{"thread":{"id":"58144","subject":"[ANNOUNCE] Git v2.37.1 and others","startedAt":"2022-07-12T17:09:45Z","lastAt":"2022-07-14T02:10:59Z","messageCount":4,"participants":["Junio C Hamano","rsbecker@nexbridge.com"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"458907","messageId":"xmqqv8s2fefi.fsf@gitster.g","threadId":"58144","inReplyTo":null,"subject":"[ANNOUNCE] Git v2.37.1 and others","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2022-07-12T17:06:57Z","receivedAt":"2022-07-12T17:09:45Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Git v2.37.1, together with v2.30.5, v2.31.4, v2.32.3, v2.33.4,\nv2.34.4, v2.35.4, and v2.36.2 for older maintenance tracks, are now\navailable at the usual places.\n\nThese are to address CVE-2022-29187, where the fixes in v2.36.1 and\nbelow to address CVE-2022-24765 released earlier may not have been\ncomplete.\n\nThe tarballs are found at:\n\n    https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the 'v2.37.1'\ntag and other tags for older maintenance tracks.\n\n  url = https://git.kernel.org/pub/scm/git/git\n  url = https://kernel.googlesource.com/pub/scm/git/git\n  url = git://repo.or.cz/alt-git.git\n  url = https://github.com/gitster/git\n\n----------------------------------------------------------------\n\nGit 2.37.1 Release Notes\n========================\n\nThis release merges up the fixes that appear in v2.30.5, v2.31.4,\nv2.32.3, v2.33.4, v2.34.4, v2.35.4, and v2.36.2 to address the\nsecurity issue CVE-2022-29187; see the release notes for these\nversions for details.\n\nFixes since Git 2.37\n--------------------\n\n * Rewrite of \"git add -i\" in C that appeared in Git 2.25 didn't\n   correctly record a removed file to the index, which is an old\n   regression but has become widely known because the C version has\n   become the default in the latest release.\n\n * Fix for CVE-2022-29187.\n\n----------------------------------------------------------------\n\nGit v2.30.5 Release Notes\n=========================\n\nThis release contains minor fix-ups for the changes that went into\nGit 2.30.3 and 2.30.4, addressing CVE-2022-29187.\n\n * The safety check that verifies a safe ownership of the Git\n   worktree is now extended to also cover the ownership of the Git\n   directory (and the `.git` file, if there is any).\n\nCarlo Marcelo Arenas Belón (1):\n      setup: tighten ownership checks post CVE-2022-24765\n"},{"id":"458950","messageId":"01af01d896b1$a48e32f0$edaa98d0$@nexbridge.com","threadId":"58144","inReplyTo":"xmqqv8s2fefi.fsf@gitster.g","subject":"[Test Failures] Git v2.37.1 (was RE: [ANNOUNCE] Git v2.37.1 and others)","fromName":"","fromEmail":"rsbecker@nexbridge.com","sentAt":"2022-07-13T12:11:06Z","receivedAt":"2022-07-13T12:11:19Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"On July 12, 2022 1:07 PM, Junio C Hamano wrote:\n>Git v2.37.1, together with v2.30.5, v2.31.4, v2.32.3, v2.33.4, v2.34.4, v2.35.4, and\n>v2.36.2 for older maintenance tracks, are now available at the usual places.\n>\n>These are to address CVE-2022-29187, where the fixes in v2.36.1 and below to\n>address CVE-2022-24765 released earlier may not have been complete.\n\nFollowing are net new test failures with 2.37.1 compared with 2.37.0 are as follows on NonStop ia64 and x86 platforms:\n\nt5516-fetch-push subtests 53, 113\n\nt5545-push-options subtest 9\n\nt5601-clone subtest 8\n\nt7502-commit-porcelain subtests 20-26, 29-33, 42-47\n\nt7528-signed-commit-ssh subtests 4, 5\n\nI am investigating, but as it stands, we cannot package this release for our platform at this time.