{"thread":{"id":"62807","subject":"[ANNOUNCE] Git v2.48.1 and friends","startedAt":"2025-01-14T18:00:22Z","lastAt":"2025-01-15T05:27:23Z","messageCount":9,"participants":["Junio C Hamano","Johannes Schindelin","rsbecker@nexbridge.com"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"510529","messageId":"xmqq5xmh46oc.fsf@gitster.g","threadId":"62807","inReplyTo":null,"subject":"[ANNOUNCE] Git v2.48.1 and friends","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2025-01-14T18:00:19Z","receivedAt":"2025-01-14T18:00:22Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"A maintenance release Git v2.48.1, together with releases for older\nmaintenance tracks (v2.40.4, v2.41.3, v2.42.4, v2.43.6, v2.44.3,\nv2.45.3, v2.46.3, and v2.47.2) are now available at the usual\nplaces. These are to address a couple of security issues.\n\nThe tarballs are found at:\n\n https://www.kernel.org/pub/software/scm/git/\n\nThe following public repositories all have a copy of the 'v2.48.1'\ntag, as well as the tags for older maintenance tracks listed above.\n\n url = https://git.kernel.org/pub/scm/git/git\n url = https://kernel.googlesource.com/pub/scm/git/git\n url = git://repo.or.cz/alt-git.git\n url = https://github.com/gitster/git\n\n\nThese releases make Git refuse to accept URLs that contain control\nsequences to address CVE-2024-50349 and CVE-2024-52006.\n\n - CVE-2024-50349:\n\n Printing unsanitized URLs when asking for credentials made the\n user susceptible to crafted URLs (e.g. in recursive clones) that\n mislead the user into typing in passwords for trusted sites that\n would then be sent to untrusted sites instead.\n\n - CVE-2024-52006\n\n Git may pass on Carriage Returns via the credential protocol to\n credential helpers which use line-reading functions that\n interpret said Carriage Returns as line endings, even though Git\n did not intend that.\n\n\nHuge credit goes to Dscho who led and coordinated the fixes for this\nset of releases.\n"},{"id":"510536","messageId":"4a3c949a-416f-734d-f63b-cb1b7f9b362f@gmx.de","threadId":"62807","inReplyTo":"xmqq5xmh46oc.fsf@gitster.g","subject":"Re: [ANNOUNCE] Git v2.48.1 and friends","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2025-01-14T18:44:14Z","receivedAt":"2025-01-14T18:44:20Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Junio,\n\nmy apologies, I only realized _now_ that I had forgotten to update\n`GIT-VERSION-GEN` in v2.47.2, it still has `DEF_VER=v2.47.1` (but all\nother mentioned tagged versions have a correct `GIT-VERSION-GEN`). I am\nvery sorry about that.\n\nCiao,\nJohannes\n\nOn Tue, 14 Jan 2025, Junio C Hamano wrote:\n\n> A maintenance release Git v2.48.1, together with releases for older\n> maintenance tracks (v2.40.4, v2.41.3, v2.42.4, v2.43.6, v2.44.3,\n> v2.45.3, v2.46.3, and v2.47.2) are now available at the usual\n> places. These are to address a couple of security issues.\n>\n> The tarballs are found at:\n>\n> https://www.kernel.org/pub/software/scm/git/\n>\n> The following public repositories all have a copy of the 'v2.48.1'\n> tag, as well as the tags for older maintenance tracks listed above.\n>\n> url = https://git.kernel.org/pub/scm/git/git\n> url = https://kernel.googlesource.com/pub/scm/git/git\n> url = git://repo.or.cz/alt-git.git\n> url = https://github.com/gitster/git\n>\n>\n> These releases make Git refuse to accept URLs that contain control\n> sequences to address CVE-2024-50349 and CVE-2024-52006.\n>\n> - CVE-2024-50349:\n>\n> Printing unsanitized URLs when asking for credentials made the\n> user susceptible to crafted URLs (e.g. in recursive clones) that\n> mislead the user into typing in passwords for trusted sites that\n> would then be sent to untrusted sites instead.\n>\n> - CVE-2024-52006\n>\n> Git may pass on Carriage Returns via the credential protocol to\n> credential helpers which use line-reading functions that\n> interpret said Carriage Returns as line endings, even though Git\n> did not intend that.\n>\n>\n> Huge credit goes to Dscho who led and coordinated the fixes for this\n> set of releases.