git/list[1] front-page[2] threads[3] people[4] search[5] about
 

[PATCH 00/12] Fix various overly aggressive protections in 2.45.1 and friends

From
Junio C Hamano <gitster@pobox.com>
Date
May 21, 2024, 19:56 UTC
Message-ID
<20240521195659.870714-1-gitster@pobox.com>

As people have seen, the latest "security fix" release turned out to be a mixed bag of good vulnerability fixes with a bit over-eager "layered defence" that broke real uses cases like git-lfs. Let's quickly get them in working order back first, with the vision that we will then rebuild layered defence more carefully in the open on top as necessary.

What we have here are the first "revert" part.

These patches are designed to apply to 2.39.4; the series may have to grow as we discover more things to revert, but for now here are the patches to

 - revert the over-eager "refusal to work" went into 2.39.4
 - adjust 2.39.4 codebase to cleanly build and test (at CI and
   locally) by backported fixes

It would have been better if we did not have to have the latter class, but such is life.

I'll figure out a way to convey conflict resolutions as this topic gets merged up to newer maintenance tracks on the list so that people can assist with ensuring correctness of the result by reviewing, and follow up. ("git show --remerge-diff" might turn out to be such a way, but I do not know yet).

Jeff King (5):
  send-email: drop FakeTerm hack
  send-email: avoid creating more than one Term::ReadLine object
  ci: drop mention of BREW_INSTALL_PACKAGES variable
  ci: avoid bare "gcc" for osx-gcc job
  ci: stop installing "gcc-13" for osx-gcc
Johannes Schindelin (6):
  hook: plug a new memory leak
  init: use the correct path of the templates directory again
  Revert "core.hooksPath: add some protection while cloning"
  tests: verify that `clone -c core.hooksPath=/dev/null` works again
  clone: drop the protections where hooks aren't run
  Revert "Add a helper function to compare file contents"
Junio C Hamano (1):
  Revert "fetch/clone: detect dubious ownership of local repositories"
 .github/workflows/main.yml    |  3 +-
 Makefile                      |  2 +-
 builtin/clone.c               | 12 +-------
 cache.h                       | 14 ---------
 ci/install-dependencies.sh    |  2 --
 config.c                      | 13 +-------
 copy.c                        | 58 -----------------------------------
 git-send-email.perl           | 32 +++++++------------
 hook.c                        | 32 -------------------
 path.c                        |  2 --
 t/helper/test-path-utils.c    | 10 ------
 t/t0060-path-utils.sh         | 41 -------------------------
 t/t0411-clone-from-partial.sh |  6 ++--
 t/t1350-config-hooks-path.sh  |  7 +++++
 t/t1800-hook.sh               | 15 ---------
 t/t5601-clone.sh              | 51 ------------------------------
 t/t9001-send-email.sh         |  5 +--
 17 files changed, 28 insertions(+), 277 deletions(-)
-- 
2.45.1-216-g4365c6fcf9
Next: Junio C Hamano
Message 1 of 36 in “Fix various overly aggressive protections in 2.45.1 and friends”
  1. 00/12 Fix various overly aggressive protections in 2.45.1 and friendsJunio C Hamano, May 21, 2024
  2. 02/12 send-email: avoid creating more than one Term::ReadLine objectJunio C Hamano, May 21, 2024
  3. Dragan SimicMay 22, 2024
  4. 03/12 ci: drop mention of BREW_INSTALL_PACKAGES variableJunio C Hamano, May 21, 2024
  5. 01/12 send-email: drop FakeTerm hackJunio C Hamano, May 21, 2024
  6. Dragan SimicMay 22, 2024
  7. 04/12 ci: avoid bare "gcc" for osx-gcc jobJunio C Hamano, May 21, 2024
  8. 05/12 ci: stop installing "gcc-13" for osx-gccJunio C Hamano, May 21, 2024
  9. 06/12 hook: plug a new memory leakJunio C Hamano, May 21, 2024
  10. 07/12 init: use the correct path of the templates directory againJunio C Hamano, May 21, 2024
  11. 08/12 Revert "core.hooksPath: add some protection while cloning"Junio C Hamano, May 21, 2024
  12. 09/12 tests: verify that `clone -c core.hooksPath=/dev/null` works againJunio C Hamano, May 21, 2024
  13. Brooke KuhlmannMay 21, 2024
  14. 10/12 clone: drop the protections where hooks aren't runJunio C Hamano, May 21, 2024
  15. 11/12 Revert "Add a helper function to compare file contents"Junio C Hamano, May 21, 2024
  16. 12/12 Revert "fetch/clone: detect dubious ownership of local repositories"Junio C Hamano, May 21, 2024
  17. Junio C HamanoMay 21, 2024
  18. Johannes SchindelinMay 22, 2024
  19. Junio C HamanoMay 22, 2024
  20. 13/12 Merge branch 'jc/fix-aggressive-protection-2.39'Junio C Hamano, May 21, 2024
  21. Reviewing merge commits, was Re: [rPATCH 13/12] Merge branch 'jc/fix-aggressive-protection-2.39'Johannes Schindelin, May 23, 2024
  22. Junio C HamanoMay 23, 2024
  23. 14/12 Merge branch 'jc/fix-aggressive-protection-2.40'Junio C Hamano, May 21, 2024
  24. Junio C HamanoMay 21, 2024
  25. Johannes SchindelinMay 21, 2024
  26. Junio C HamanoMay 21, 2024
  27. Junio C HamanoMay 21, 2024
  28. Joey HessMay 22, 2024
  29. Junio C HamanoMay 23, 2024
  30. Joey HessMay 23, 2024
  31. Johannes SchindelinMay 27, 2024
  32. Joey HessMay 28, 2024
  33. Phillip WoodMay 28, 2024
  34. Junio C HamanoMay 28, 2024
  35. Junio C HamanoMay 28, 2024
  36. Junio C HamanoMay 23, 2024

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.