summaryrefslogtreecommitdiffstats
path: root/Documentation (follow)
AgeCommit message (Collapse)AuthorFilesLines
2024-05-30Git 2.44.2v2.44.2Junio C Hamano6-0/+156
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-05-30Git 2.43.5v2.43.5Junio C Hamano5-0/+130
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-05-30Git 2.42.3v2.42.3Junio C Hamano4-0/+104
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-05-30Git 2.41.2v2.41.2Junio C Hamano3-0/+78
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-05-30Git 2.40.3v2.40.3Junio C Hamano2-0/+52
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-05-30Git 2.39.5v2.39.5Junio C Hamano1-0/+26
2024-05-24Merge branch 'fixes/2.45.1/2.43' into fixes/2.45.1/2.44Junio C Hamano1-12/+0
* fixes/2.45.1/2.43: Revert "fsck: warn about symlink pointing inside a gitdir" Revert "Add a helper function to compare file contents" clone: drop the protections where hooks aren't run tests: verify that `clone -c core.hooksPath=/dev/null` works again Revert "core.hooksPath: add some protection while cloning" init: use the correct path of the templates directory again hook: plug a new memory leak ci: stop installing "gcc-13" for osx-gcc ci: avoid bare "gcc" for osx-gcc job ci: drop mention of BREW_INSTALL_PACKAGES variable send-email: avoid creating more than one Term::ReadLine object send-email: drop FakeTerm hack
2024-05-24Merge branch 'fixes/2.45.1/2.42' into fixes/2.45.1/2.43Junio C Hamano1-12/+0
* fixes/2.45.1/2.42: Revert "fsck: warn about symlink pointing inside a gitdir" Revert "Add a helper function to compare file contents" clone: drop the protections where hooks aren't run tests: verify that `clone -c core.hooksPath=/dev/null` works again Revert "core.hooksPath: add some protection while cloning" init: use the correct path of the templates directory again hook: plug a new memory leak ci: stop installing "gcc-13" for osx-gcc ci: avoid bare "gcc" for osx-gcc job ci: drop mention of BREW_INSTALL_PACKAGES variable send-email: avoid creating more than one Term::ReadLine object send-email: drop FakeTerm hack
2024-05-24Merge branch 'fixes/2.45.1/2.41' into fixes/2.45.1/2.42Junio C Hamano1-12/+0
* fixes/2.45.1/2.41: Revert "fsck: warn about symlink pointing inside a gitdir" Revert "Add a helper function to compare file contents" clone: drop the protections where hooks aren't run tests: verify that `clone -c core.hooksPath=/dev/null` works again Revert "core.hooksPath: add some protection while cloning" init: use the correct path of the templates directory again hook: plug a new memory leak ci: stop installing "gcc-13" for osx-gcc ci: avoid bare "gcc" for osx-gcc job ci: drop mention of BREW_INSTALL_PACKAGES variable send-email: avoid creating more than one Term::ReadLine object send-email: drop FakeTerm hack
2024-05-24Merge branch 'fixes/2.45.1/2.40' into fixes/2.45.1/2.41Junio C Hamano1-12/+0
* fixes/2.45.1/2.40: Revert "fsck: warn about symlink pointing inside a gitdir" Revert "Add a helper function to compare file contents" clone: drop the protections where hooks aren't run tests: verify that `clone -c core.hooksPath=/dev/null` works again Revert "core.hooksPath: add some protection while cloning" init: use the correct path of the templates directory again hook: plug a new memory leak ci: stop installing "gcc-13" for osx-gcc ci: avoid bare "gcc" for osx-gcc job ci: drop mention of BREW_INSTALL_PACKAGES variable send-email: avoid creating more than one Term::ReadLine object send-email: drop FakeTerm hack
2024-05-24Merge branch 'jc/fix-2.45.1-and-friends-for-2.39' into fixes/2.45.1/2.40Junio C Hamano1-12/+0
Revert overly aggressive "layered defence" that went into 2.45.1 and friends, which broke "git-lfs", "git-annex", and other use cases, so that we can rebuild necessary counterparts in the open. * jc/fix-2.45.1-and-friends-for-2.39: Revert "fsck: warn about symlink pointing inside a gitdir" Revert "Add a helper function to compare file contents" clone: drop the protections where hooks aren't run tests: verify that `clone -c core.hooksPath=/dev/null` works again Revert "core.hooksPath: add some protection while cloning" init: use the correct path of the templates directory again hook: plug a new memory leak ci: stop installing "gcc-13" for osx-gcc ci: avoid bare "gcc" for osx-gcc job ci: drop mention of BREW_INSTALL_PACKAGES variable send-email: avoid creating more than one Term::ReadLine object send-email: drop FakeTerm hack
2024-05-22Revert "fsck: warn about symlink pointing inside a gitdir"Junio C Hamano1-12/+0
This reverts commit a33fea08 (fsck: warn about symlink pointing inside a gitdir, 2024-04-10), which warns against symbolic links commonly created by git-annex.