\n\nSincerely,\nRandall\n\n"},{"id":"458983","messageId":"01b101d896c4$31761bd0$94625370$@nexbridge.com","threadId":"58144","inReplyTo":"01af01d896b1$a48e32f0$edaa98d0$@nexbridge.com","subject":"RE: [Test Failures] Git v2.37.1 (was RE: [ANNOUNCE] Git v2.37.1 and others)","fromName":"","fromEmail":"rsbecker@nexbridge.com","sentAt":"2022-07-13T14:23:47Z","receivedAt":"2022-07-13T14:24:20Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"On July 13, 2022 8:11 AM, I wrote:\n>On July 12, 2022 1:07 PM, Junio C Hamano wrote:\n>>Git v2.37.1, together with v2.30.5, v2.31.4, v2.32.3, v2.33.4, v2.34.4,\n>>v2.35.4, and\n>>v2.36.2 for older maintenance tracks, are now available at the usual places.\n>>\n>>These are to address CVE-2022-29187, where the fixes in v2.36.1 and\n>>below to address CVE-2022-24765 released earlier may not have been complete.\n>\n>Following are net new test failures with 2.37.1 compared with 2.37.0 are as follows\n>on NonStop ia64 and x86 platforms:\n>\n>t5516-fetch-push subtests 53, 113\n>\n>t5545-push-options subtest 9\n\nTest passes when not run in Jenkins CI/CD\n\n>t5601-clone subtest 8\n\nTest passes when not run in Jenkins CI/CD\n\n>t7502-commit-porcelain subtests 20-26, 29-33, 42-47\n\nTest passes when not run in Jenkins CI/CD\n\n>t7528-signed-commit-ssh subtests 4, 5\n\nTest passes when not run in Jenkins CI/CD \n\nSo it looks like a Jenkins/git test interaction is the issue here. I'm wondering whether running the test with </dev/null and 2>/dev/null might make a difference when running in Jenkins. The tty where Jenkins was started is in a permanently disconnected state.\n\nMostly ignore the subtest failures, but still, would like to know why these subtests in particular.\n\n--Randall\n\n"},{"id":"459031","messageId":"021701d89726$ed4d09b0$c7e71d10$@nexbridge.com","threadId":"58144","inReplyTo":"01b101d896c4$31761bd0$94625370$@nexbridge.com","subject":"RE: [Test Failures] Git v2.37.1 (was RE: [ANNOUNCE] Git v2.37.1 and others)","fromName":"","fromEmail":"rsbecker@nexbridge.com","sentAt":"2022-07-14T02:10:39Z","receivedAt":"2022-07-14T02:10:59Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"On July 13, 2022 10:24 AM, I wrote:\n>On July 13, 2022 8:11 AM, I wrote:\n>>On July 12, 2022 1:07 PM, Junio C Hamano wrote:\n>>>Git v2.37.1, together with v2.30.5, v2.31.4, v2.32.3, v2.33.4,\n>>>v2.34.4, v2.35.4, and\n>>>v2.36.2 for older maintenance tracks, are now available at the usual places.\n>>>\n>>>These are to address CVE-2022-29187, where the fixes in v2.36.1 and\n>>>below to address CVE-2022-24765 released earlier may not have been\n>complete.\n>>\n>>Following are net new test failures with 2.37.1 compared with 2.37.0\n>>are as follows on NonStop ia64 and x86 platforms:\n>>\n>>t5516-fetch-push subtests 53, 113\n>>\n>>t5545-push-options subtest 9\n>\n>Test passes when not run in Jenkins CI/CD\n>\n>>t5601-clone subtest 8\n>\n>Test passes when not run in Jenkins CI/CD\n>\n>>t7502-commit-porcelain subtests 20-26, 29-33, 42-47\n>\n>Test passes when not run in Jenkins CI/CD\n>\n>>t7528-signed-commit-ssh subtests 4, 5\n>\n>Test passes when not run in Jenkins CI/CD\n>\n>So it looks like a Jenkins/git test interaction is the issue here. I'm wondering\n>whether running the test with </dev/null and 2>/dev/null might make a\n>difference when running in Jenkins. The tty where Jenkins was started is in a\n>permanently disconnected state.\n>\n>Mostly ignore the subtest failures, but still, would like to know why these subtests\n>in particular.\n\nStrangely, setting stdin to /dev/null and stderr to /dev/null makes no difference in the test results. stdout is the Jenkins pipe, which is Java of course, but roughly a popen(x, \"r\"). I have no explanation at this point why specific tests fail - other than OpenSSH, which I know attempts to prompt if it thinks the tty is even remotely reasonable.\n\n"}]}