./devel/git-base, GIT Tree History Storage Tool (base package)

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]

Branch: pkgsrc-2018Q3, Version: 2.19.1, Package name: git-base-2.19.1, Maintainer: pkgsrc-users

Git is a free and open source distributed version control system
designed to handle everything from small to very large projects with
speed and efficiency.

Git is easy to learn and has a tiny footprint with lightning fast
performance. It outclasses SCM tools like Subversion, CVS, Perforce,
and ClearCase with features like cheap local branching, convenient
staging areas, and multiple workflows.

This package contains only the git program (and subcommands). It does
not contain man pages or the tk-based repository browser.


Required to run:
[lang/perl5] [mail/p5-MailTools] [mail/p5-Net-SMTP-SSL] [mail/p5-Email-Valid] [www/curl] [devel/pcre2]

Required to build:
[pkgtools/cwrappers]

Master sites:

SHA1: b61b1bdaf0e695a9c76e9a7994bff0c6026ca540
RMD160: f03b87ab8ad24e9c7ceb346f25da1ea6621f59e4
Filesize: 5105.379 KB

Version history: (Expand)

CVS history: (Expand)


   2018-10-06 14:03:41 by S.P.Zeidler | Files touched by this commit (2) | Package updated
Log message:
Pullup ticket #5840 - requested by maya
devel/git-base: security update
devel/git: security update

Revisions pulled up:
- devel/git-base/distinfo                                       1.84
- devel/git/Makefile.version                                    1.74

-------------------------------------------------------------------
   Module Name:	pkgsrc
   Committed By:	maya
   Date:		Fri Oct  5 17:48:20 UTC 2018

   Modified Files:
   	pkgsrc/devel/git: Makefile.version
   	pkgsrc/devel/git-base: distinfo

   Log message:
   Git: update to 2.19.1

   These releases fix a security flaw (CVE-2018-17456), which allowed an
   attacker to execute arbitrary code by crafting a malicious .gitmodules
   file in a project cloned with --recurse-submodules.

   When running "git clone --recurse-submodules", Git parses the supplied
   .gitmodules file for a URL field and blindly passes it as an argument
   to a "git clone" subprocess.  If the URL field is set to a string that
   begins with a dash, this "git clone" subprocess interprets the URL as
   an option.  This can lead to executing an arbitrary script shipped in
   the superproject as the user who ran "git clone".

   In addition to fixing the security issue for the user running "clone",
   the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can
   be used to detect such malicious repository content when fetching or
   accepting a push. See "transfer.fsckObjects" in git-config(1).

   Credit for finding and fixing this vulnerability goes to joernchen
   and Jeff King, respectively.

   To generate a diff of this commit:
   cvs rdiff -u -r1.73 -r1.74 pkgsrc/devel/git/Makefile.version
   cvs rdiff -u -r1.83 -r1.84 pkgsrc/devel/git-base/distinfo