Skip to contentSkip to conversation

package/git: bump version to 2.30.2

PATCH New Peter Seiderer 3 participants 4 messages Mar 18, 2021 – Mar 24, 2021

lore
Share & tools
lore

Peter Seiderer

author
#0 lore raw

PATCH 1/2 package/git: bump version to 2.30.2

Fix CVE-2021-21300:

On case-insensitive file systems with support for symbolic links, if Git is configured globally to apply delay-capable clean/smudge filters (such as Git LFS), Git could be fooled into running remote code during a clone.

For details see [1] and [2].

[1] http://lkml.iu.edu/hypermail/linux/kernel/2102.1/01858.html
[2] http://lkml.iu.edu/hypermail/linux/kernel/2103.1/02533.html

Signed-off-by Peter Seiderer <[email protected]>
---
 package/git/git.hash | 2 +-
 package/git/git.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
package/git/git.hash +1 -1
index 375ce787e9..c1960b9728 100644
@@ -1,5 +1,5 @@
 # From: https://www.kernel.org/pub/software/scm/git/sha256sums.asc
-sha256  55735021109565721af805af382c45cce73c3cfaa59daad22443d1477d334d19  git-2.30.0.tar.xz
+sha256  41f7d90c71f9476cd387673fcb10ce09ccbed67332436a4cc58d7af32c355faa  git-2.30.2.tar.xz
 # Locally calculated
 sha256  5b2198d1645f767585e8a88ac0499b04472164c0d2da22e75ecf97ef443ab32e  COPYING
 sha256  1922f45d2c49e390032c9c0ba6d7cac904087f7cec51af30c2b2ad022ce0e76a  LGPL-2.1
package/git/git.mk +1 -1
index 55178de138..910dcf5fa1 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-GIT_VERSION = 2.30.0
+GIT_VERSION = 2.30.2
 GIT_SOURCE = git-$(GIT_VERSION).tar.xz
 GIT_SITE = $(BR2_KERNEL_MIRROR)/software/scm/git
 GIT_LICENSE = GPL-2.0, LGPL-2.1+
Signature · 1 line
2.30.2
author
#1 lore raw

PATCH 2/2 package/git: bump version to 2.31.0

- drop libpcre1 support

For details see [1].

[1] https://lore.kernel.org/git/xmqqwnu8z03c.fsf at gitster.g/T/

Signed-off-by Peter Seiderer <[email protected]>
---
 package/git/git.hash | 2 +-
 package/git/git.mk   | 8 ++------
 2 files changed, 3 insertions(+), 7 deletions(-)
package/git/git.hash +1 -1
index c1960b9728..1c87f9829e 100644
@@ -1,5 +1,5 @@
 # From: https://www.kernel.org/pub/software/scm/git/sha256sums.asc
-sha256  41f7d90c71f9476cd387673fcb10ce09ccbed67332436a4cc58d7af32c355faa  git-2.30.2.tar.xz
+sha256  e8f162cbdb3283e13cd7388d864ed23485f1b046a19e969f12ed2685fb789a40  git-2.31.0.tar.xz
 # Locally calculated
 sha256  5b2198d1645f767585e8a88ac0499b04472164c0d2da22e75ecf97ef443ab32e  COPYING
 sha256  1922f45d2c49e390032c9c0ba6d7cac904087f7cec51af30c2b2ad022ce0e76a  LGPL-2.1
package/git/git.mk +2 -6
index 910dcf5fa1..c95878981a 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-GIT_VERSION = 2.30.2
+GIT_VERSION = 2.31.0
 GIT_SOURCE = git-$(GIT_VERSION).tar.xz
 GIT_SITE = $(BR2_KERNEL_MIRROR)/software/scm/git
 GIT_LICENSE = GPL-2.0, LGPL-2.1+

@@ -25,12 +25,8 @@ endif
 ifeq ($(BR2_PACKAGE_PCRE2),y)
 GIT_DEPENDENCIES += pcre2
 GIT_CONF_OPTS += --with-libpcre2
-else ifeq ($(BR2_PACKAGE_PCRE),y)
-GIT_DEPENDENCIES += pcre
-GIT_CONF_OPTS += --with-libpcre1
-GIT_MAKE_OPTS += NO_LIBPCRE1_JIT=1
 else
-GIT_CONF_OPTS += --without-libpcre
+GIT_CONF_OPTS += --without-libpcre2
 endif
 
 ifeq ($(BR2_PACKAGE_LIBCURL),y)
Signature · 1 line
2.30.2
#2 lore raw

PATCH 1/2 package/git: bump version to 2.30.2

In reply to Peter Seiderer
Quoted 9 lines · On Thu, 18 Mar 2021 21:16:54 +0100 Peter Seiderer <[email protected]> wrote:

Fix CVE-2021-21300:

On case-insensitive file systems with support for symbolic links, if Git is configured globally to apply delay-capable clean/smudge filters (such as Git LFS), Git could be fooled into running remote code during a clone.

For details see [1] and [2].

Quoted 8 lines

[1] http://lkml.iu.edu/hypermail/linux/kernel/2102.1/01858.html
[2] http://lkml.iu.edu/hypermail/linux/kernel/2103.1/02533.html

Signed-off-by Peter Seiderer <[email protected]>
---
 package/git/git.hash | 2 +-
 package/git/git.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Both applied to master, thanks!

Thomas

Signature · 3 lines
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
#3 lore raw

PATCH 1/2 package/git: bump version to 2.30.2

In reply to Peter Seiderer
Quoted 8 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Peter" == Peter Seiderer <[email protected]> writes:

Fix CVE-2021-21300:
On case-insensitive file systems with support for symbolic links, if Git is configured globally to apply delay-capable clean/smudge filters (such as Git LFS), Git could be fooled into running remote code during a clone.

Quoted 6 lines

For details see [1] and [2].

[1] http://lkml.iu.edu/hypermail/linux/kernel/2102.1/01858.html
[2] http://lkml.iu.edu/hypermail/linux/kernel/2103.1/02533.html

Signed-off-by Peter Seiderer <[email protected]>

Committed to 2021.02.x, thanks.

For 2020.02.x and 2020.11.x I will instead bump to the corresponding updates to the git series used there.

Signature · 1 line
Bye, Peter Korsgaard