n A new command is introduced that takes two commits and computes a\n tree that would be contained in the resulting merge commit, if the\n histories leading to these two commits were to be merged, and is\n added as a new mode of \"git merge-tree\" subcommand.\n\n On hold.\n cf. \n source: \n\n\n* jh/p4-various-fixups (2022-04-01) 22 commits\n (merged to 'next' on 2022-04-04 at 251b14976f)\n + git-p4: sort imports\n + git-p4: seperate multiple statements onto seperate lines\n + git-p4: move inline comments to line above\n + git-p4: only seperate code blocks by a single empty line\n + git-p4: compare to singletons with \"is\" and \"is not\"\n + git-p4: normalize indentation of lines in conditionals\n + git-p4: ensure there is a single space around all operators\n + git-p4: ensure every comment has a single #\n + git-p4: remove spaces between dictionary keys and colons\n + git-p4: remove redundant backslash-continuations inside brackets\n + git-p4: remove extraneous spaces before function arguments\n + git-p4: place a single space after every comma\n + git-p4: removed brackets when assigning multiple return values\n + git-p4: remove spaces around default arguments\n + git-p4: remove padding from lists, tuples and function arguments\n + git-p4: sort and de-duplcate pylint disable list\n + git-p4: remove commented code\n + git-p4: convert descriptive class and function comments into docstrings\n + git-p4: improve consistency of docstring formatting\n + git-p4: indent with 4-spaces\n + git-p4: remove unneeded semicolons from statements\n + git-p4: add blank lines between functions and class definitions\n\n Various cleanups to \"git p4\".\n\n Will cook in 'next'.\n source: <20220401142504.58995-1-jholdsworth@nvidia.com>\n\n\n* js/use-builtin-add-i (2021-12-01) 2 commits\n - add -i: default to the built-in implementation\n - t2016: require the PERL prereq only when necessary\n\n \"git add -i\" was rewritten in C some time ago and has been in\n testing; the reimplementation is now exposed to general public by\n default.\n\n On hold.\n\n What's the status of the \"known breakage\"?\n Are we ready to switch if we wanted to?\n There are known breakages on macOS.\n cf. \n source: \n"},{"id":"453454","messageId":"8698e468-5552-77a3-10c7-933affd98832@gmail.com","threadId":"57717","inReplyTo":"xmqq8rsab5do.fsf@gitster.g","subject":"Re: What's cooking in git.git (Apr 2022, #03; Tue, 12)","fromName":"Philippe Blain","fromEmail":"levraiphilippeblain@gmail.com","sentAt":"2022-04-12T17:52:16Z","receivedAt":"2022-04-12T17:52:22Z","isPatch":false,"sender":{"key":"levraiphilippeblain@gmail.com","avatar":"https://avatars.githubusercontent.com/u/44212482?v=4"},"body":"Hi Junio,\n\nLe 2022-04-12 à 13:04, Junio C Hamano a écrit :\n> \n> \n> Security releases for the 2.30-2.35 maintenance tracks have been\n> tagged to address CVE-2022-24765, which allows a user to trick other\n> users into running a command of their choice easily on multi-user\n> machines with a shared \"mob\" directory. The fix has been also\n> merged to Git 2.36-rc2 and to all integration branches.\n> \n\nThis is quite a big behaviour change for some environments [1], so I would think maybe it\ndeserves to be fully spelled out in the release notes for 2.36.0,\ninstead of just referring readers to the release notes for the maintenance\nrelease, where they can read a full description only in the release notes\nfor 2.30.3 ?\n\nThanks,\nPhilippe.\n\n[1] the commit message for the change mentions \"shared directories\", \nbut in some environments, it is quite common for each user to have\nread access to other uers's home directories. I'm mostly thinking about\nhigh performance computing clusters, which is the kind of systems I have \nexperience with. This makes it really easy for local\n\"git experts\" to 'cd' into a colleague's repo and help them when they \nare facing a Git problem. The fact that it won't be possible to do that\nwithout manually invoking 'git config --add safe.directory $PWD' beforehand\nis a little sad... What were the arguments for specifically disabling\n'git -c safe.directory' for this fix ?