\n>\n>\n"},{"id":"510538","messageId":"041901db66b7$c0c759a0$42560ce0$@nexbridge.com","threadId":"62807","inReplyTo":"4a3c949a-416f-734d-f63b-cb1b7f9b362f@gmx.de","subject":"RE: [ANNOUNCE] Git v2.48.1 and friends","fromName":"","fromEmail":"rsbecker@nexbridge.com","sentAt":"2025-01-14T19:08:47Z","receivedAt":"2025-01-14T19:08:59Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"On January 14, 2025 1:44 PM, Johannes Schindelin wrote:\n>To: Junio C Hamano \n>Cc: git@vger.kernel.org; Linux Kernel ; git-\n>packagers@googlegroups.com\n>Subject: Re: [ANNOUNCE] Git v2.48.1 and friends\n>\n>Hi Junio,\n>\n>my apologies, I only realized _now_ that I had forgotten to update\n`GIT-VERSION-\n>GEN` in v2.47.2, it still has `DEF_VER=v2.47.1` (but all other mentioned\ntagged\n>versions have a correct `GIT-VERSION-GEN`). I am very sorry about that.\n\nOh gosh. Glad I did not hit the \"build\" button. I will hold off packaging\nthat\nversion until this is resolved. It is definitely needed by the NonStop\ncommunity.\n\n--Randall\n\n"},{"id":"510542","messageId":"41d5de4e-c4b5-9564-6210-d9b8efddacb7@gmx.de","threadId":"62807","inReplyTo":"041901db66b7$c0c759a0$42560ce0$@nexbridge.com","subject":"RE: [ANNOUNCE] Git v2.48.1 and friends","fromName":"Johannes Schindelin","fromEmail":"johannes.schindelin@gmx.de","sentAt":"2025-01-14T21:05:23Z","receivedAt":"2025-01-14T21:05:37Z","isPatch":false,"sender":{"key":"johannes.schindelin@gmx.de","avatar":"https://avatars.githubusercontent.com/u/127790?v=4"},"body":"Hi Randall,\n\nOn Tue, 14 Jan 2025, rsbecker@nexbridge.com wrote:\n\n> On January 14, 2025 1:44 PM, Johannes Schindelin wrote:\n>\n> > my apologies, I only realized _now_ that I had forgotten to update\n> > `GIT-VERSION-GEN` in v2.47.2, it still has `DEF_VER=v2.47.1` (but all\n> > other mentioned tagged versions have a correct `GIT-VERSION-GEN`). I\n> > am very sorry about that.\n\n[I fixed the formatting, not sure how it got screwed up, it had verbatim\nmbox headers and inconsistent `>` prefixes in the quoted lines.]\n\n> Oh gosh. Glad I did not hit the \"build\" button.\n\nWell, depending what that \"build\" button does when you hit it, it might\nnot even affect you, have you tried it or at least looked at what\n`GIT-VERSION-GEN` does? `DEF_VER` only sets the default version when\nbuilding e.g. from a tarball.\n\nWhen building from a Git checkout, though, it uses the tag and everything\nis fine, the output of `git version` will say that this is 2.47.2:\nhttps://github.com/git/git/blob/v2.47.2/GIT-VERSION-GEN#L15\n\nAlso, you can always hard-code the version by writing it to a file\ncalled... wait for it... `version`, before calling `make`.\n\n> I will hold off packaging that version until this is resolved. It is\n> definitely needed by the NonStop community.\n\nI'm not sure what you're implying by \"until this is resolved\". I hope that\nyou don't intend to suggest to re-tag and force-push v2.47.2 because\nthat's kind of a serious no-go, those tags have been relayed to quite a\nfew people well in advance of today during the carefully-orchestrated\ncoordination of the embargoed release process. You cannot pull that\nv2.47.2 tag.\n\nIn any case, if you don't want to build v2.48.1 instead, and if you cannot\nbuild v2.47.2 from a Git checkout, at least that `version` file method\nshould work for you and you don't need to put pressure on anybody else to\nget the version that is so definitely needed out to the NonStop community.\n\nCiao,\nJohannes\n"},{"id":"510544","messageId":"xmqq5xmh2j9b.fsf@gitster.g","threadId":"62807","inReplyTo":"4a3c949a-416f-734d-f63b-cb1b7f9b362f@gmx.de","subject":"Re: [ANNOUNCE] Git v2.48.1 and friends","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2025-01-14T21:11:28Z","receivedAt":"2025-01-14T21:11:31Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":"Johannes Schindelin writes:\n\n> my apologies, I only realized _now_ that I had forgotten to update\n> `GIT-VERSION-GEN` in v2.47.2, it still has `DEF_VER=v2.47.1` (but all\n> other mentioned tagged versions have a correct `GIT-VERSION-GEN`). I am\n> very sorry about that.\n\nHeh, mistakes happen. You do not owe _me_ an apology.