2024-04-19Git 2.44.1v2.44.1Johannes Schindelin1-0/+8
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2024-04-19Sync with 2.43.4Johannes Schindelin8-0/+181
* maint-2.43: (40 commits) Git 2.43.4 Git 2.42.2 Git 2.41.1 Git 2.40.2 Git 2.39.4 fsck: warn about symlink pointing inside a gitdir core.hooksPath: add some protection while cloning init.templateDir: consider this config setting protected clone: prevent hooks from running during a clone Add a helper function to compare file contents init: refactor the template directory discovery into its own function find_hook(): refactor the `STRIP_EXTENSION` logic clone: when symbolic links collide with directories, keep the latter entry: report more colliding paths t5510: verify that D/F confusion cannot lead to an RCE submodule: require the submodule path to contain directories only clone_submodule: avoid using `access()` on directories submodules: submodule paths must not contain symlinks clone: prevent clashing git dirs when cloning submodule in parallel t7423: add tests for symlinked submodule directories ...
2024-04-19Git 2.43.4v2.43.4Johannes Schindelin1-0/+7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2024-04-19Sync with 2.42.2Johannes Schindelin7-0/+174
* maint-2.42: (39 commits) Git 2.42.2 Git 2.41.1 Git 2.40.2 Git 2.39.4 fsck: warn about symlink pointing inside a gitdir core.hooksPath: add some protection while cloning init.templateDir: consider this config setting protected clone: prevent hooks from running during a clone Add a helper function to compare file contents init: refactor the template directory discovery into its own function find_hook(): refactor the `STRIP_EXTENSION` logic clone: when symbolic links collide with directories, keep the latter entry: report more colliding paths t5510: verify that D/F confusion cannot lead to an RCE submodule: require the submodule path to contain directories only clone_submodule: avoid using `access()` on directories submodules: submodule paths must not contain symlinks clone: prevent clashing git dirs when cloning submodule in parallel t7423: add tests for symlinked submodule directories has_dir_name(): do not get confused by characters < '/' ...
2024-04-19Git 2.42.2v2.42.2Johannes Schindelin1-0/+7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2024-04-19Sync with 2.41.1Johannes Schindelin6-0/+167
* maint-2.41: (38 commits) Git 2.41.1 Git 2.40.2 Git 2.39.4 fsck: warn about symlink pointing inside a gitdir core.hooksPath: add some protection while cloning init.templateDir: consider this config setting protected clone: prevent hooks from running during a clone Add a helper function to compare file contents init: refactor the template directory discovery into its own function find_hook(): refactor the `STRIP_EXTENSION` logic clone: when symbolic links collide with directories, keep the latter entry: report more colliding paths t5510: verify that D/F confusion cannot lead to an RCE submodule: require the submodule path to contain directories only clone_submodule: avoid using `access()` on directories submodules: submodule paths must not contain symlinks clone: prevent clashing git dirs when cloning submodule in parallel t7423: add tests for symlinked submodule directories has_dir_name(): do not get confused by characters < '/' docs: document security issues around untrusted .git dirs ...