\n"},{"id":"453458","messageId":"220412.86h76yglfe.gmgdl@evledraar.gmail.com","threadId":"57717","inReplyTo":"8698e468-5552-77a3-10c7-933affd98832@gmail.com","subject":"CVE-2022-24765 and core.sharedRepository (was: What's cooking in git.git (Apr 2022, #03; Tue, 12))","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2022-04-12T18:55:50Z","receivedAt":"2022-04-12T19:18:36Z","isPatch":false,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"\nOn Tue, Apr 12 2022, Philippe Blain wrote:\n\n[A change of $subject seems in order]\n\n> Le 2022-04-12 à 13:04, Junio C Hamano a écrit :\n>> \n>> \n>> Security releases for the 2.30-2.35 maintenance tracks have been\n>> tagged to address CVE-2022-24765, which allows a user to trick other\n>> users into running a command of their choice easily on multi-user\n>> machines with a shared \"mob\" directory. The fix has been also\n>> merged to Git 2.36-rc2 and to all integration branches.\n>> \n>\n> This is quite a big behaviour change for some environments [1], so I would think maybe it\n> deserves to be fully spelled out in the release notes for 2.36.0,\n> instead of just referring readers to the release notes for the maintenance\n> release, where they can read a full description only in the release notes\n> for 2.30.3 ?\n\nYes, I think it deserves to be noted very prominently, and also that we\nhad some mechanism for publishing relevant git-security@ discussions\n(possibly with some parts redacted) after the issues become public.\n\nNon knowing if others involved are OK with being quoted I'll just say\nthat this issue was discussed at some length on the list, in particular\nthat it'll severely hinder some core.sharedRepository workflows.\n\nQuoting (part of) my own reply from one of those exchanges (this is in\nreply to Johannes Schindelin):\n\n\tBut I don't understand why we need to immediately die() when we detect\n\tthis situation in setup.c.\n\t\n\tWhy don't we just detect it, then set a:\n\t\n\t naughty_fsmonitor = \"/scratch/.git\"\n\t\n\tAnd then later:\n\t\n\t diff --git a/config.c b/config.c\n\t index 383b1a4885b..c9ac12e47b0 100644\n\t --- a/config.c\n\t +++ b/config.c\n\t @@ -2630,6 +2630,9 @@ int git_config_get_fsmonitor(void)\n\t {\n\t if (git_config_get_pathname(\"core.fsmonitor\", &core_fsmonitor))\n\t core_fsmonitor = getenv(\"GIT_TEST_FSMONITOR\");\n\t + else if (naughty_fsmonitor)\n\t + die(_(\"zOMG we got a core.fsmonitor setting from a possibly bad path '%s' ...\"),\n\t + git_config_get_fsmonitor);\n\t\n\t if (core_fsmonitor && !*core_fsmonitor)\n\t core_fsmonitor = NULL;\n\t\n\tWhere the \"...\" would be some version of your advice in 2/2 about\n\tsafe.directory, which would also cause \"naughty_fsmonitor\" to remain\n\tNULL in this case.\n\t\n\tDoesn't that give us all of the relevant security mitigation without\n\tpotentially breaking users in the wild who are relying on git to work in\n\tthe core.sharedRepository case?\n\t\n\tTo Edward's upthread \"I will wager a handsome sum[...]\" comment: An\n\tex-employer has exactly that setup, with AFAIK on the orders of thousand\n\tof users (a shared directory deployment system across a fleet of\n\t\"staging\" servers).\n\t\n\tI'd really like us to avoid unduly disrupting those kinds of setups if\n\twe can help it.\n\t\n\tIn this case doing so seems like a rather easy addition: Let's ignore\n\tand/or die on the combination of this sort of \"unsafe\" directory and\n\tcore.fsmonitor in particular. No?\n\nThat patch doesn't apply anymore (recent fsmonitor changes), but I still\nthink something like that would be a nice thing to have, e.g. being able\nto configure in /etc/gitconfig that \"this system is OK with not needing\nsafe.directory whitelisting, except maybe for core.fsmonitor\".