\n\nI hope I did 2.48.1 right, so we should be OK ;-)\n"},{"id":"510550","messageId":"045701db66da$36a358a0$a3ea09e0$@nexbridge.com","threadId":"62807","inReplyTo":"41d5de4e-c4b5-9564-6210-d9b8efddacb7@gmx.de","subject":"RE: [ANNOUNCE] Git v2.48.1 and friends","fromName":"","fromEmail":"rsbecker@nexbridge.com","sentAt":"2025-01-14T23:15:28Z","receivedAt":"2025-01-14T23:15:47Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"On January 14, 2025 4:05 PM, Johannes Schindelin wrote:\n>On Tue, 14 Jan 2025, rsbecker@nexbridge.com wrote:\n>\n>> On January 14, 2025 1:44 PM, Johannes Schindelin wrote:\n>>\n>> > my apologies, I only realized _now_ that I had forgotten to update\n>> > `GIT-VERSION-GEN` in v2.47.2, it still has `DEF_VER=v2.47.1` (but\n>> > all other mentioned tagged versions have a correct\n>> > `GIT-VERSION-GEN`). I am very sorry about that.\n>\n>[I fixed the formatting, not sure how it got screwed up, it had verbatim\nmbox\n>headers and inconsistent `>` prefixes in the quoted lines.]\n>\n>> Oh gosh. Glad I did not hit the \"build\" button.\n>\n>Well, depending what that \"build\" button does when you hit it, it might not\neven\n>affect you, have you tried it or at least looked at what `GIT-VERSION-GEN`\ndoes?\n>`DEF_VER` only sets the default version when building e.g. from a tarball.\n>\n>When building from a Git checkout, though, it uses the tag and everything\nis fine,\n>the output of `git version` will say that this is 2.47.2:\n>https://github.com/git/git/blob/v2.47.2/GIT-VERSION-GEN#L15\n>\n>Also, you can always hard-code the version by writing it to a file\ncalled... wait for it...\n>`version`, before calling `make`.\n>\n>> I will hold off packaging that version until this is resolved. It is\n>> definitely needed by the NonStop community.\n>\n>I'm not sure what you're implying by \"until this is resolved\". I hope that\nyou don't\n>intend to suggest to re-tag and force-push v2.47.2 because that's kind of a\nserious\n>no-go, those tags have been relayed to quite a few people well in advance\nof today\n>during the carefully-orchestrated coordination of the embargoed release\nprocess.\n>You cannot pull that\n>v2.47.2 tag.\n>\n>In any case, if you don't want to build v2.48.1 instead, and if you cannot\nbuild\n>v2.47.2 from a Git checkout, at least that `version` file method should\nwork for you\n>and you don't need to put pressure on anybody else to get the version that\nis so\n>definitely needed out to the NonStop community.\n\nI will not be able to package this. The reason is that only official commits\nare\npermitted in the highly regulated customer base that I have to support. If I\nmodify any file in the git build to \"get it out the door\", my community will\nnot install the package, even if I make a fork of git and do it there. My\npersonal commit is not considered \"sanctioned\", so the package will be\nignored.\n\nIf 2.47.2 has a mistake, I will simply skip the release, and tell people to\nmove\nto 2.48.1 to get the security fix instead of 2.47.2, which is not going to\nmake\nthem particularly happy. Sadly, this is my reality.\n\n--Randall\n\n"},{"id":"510551","messageId":"xmqqo70827df.fsf@gitster.g","threadId":"62807","inReplyTo":"045701db66da$36a358a0$a3ea09e0$@nexbridge.com","subject":"Re: [ANNOUNCE] Git v2.48.1 and friends","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2025-01-15T01:28:12Z","receivedAt":"2025-01-15T01:28:15Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":" writes:\n\n> I will not be able to package this. The reason is that only official commits\n> are\n> permitted in the highly regulated customer base that I have to support.\n\nWell, you probably want to be a bit more careful.\n\nThink what *exactly* is *this* in \"package this\" in your message,\nfor example.\n\nWill it be the resulting checkout of \"git clone --single\" of that\ntag? Then you can go there and say \"make\", and as Dscho explained,\nwhat Dscho wrote in DEF_VER does not matter. The tag that points at\nthat checked out commit is v2.47.2 and that is what resulting \"git\nversion\" would say.\n\nWill it be the tarball extract from the git-2.47.2.tar.gz that is\navailable at https://www.kernel.org/pub/software/scm/git/? Then you\ncan go there and say \"make\", and what Dscho wrote in DEF_VER does\nnot matter, either, because the official tarball contains the\n'version' file that says \"2.47.2\" and that is the version used by\nthe resulting \"git version\".