2024-04-19Git 2.41.1v2.41.1Johannes Schindelin1-0/+7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2024-04-19Sync with 2.40.2Johannes Schindelin5-0/+160
* maint-2.40: (39 commits) Git 2.40.2 Git 2.39.4 fsck: warn about symlink pointing inside a gitdir core.hooksPath: add some protection while cloning init.templateDir: consider this config setting protected clone: prevent hooks from running during a clone Add a helper function to compare file contents init: refactor the template directory discovery into its own function find_hook(): refactor the `STRIP_EXTENSION` logic clone: when symbolic links collide with directories, keep the latter entry: report more colliding paths t5510: verify that D/F confusion cannot lead to an RCE submodule: require the submodule path to contain directories only clone_submodule: avoid using `access()` on directories submodules: submodule paths must not contain symlinks clone: prevent clashing git dirs when cloning submodule in parallel t7423: add tests for symlinked submodule directories has_dir_name(): do not get confused by characters < '/' docs: document security issues around untrusted .git dirs upload-pack: disable lazy-fetching by default ...
2024-04-19Git 2.40.2v2.40.2Johannes Schindelin1-0/+7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2024-04-19Sync with 2.39.4Johannes Schindelin4-0/+153
* maint-2.39: (38 commits) Git 2.39.4 fsck: warn about symlink pointing inside a gitdir core.hooksPath: add some protection while cloning init.templateDir: consider this config setting protected clone: prevent hooks from running during a clone Add a helper function to compare file contents init: refactor the template directory discovery into its own function find_hook(): refactor the `STRIP_EXTENSION` logic clone: when symbolic links collide with directories, keep the latter entry: report more colliding paths t5510: verify that D/F confusion cannot lead to an RCE submodule: require the submodule path to contain directories only clone_submodule: avoid using `access()` on directories submodules: submodule paths must not contain symlinks clone: prevent clashing git dirs when cloning submodule in parallel t7423: add tests for symlinked submodule directories has_dir_name(): do not get confused by characters < '/' docs: document security issues around untrusted .git dirs upload-pack: disable lazy-fetching by default fetch/clone: detect dubious ownership of local repositories ...
2024-04-19Git 2.39.4v2.39.4Johannes Schindelin1-0/+79
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2024-04-19fsck: warn about symlink pointing inside a gitdirJohannes Schindelin1-0/+12
In the wake of fixing a vulnerability where `git clone` mistakenly followed a symbolic link that it had just written while checking out files, writing into a gitdir, let's add some defense-in-depth by teaching `git fsck` to report symbolic links stored in its trees that point inside `.git/`. Even though the Git project never made any promises about the exact shape of the `.git/` directory's contents, there are likely repositories out there containing symbolic links that point inside the gitdir. For that reason, let's only report these as warnings, not as errors. Security-conscious users are encouraged to configure `fsck.symlinkPointsToGitDir = error`. Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2024-04-17docs: document security issues around untrusted .git dirsJeff King2-0/+46
For a long time our general philosophy has been that it's unsafe to run arbitrary Git commands if you don't trust the hooks or config in .git, but that running upload-pack should be OK. E.g., see 1456b043fc (Remove post-upload-hook, 2009-12-10), or the design of uploadpack.packObjectsHook. But we never really documented this (and even the discussions that led to 1456b043fc were not on the public list!). Let's try to make our approach more clear, but also be realistic that even upload-pack carries some risk. Helped-by: Filip Hejsek <filip.hejsek@gmail.com> Helped-by: Junio C Hamano <gitster@pobox.com> Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2024-04-17upload-pack: disable lazy-fetching by defaultJeff King1-0/+16