\n\nHopefully Johannes will chime in, but I think it's fair to say that\n(this is just a summarizing from memory, I've surely missed some bits):\n\n * Yes, for the *known* issues we could go for a much more narrow\n solution (something like the above).\n\n * There are other bits of config that also point to executable things,\n e.g. core.editor, aliases etc, but nothing has been found yet that\n provides the \"at a distance\" effect that the core.fsmonitor vector\n does.\n\n I.e. a user is unlikely to go to /tmp/some-crap/here and run \"git\n commit\", but they (or their shell prompt) might run \"git status\", and\n if you have a /tmp/.git ...\n\n * Third-party software is also a wildcard here, i.e. we can know that\n for git itself we have such-and-such interaction with core.editor or\n whatever, but is the same true of the plethora of third-party git\n integrations?\n\n * Johannes et al were concerned that with the cat being out of the bag\n (as it were) other similar issues would be poked at/discovered.\n\n * Therefore a more thorough initial solution was preferred.\n\nAnd maybe?:\n\n * Now that this is out, the people involved would be OK with discussing\n something more surgical, in particular to accommodate the\n core.sharedRepository case (after the current rc phase, preferably).\n\nIn any case, the core.sharedRepository case isn't personally my itch to\nscratch anymore, so I'm not going to pursue this, but perhaps someone\nelse is interested...\n\n> [1] the commit message for the change mentions \"shared directories\", \n> but in some environments, it is quite common for each user to have\n> read access to other uers's home directories. I'm mostly thinking about\n> high performance computing clusters, which is the kind of systems I have \n> experience with. This makes it really easy for local\n> \"git experts\" to 'cd' into a colleague's repo and help them when they \n> are facing a Git problem. The fact that it won't be possible to do that\n> without manually invoking 'git config --add safe.directory $PWD' beforehand\n> is a little sad... What were the arguments for specifically disabling\n> 'git -c safe.directory' for this fix ?\n\nI wasn't aware/hadn't noticed that aspect of it, but I don't think\nthat's \"by design\" or whatever, but just an \"and by the way...\" in\n8959555cee7 (setup_git_directory(): add an owner check for the top-level\ndirectory, 2022-03-02).\n\nI.e. for no particularly good reason other than historical codebase\ngrowth we'll parse the command-line in git.c after we run the setup.c\nbits, which I believe is the reason this isn't supported on the\ncommand-line.\n\nThe same is true for the trace2.* config, which likewise is for no\nparticular reason other than nobody felt like refactoring that tricky\ncore bit of code to make it work.\n\nI.e. if you go back and read the discussions when the trace2.* config\nwas added it was essentially a \"yeah, -c would be nice, but this is good\nenough\", and not \"we'd like to forbid -c by design\".\n\nI hope all of that helps.\n\nP.s.: For anyone wanting to hoist the \"-c\" handling earlier this is\nprobably a good start:\nhttps://lore.kernel.org/git/220128.8635l7d7y6.gmgdl@evledraar.gmail.com/\n"},{"id":"453469","messageId":"CANgJU+XU_j2Ge-c34qqKMZRjM5k4OBYMiJa4t7WJcPsdABWHiQ@mail.gmail.com","threadId":"57717","inReplyTo":"220412.86h76yglfe.gmgdl@evledraar.gmail.com","subject":"Re: CVE-2022-24765 and core.sharedRepository (was: What's cooking in git.git (Apr 2022, #03; Tue, 12))","fromName":"demerphq","fromEmail":"demerphq@gmail.com","sentAt":"2022-04-13T03:10:11Z","receivedAt":"2022-04-13T03:10:53Z","isPatch":false,"sender":{"key":"demerphq@gmail.com","avatar":null},"body":"On Tue, 12 Apr 2022 at 21:43, Ævar Arnfjörð Bjarmason wrote:\n>\n>\n> On Tue, Apr 12 2022, Philippe Blain wrote:\n>\n> [A change of $subject seems in order]\n>\n> > Le 2022-04-12 à 13:04, Junio C Hamano a écrit :\n> >>\n> >>\n> >> Security releases for the 2.30-2.35 maintenance tracks have been\n> >> tagged to address CVE-2022-24765, which allows a user to trick other\n> >> users into running a command of their choice easily on multi-user\n> >> machines with a shared \"mob\" directory. The fix has been also\n> >> merged to Git 2.36-rc2 and to all integration branches.