\n\n"},{"id":"510552","messageId":"047401db66f1$f4ba6790$de2f36b0$@nexbridge.com","threadId":"62807","inReplyTo":"xmqqo70827df.fsf@gitster.g","subject":"RE: [ANNOUNCE] Git v2.48.1 and friends","fromName":"","fromEmail":"rsbecker@nexbridge.com","sentAt":"2025-01-15T02:05:25Z","receivedAt":"2025-01-15T02:05:39Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"On January 14, 2025 8:28 PM, Junio C Hamano wrote:\n> writes:\n>\n>> I will not be able to package this. The reason is that only official\n>> commits are permitted in the highly regulated customer base that I\n>> have to support.\n>\n>Well, you probably want to be a bit more careful.\n>\n>Think what *exactly* is *this* in \"package this\" in your message, for\nexample.\n>\n>Will it be the resulting checkout of \"git clone --single\" of that tag?\nThen you can go\n>there and say \"make\", and as Dscho explained, what Dscho wrote in DEF_VER\ndoes\n>not matter. The tag that points at that checked out commit is v2.47.2 and\nthat is\n>what resulting \"git version\" would say.\n>\n>Will it be the tarball extract from the git-2.47.2.tar.gz that is available\nat\n>https://www.kernel.org/pub/software/scm/git/? Then you can go there and\nsay\n>\"make\", and what Dscho wrote in DEF_VER does not matter, either, because\nthe\n>official tarball contains the 'version' file that says \"2.47.2\" and that is\nthe version\n>used by the resulting \"git version\".\n\nIn order to accept our builds, the NonStop community needs to be able to\ncorrelate what we build to a real commit from the git git repository. We\ncannot\nbuild from tarballs, as this cannot be certified by the community users. If\nthey\ncannot certify what I am building for them, they will not use it. It is that\nsimple,\nsadly. That is why we worked so hard to have our builds 100% consistent with\nthe official git commits. Tarballs can be hacked. Now, if members of the\ncommunity wanted to do that, I would be elated at the prospect, and it would\nsave me hundreds of hours a year, but they are not willing (or able) to do\nthat. My key role is as a trusted build manager for the platform. I cannot\npackage a modified set of files, so I must skip this element of the friends\nof\n2.48.1, and ask them to go directly to that version instead of 2.47.2.\n\nI ask you sincerely to please understand the constraints I am under.\n\n"},{"id":"510554","messageId":"xmqqikqg1wav.fsf@gitster.g","threadId":"62807","inReplyTo":"047401db66f1$f4ba6790$de2f36b0$@nexbridge.com","subject":"Re: [ANNOUNCE] Git v2.48.1 and friends","fromName":"Junio C Hamano","fromEmail":"gitster@pobox.com","sentAt":"2025-01-15T05:27:20Z","receivedAt":"2025-01-15T05:27:23Z","isPatch":false,"sender":{"key":"gitster@pobox.com","avatar":"https://avatars.githubusercontent.com/u/54884?v=4"},"body":" writes:\n\n> On January 14, 2025 8:28 PM, Junio C Hamano wrote:\n> ...\n>>Will it be the resulting checkout of \"git clone --single\" of that tag?\n> Then you can go\n>>there and say \"make\", and as Dscho explained, what Dscho wrote in DEF_VER\n> does\n>>not matter. The tag that points at that checked out commit is v2.47.2 and\n> that is\n>>what resulting \"git version\" would say.\n>> ...\n> In order to accept our builds, the NonStop community needs to be able to\n> correlate what we build to a real commit from the git git repository. We\n> cannot\n> build from tarballs, as this cannot be certified by the community users.\n\nSo you are going to build by having a clone of my repository that is\nupdated via \"git fetch\" to have these latest tags, and you will\ncheck out the v2.47.2 tag or the \"maint-2.47\" branch whose tip\nhappens to be at that tag. And say \"make\" in there. We may have a\nwrong string in DEF_VAR in its GIT-VERSION-GEN file, but as you read\nalready in the above, it does not matter. Saying \"make\" would run\nGIT-VERSION-GEN script, which notices that you are in a Git\nrepository and not in a tarball extract, and runs \"git describe\" on\nthe commit you are building from, instead of blindly relying on the\nvalue in DEF_VAR.\n\nWhich means your build will result in a version of git that says\n\"2.47.2\" when \"git version\" is run.\n\nSo is there still a problem? I am puzzled.\n"}]}