The upload-pack command tries to avoid trusting the repository in which it's run (e.g., by not running any hooks and not using any config that contains arbitrary commands). But if the server side of a fetch or a clone is a partial clone, then either upload-pack or its child pack-objects may run a lazy "git fetch" under the hood. And it is very easy to convince fetch to run arbitrary commands. The "server" side can be a local repository owned by someone else, who would be able to configure commands that are run during a clone with the current user's permissions. This issue has been designated CVE-2024-32004. The fix in this commit's parent helps in this scenario, as well as in related scenarios using SSH to clone, where the untrusted .git directory is owned by a different user id. But if you received one as a zip file, on a USB stick, etc, it may be owned by your user but still untrusted. This has been designated CVE-2024-32465. To mitigate the issue more completely, let's disable lazy fetching entirely during `upload-pack`. While fetching from a partial repository should be relatively rare, it is certainly not an unreasonable workflow. And thus we need to provide an escape hatch. This commit works by respecting a GIT_NO_LAZY_FETCH environment variable (to skip the lazy-fetch), and setting it in upload-pack, but only when the user has not already done so (which gives us the escape hatch). The name of the variable is specifically chosen to match what has already been added in 'master' via e6d5479e7a (git: extend --no-lazy-fetch to work across subprocesses, 2024-02-27). Since we're building this fix as a backport for older versions, we could cherry-pick that patch and its earlier steps. However, we don't really need the niceties (like a "--no-lazy-fetch" option) that it offers. By using the same name, everything should just work when the two are eventually merged, but here are a few notes: - the blocking of the fetch in e6d5479e7a is incomplete! It sets fetch_if_missing to 0 when we setup the repository variable, but that isn't enough. pack-objects in particular will call prefetch_to_pack() even if that variable is 0. This patch by contrast checks the environment variable at the lowest level before we call the lazy fetch, where we can be sure to catch all code paths. Possibly the setting of fetch_if_missing from e6d5479e7a can be reverted, but it may be useful to have. For example, some code may want to use that flag to change behavior before it gets to the point of trying to start the fetch. At any rate, that's all outside the scope of this patch. - there's documentation for GIT_NO_LAZY_FETCH in e6d5479e7a. We can live without that here, because for the most part the user shouldn't need to set it themselves. The exception is if they do want to override upload-pack's default, and that requires a separate documentation section (which is added here) - it would be nice to use the NO_LAZY_FETCH_ENVIRONMENT macro added by e6d5479e7a, but those definitions have moved from cache.h to environment.h between 2.39.3 and master. I just used the raw string literals, and we can replace them with the macro once this topic is merged to master. At least with respect to CVE-2024-32004, this does render this commit's parent commit somewhat redundant. However, it is worth retaining that commit as defense in depth, and because it may help other issues (e.g., symlink/hardlink TOCTOU races, where zip files are not really an interesting attack vector). The tests in t0411 still pass, but now we have _two_ mechanisms ensuring that the evil command is not run. Let's beef up the existing ones to check that they failed for the expected reason, that we refused to run upload-pack at all with an alternate user id. And add two new ones for the same-user case that both the restriction and its escape hatch. Signed-off-by: Jeff King <peff@peff.net> Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2024-02-22Git 2.44v2.44.0Junio C Hamano1-0/+12
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-02-22Git 2.43.3v2.43.3Junio C Hamano1-0/+12
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-02-19Git 2.44-rc2v2.44.0-rc2Junio C Hamano1-0/+1