\n> >>\n> >\n> > This is quite a big behaviour change for some environments [1], so I would think maybe it\n> > deserves to be fully spelled out in the release notes for 2.36.0,\n> > instead of just referring readers to the release notes for the maintenance\n> > release, where they can read a full description only in the release notes\n> > for 2.30.3 ?\n>\n> Yes, I think it deserves to be noted very prominently, and also that we\n> had some mechanism for publishing relevant git-security@ discussions\n> (possibly with some parts redacted) after the issues become public.\n>\n> Non knowing if others involved are OK with being quoted I'll just say\n> that this issue was discussed at some length on the list, in particular\n> that it'll severely hinder some core.sharedRepository workflows.\n>\n> Quoting (part of) my own reply from one of those exchanges (this is in\n> reply to Johannes Schindelin):\n>\n> But I don't understand why we need to immediately die() when we detect\n> this situation in setup.c.\n\nWould I be right in thinking this explains new breakage we are seeing\nin CI jobs we (the Perl project) have hosted on GitHub:\n\nhttps://github.com/Perl/perl5/runs/6000831257?check_suite_focus=true#step:5:1\n\nRun git remote set-url origin \"***github.com/$GITHUB_REPOSITORY\"\nfatal: unsafe repository ('/__w/perl5/perl5' is owned by someone else)\nTo add an exception for this directory, call:\n\ngit config --global --add safe.directory /__w/perl5/perl5\nProcess completed with exit code 128.\n\nCheers,\nYves\n"},{"id":"453592","messageId":"220413.86bkx4eobr.gmgdl@evledraar.gmail.com","threadId":"57717","inReplyTo":"xmqq8rsab5do.fsf@gitster.g","subject":"ab/plug-leak-in-revisions (was: What's cooking in git.git (Apr 2022, #03; Tue, 12))","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2022-04-13T20:08:54Z","receivedAt":"2022-04-13T20:11:11Z","isPatch":false,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"\nOn Tue, Apr 12 2022, Junio C Hamano wrote:\n\n> * ab/plug-leak-in-revisions (2022-04-03) 28 commits\n> - revisions API: add a TODO for diff_free(&revs->diffopt)\n> - revisions API: have release_revisions() release \"topo_walk_info\"\n> - revisions API: have release_revisions() release \"date_mode\"\n> - revisions API: call diff_free(&revs->pruning) in revisions_release()\n> - revisions API: release \"reflog_info\" in release revisions()\n> - revisions API: clear \"boundary_commits\" in release_revisions()\n> - revisions API: have release_revisions() release \"prune_data\"\n> - revisions API: have release_revisions() release \"grep_filter\"\n> - revisions API: have release_revisions() release \"filter\"\n> - revisions API: have release_revisions() release \"cmdline\"\n> - revisions API: have release_revisions() release \"mailmap\"\n> - revisions API: have release_revisions() release \"commits\"\n> - revisions API users: use release_revisions() for \"prune_data\" users\n> - revisions API users: use release_revisions() with UNLEAK()\n> - revisions API users: use release_revisions() in builtin/log.c\n> - revisions API users: use release_revisions() in http-push.c\n> - revisions API users: add \"goto cleanup\" for release_revisions()\n> - stash: always have the owner of \"stash_info\" free it\n> - revisions API users: use release_revisions() needing REV_INFO_INIT\n> - revision.[ch]: document and move code declared around \"init\"\n> - revisions API users: add straightforward release_revisions()\n> - revision.[ch]: provide and start using a release_revisions()\n> - cocci: add and apply free_commit_list() rules\n> - format-patch: don't leak \"extra_headers\" or \"ref_message_ids\"\n> - string_list API users: use string_list_init_{no,}dup\n> - blame: use \"goto cleanup\" for cleanup_scoreboard()\n> - t/helper/test-fast-rebase.c: don't leak \"struct strbuf\"\n> - Merge branch 'ds/partial-bundle-more' into ab/plug-leak-in-revisions\n>\n> Plug the memory leaks from the trickiest API of all, the revision\n> walker.\n>\n> Will merge to 'next'?\n> source: \n\nI think it should be ready with my just-submitted re-roll, which fixes a\ntrivial nit spotted by Phillip Wood by removing a useless NULL check:\nhttps://lore.kernel.org/git/cover-v6-00.27-00000000000-20220413T195935Z-avarab@gmail.com/\n"},{"id":"453593","messageId":"220413.867d7senrw.gmgdl@evledraar.gmail.com","threadId":"57717","inReplyTo":"xmqq8rsab5do.fsf@gitster.g","subject":"ab/ci-setup-simplify etc. (was: What's cooking in git.git (Apr 2022, #03; Tue, 12))","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2022-04-13T20:11:50Z","receivedAt":"2022-04-13T20:23:05Z","isPatch":false,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"\nOn Tue, Apr 12 2022, Junio C Hamano wrote:\n\n> * ab/ci-github-workflow-markup (2022-03-27) 7 commits\n> - ci: call `finalize_test_case_output` a little later\n> - ci: use `--github-workflow-markup` in the GitHub workflow\n> - ci: optionally mark up output in the GitHub workflow\n> - test(junit): avoid line feeds in XML attributes\n> - tests: refactor --write-junit-xml code\n> - ci: make it easier to find failed tests' logs in the GitHub workflow\n> - Merge branch 'ab/ci-setup-simplify' into ab/ci-github-workflow-markup\n> (this branch uses ab/ci-setup-simplify.)\n>\n> Build a moral equivalent of js/ci-github-workflow-markup on top of\n> ab/ci-setup-simplify.\n>\n> How does this compare feature-wise with js/ci-github-workflow-markup?\n> source: \n\n...[covered below]...\n\n> * ab/ci-setup-simplify (2022-03-27) 25 commits\n> - CI: don't use \"set -x\" in \"ci/lib.sh\" output\n> - CI: set PYTHON_PATH setting for osx-{clang,gcc} into \"$jobname\" case\n> - CI: set CC in MAKEFLAGS directly, don't add it to the environment\n> - CI: add more variables to MAKEFLAGS, except under vs-build\n> - CI: narrow down variable definitions in --build and --test\n> - CI: only invoke ci/lib.sh as \"steps\" in main.yml\n> - CI: pre-select test slice in Windows & VS tests\n> - ci/run-test-slice.sh: replace shelling out with \"echo\"\n> - CI: move \"env\" definitions into ci/lib.sh\n> - CI: combine ci/install{,-docker}-dependencies.sh\n> - CI: split up and reduce \"ci/test-documentation.sh\"\n> - CI: invoke \"make artifacts-tar\" directly in windows-build\n> - CI: check ignored unignored build artifacts in \"win[+VS] build\" too\n> - CI: remove \"run-build-and-tests.sh\", run \"make [test]\" directly\n> - CI: export variables via a wrapper\n> - CI: consistently use \"export\" in ci/lib.sh\n> - CI: move p4 and git-lfs variables to ci/install-dependencies.sh\n> - CI: have \"static-analysis\" run \"check-builtins\", not \"documentation\"\n> - CI: have \"static-analysis\" run a \"make ci-static-analysis\" target\n> - CI: don't have \"git grep\" invoke a pager in tree content check\n> - CI: remove unused Azure ci/* code\n> - CI: remove dead \"tree skipping\" code\n> - CI: remove more dead Travis CI support\n> - CI: make \"$jobname\" explicit, remove fallback\n> - CI: run \"set -ex\" early in ci/lib.sh\n> (this branch is used by ab/ci-github-workflow-markup.)\n>\n> Drive more actions done in CI via the Makefile instead of shell\n> commands sprinkled in .github/workflows/main.yml\n>\n> Unless \"doing more in Makefile\" is fundamentally undesirable, I am\n> inclined to take this, together with ab/ci-github-workflow-markup\n> to replace js/ci-github-workflow-markup\n> cf. \n> source: \n\nWith the RC period hopefully the timing of the re-rolls I submitted is\nmore helpful than not (since you were considering things for \"next\").