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-02-17RelNotes: minor typo fixes in 2.44.0 draftTodd Zullinger1-2/+2
Signed-off-by: Todd Zullinger <tmz@pobox.com> Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-02-14Hopefully the last batch of fixes before 2.44 finalJunio C Hamano1-0/+19
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-02-13Git 2.44-rc1v2.44.0-rc1Junio C Hamano2-19/+37
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-02-13Git 2.43.2v2.43.2Junio C Hamano1-0/+37
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-02-13Merge branch 'jc/bisect-doc' into maint-2.43Junio C Hamano1-4/+6
Doc update. * jc/bisect-doc: bisect: document command line arguments for "bisect start" bisect: document "terms" subcommand more fully
2024-02-13Merge branch 'jc/majordomo-to-subspace' into maint-2.43Junio C Hamano1-2/+3
Doc update. * jc/majordomo-to-subspace: Docs: majordomo@vger.kernel.org has been decomissioned
2024-02-13Merge branch 'nb/rebase-x-shell-docfix' into maint-2.43Junio C Hamano1-4/+3
Doc update. * nb/rebase-x-shell-docfix: rebase: fix documentation about used shell in -x
2024-02-13Merge branch 'ne/doc-filter-blob-limit-fix' into maint-2.43Junio C Hamano1-4/+4
Docfix. * ne/doc-filter-blob-limit-fix: rev-list-options: fix off-by-one in '--filter=blob:limit=<n>' explainer
2024-02-13A few more fixes before -rc1Junio C Hamano1-0/+14
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-02-12A few more topics before -rc1Junio C Hamano1-0/+24
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-02-12Merge branch 'tb/multi-pack-reuse-experiment'Junio C Hamano1-0/+3
Setting `feature.experimental` opts the user into multi-pack reuse experiment * tb/multi-pack-reuse-experiment: pack-objects: enable multi-pack reuse via `feature.experimental` t5332-multi-pack-reuse.sh: extract pack-objects helper functions
2024-02-12Merge branch 'vd/for-each-ref-sort-with-formatted-timestamp'Junio C Hamano1-3/+5
"git branch" and friends learned to use the formatted text as sorting key, not the underlying timestamp value, when the --sort option is used with author or committer timestamp with a format specifier (e.g., "--sort=creatordate:format:%H:%M:%S"). * vd/for-each-ref-sort-with-formatted-timestamp: ref-filter.c: sort formatted dates by byte value
2024-02-12Merge branch 'jc/bisect-doc'Junio C Hamano1-4/+6
Doc update. * jc/bisect-doc: bisect: document command line arguments for "bisect start" bisect: document "terms" subcommand more fully
2024-02-08Git 2.44-rc0v2.44.0-rc0Junio C Hamano1-49/+0
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-02-08Sync with Git 2.43.1Junio C Hamano1-0/+82
2024-02-08Git 2.43.1v2.43.1Junio C Hamano1-0/+82
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2024-02-08Merge branch 'ib/rebase-reschedule-doc' into maint-2.43Junio C Hamano1-7/+10
Doc update. * ib/rebase-reschedule-doc: rebase: clarify --reschedule-failed-exec default
2024-02-08Merge branch 'ms/rebase-insnformat-doc-fix' into maint-2.43Junio C Hamano2-2/+2
Docfix. * ms/rebase-insnformat-doc-fix: Documentation: fix statement about rebase.instructionFormat
2024-02-08Merge branch 'js/contributor-docs-updates' into maint-2.43Junio C Hamano2-12/+25
Doc update. * js/contributor-docs-updates: SubmittingPatches: hyphenate non-ASCII SubmittingPatches: clarify GitHub artifact format SubmittingPatches: clarify GitHub visual SubmittingPatches: provide tag naming advice SubmittingPatches: update extra tags list SubmittingPatches: discourage new trailers SubmittingPatches: drop ref to "What's in git.git" CodingGuidelines: write punctuation marks CodingGuidelines: move period inside parentheses
2024-02-08Merge branch 'ml/doc-merge-updates' into maint-2.43Junio C Hamano1-35/+35
Doc update. * ml/doc-merge-updates: Documentation/git-merge.txt: use backticks for command wrapping Documentation/git-merge.txt: fix reference to synopsis
2024-02-08Merge branch 'jc/orphan-unborn' into maint-2.43Junio C Hamano5-5/+23
Doc updates to clarify what an "unborn branch" means. * jc/orphan-unborn: orphan/unborn: fix use of 'orphan' in end-user facing messages orphan/unborn: add to the glossary and use them consistently
generated by cgit v1.2.3 (git 2.39.1) at 2026-01-06 00:13:49 +0000