\n\nI think this should be ready, the main critique of this series on its\nmerits I think has been[1], I was a bit on the fence about adding\nsomething on top of it, but hopefully the re-roll at [2] helps address\nthat, i.e. by explicitly adding the support for running things \"CI-like\"\nlocally, which was the logical conclusion of this series (in addition to\nimproving the GitHub CI UX itself).\n\n> * js/ci-github-workflow-markup (2022-03-01) 9 commits\n> . ci: call `finalize_test_case_output` a little later\n> . ci: use `--github-workflow-markup` in the GitHub workflow\n> . ci: optionally mark up output in the GitHub workflow\n> . test(junit): avoid line feeds in XML attributes\n> . tests: refactor --write-junit-xml code\n> . ci/run-build-and-tests: add some structure to the GitHub workflow output\n> . ci: make it easier to find failed tests' logs in the GitHub workflow\n> . ci/run-build-and-tests: take a more high-level view\n> . ci: fix code style\n>\n> Update the GitHub workflow support to make it quicker to get to the\n> failing test.\n>\n> Waiting for discussion to settle.\n> cf. <220309.86tuc6lwpj.gmgdl@evledraar.gmail.com>\n> cf. <220302.86mti87cj2.gmgdl@evledraar.gmail.com>\n> cf. <30dbc8fb-a1db-05bc-3dcb-070e11cf4715@gmail.com>\n> source: \n\nFeature-wise v.s. ab/ci-github-workflow-markup one thing I noticed after\nsubmitting the initial re-roll is that my re-roll has the end of the\n\"prove\" output immediately preceding the expandable toggles in\njs/ci-github-workflow-markup, but in js/ci-github-workflow-markup the\n\"prove\" output is hidden its its own \"toggle\".\n\nIt's an artifact of how the two combined, the\njs/ci-github-workflow-markup way could be re-introduced, but I find the\ncombination quite helpful actually. I.e. we now see the general summary\nof what tests failed, and then the set test-by-test failures below.\n\nAs for the overall status some of the UX/slowness issues remain\nunaddressed, which are issues in the original\njs/ci-github-workflow-markup carried forward in this one.\n\nVictoria Dye had some suggestions for addressing the slowness in [3]\nthat I think should be followed-up on. It was also noted that part of\nthe output was duplicated in the series (didn't dig up that reference,\nsorry).\n\n1. https://lore.kernel.org/git/320b3dde-a84e-0074-bed8-57061293b2b0@github.com/\n2. https://lore.kernel.org/git/cover-v3-00.29-00000000000-20220413T194847Z-avarab@gmail.com/\n3. https://lore.kernel.org/git/6b83bb83-32b9-20c9-fa02-c1c3170351c3@github.com/\n\n"},{"id":"453613","messageId":"xmqq35ig5zlf.fsf@gitster.g","threadId":"57717","inReplyTo":"220413.86bkx4eobr.gmgdl@evledraar.gmail.com","subject":"Re: ab/plug-leak-in-revisions","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-04-13T23:32:28Z","receivedAt":"2022-04-13T23:32:40Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Ævar Arnfjörð Bjarmason writes:\n\n> I think it should be ready with my just-submitted re-roll, which fixes a\n> trivial nit spotted by Phillip Wood by removing a useless NULL check:\n> https://lore.kernel.org/git/cover-v6-00.27-00000000000-20220413T195935Z-avarab@gmail.com/\n\nLast time I checked, the last three patches haven't made to the lore\narchive yet. We have other things to do while waiting for them, so\nthere is no need to rush or resend ;-)\n\n"},{"id":"453616","messageId":"xmqqsfqg4k5o.fsf@gitster.g","threadId":"57717","inReplyTo":"8698e468-5552-77a3-10c7-933affd98832@gmail.com","subject":"Re: What's cooking in git.git (Apr 2022, #03; Tue, 12)","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-04-13T23:51:15Z","receivedAt":"2022-04-13T23:51:20Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Philippe Blain writes:\n\n> This is quite a big behaviour change for some environments [1], so\n> I would think maybe it deserves to be fully spelled out in the\n> release notes for 2.36.0, instead of just referring readers to the\n> release notes for the maintenance release, where they can read a\n> full description only in the release notes for 2.30.3 ?\n\nMakes sense. Here is my quick-and-dirty first draft, based on the\ndesign of the new escape hatch done by Derrick today.\n\ndiff --git c/Documentation/RelNotes/2.36.0.txt w/Documentation/RelNotes/2.36.0.txt\nindex 9f6dd3d868..f4c5e691bb 100644\n--- c/Documentation/RelNotes/2.36.0.txt\n+++ w/Documentation/RelNotes/2.36.0.txt\n@@ -13,6 +13,15 @@ Backward compatibility warts\n top-level a partial clone, while submodules are fully cloned. This\n behaviour is changed to pass the same filter down to the submodules.\n \n+ * With the fixes for CVE-2022-24765 that are common with versions of\n+ Git 2.30.4, 2.31.3, 2.32.2, 2.33.3, 2.34.3, and 2.35.3, Git has\n+ been taught not to recognise repositories owned by other users, in\n+ order to avoid getting affected by their config files and hooks.\n+ You can list the path to the safe/trusted repositories that may be\n+ owned by others on a multi-valued configuration variable\n+ `safe.directory` to override this behaviour, or use '*' to declare\n+ that you trust anything.\n+\n \n Note to those who build from the source\n \n@@ -397,8 +406,6 @@ Fixes since v2.35\n entry it moved.\n (merge b7f9130a06 vd/mv-refresh-stat later to maint).\n \n- * Fix for CVE-2022-24765 has been merged up from 2.35.2 and others.\n-\n * Other code cleanup, docfix, build fix, etc.\n (merge cfc5cf428b jc/find-header later to maint).\n (merge 40e7cfdd46 jh/p4-fix-use-of-process-error-exception later to maint).\n"},{"id":"453638","messageId":"220414.86y208cen7.gmgdl@evledraar.gmail.com","threadId":"57717","inReplyTo":"xmqq35ig5zlf.fsf@gitster.g","subject":"Re: ab/plug-leak-in-revisions","fromName":"Ævar Arnfjörð Bjarmason","fromEmail":"avarab@gmail.com","sentAt":"2022-04-14T07:22:31Z","receivedAt":"2022-04-14T07:23:15Z","isPatch":false,"sender":{"key":"avarab@gmail.com","avatar":"https://avatars.githubusercontent.com/u/45301?v=4"},"body":"\nOn Wed, Apr 13 2022, Junio C Hamano wrote:\n\n> Ævar Arnfjörð Bjarmason writes:\n>\n>> I think it should be ready with my just-submitted re-roll, which fixes a\n>> trivial nit spotted by Phillip Wood by removing a useless NULL check:\n>> https://lore.kernel.org/git/cover-v6-00.27-00000000000-20220413T195935Z-avarab@gmail.com/\n>\n> Last time I checked, the last three patches haven't made to the lore\n> archive yet. We have other things to do while waiting for them, so\n> there is no need to rush or resend ;-)\n\ngit-send-email died at the end of that send, I picked up where I left\noff and sent the remaining three.\n"},{"id":"453664","messageId":"xmqqv8vbzf9z.fsf@gitster.g","threadId":"57717","inReplyTo":"220414.86y208cen7.gmgdl@evledraar.gmail.com","subject":"Re: ab/plug-leak-in-revisions","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-04-14T18:33:12Z","receivedAt":"2022-04-14T18:33:19Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Ævar Arnfjörð Bjarmason writes:\n\n> On Wed, Apr 13 2022, Junio C Hamano wrote:\n>\n>> Ævar Arnfjörð Bjarmason writes:\n>>\n>>> I think it should be ready with my just-submitted re-roll, which fixes a\n>>> trivial nit spotted by Phillip Wood by removing a useless NULL check:\n>>> https://lore.kernel.org/git/cover-v6-00.27-00000000000-20220413T195935Z-avarab@gmail.com/\n>>\n>> Last time I checked, the last three patches haven't made to the lore\n>> archive yet. We have other things to do while waiting for them, so\n>> there is no need to rush or resend ;-)\n>\n> git-send-email died at the end of that send, I picked up where I left\n> off and sent the remaining three.\n\nThanks. All replaced and the change from the previous round was as\nexpected.\n\nLooking great.\n\n\n"}]}