linux/poky.git/meta/recipes-devtools/git, branch yocto-3.1.23

git: Use CVE_CHECK_WHITELIST instead of CVE_CHECK_IGNORE

2022-05-20T09:08:01+00:00

Use CVE_CHECK_WHITELIST as CVE_CHECK_IGNORE is not valid on dunfell branch (From OE-Core rev: 970743af349e21a399da6241587b849b14933bc5) Signed-off-by: Ranjitsinh Rathod Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git update from 2.24.3 to 2.24.4

2022-04-22T22:39:12+00:00

Security release, fixes CVE-2021-21300, so remove that patch. 22539ec3b5 unpack_trees(): start with a fresh lstat cache 0d58fef58a run-command: invalidate lstat cache after a command finished 684dd4c2b4 checkout: fix bug that makes checkout follow symlinks in leading path (From OE-Core rev: 8606d99041c3c1a002b2300c59afc116050c73cc) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: Ignore CVE-2022-24975

2022-04-21T20:26:01+00:00

Everyone I've talked to doesn't see this as a major issue. The CVE asks for a documentation improvement on the --mirror option to git clone as deleted content could be leaked into a mirror. For OE's general users/use cases, we wouldn't build or ship docs so this wouldn't affect us. (From OE-Core rev: f35500a442d6a4564d52e23f9602a3f90a4ceee5) Signed-off-by: Richard Purdie (cherry picked from commit 5dfe2dd5482c9a446f8e722fe51903d205e6770d) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: fix CVE-2021-40330

2021-12-02T16:53:07+00:00

git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring. Upstream-Status: Backport [https://github.com/git/git/commit/a02ea577174ab8ed18f847cf1693f213e0b9c473] CVE: CVE-2021-40330 (From OE-Core rev: ea0d7ef4a8c9bba94bd603ebd19e502faa86293b) Signed-off-by: Minjae Kim Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: Fix determinism issue

2021-11-03T11:18:56+00:00

(From OE-Core rev: 3b517d9e05d95c4a2ceb50f4bc07205f1b8f1e14) Signed-off-by: Richard Purdie (cherry picked from commit 9ae740939f8315c64fe7571f912404127a29dc89) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: fix CVE-2021-21300

2021-04-06T21:45:36+00:00

checkout: fix bug that makes checkout follow symlinks in leading path Upstream-Status: Acepted [https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592] CVE: CVE-2021-21300 (From OE-Core rev: 8293d5d1529629bd13028bdde1fa99da30313bac) Signed-off-by: Minjae Kim Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

meta/recipes-devtools: Add HOMEPAGE / DESCRIPTION

2021-03-10T00:22:51+00:00

Added HOMEPAGE and DESCRIPTION for recipes with missing decriptions or homepage [YOCTO #13471] (From OE-Core rev: bd3352880322598b0ba6dc439ff08c2e4c592e36) Signed-off-by: Dorinda Bassey Signed-off-by: Richard Purdie (cherry picked from commit bb05814335e7101bfd8df0a11dc18a044e867bed) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: Upgrade 2.24.1 -> 2.24.3

2020-05-28T17:15:29+00:00

This includes the fixes for CVE-2020-5260 and CVE-2020-11008. (From OE-Core rev: 46da8ac6d25bb75c625c2da1d36cbc693a7d442d) Signed-off-by: Adrian Bunk Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

nativesdk-git: point to system gitconfig

2020-03-29T19:04:10+00:00

On a system with selinux turned on, trying to access a directory that is in a tree that doesn't exist returns the error permission denined rather then no such file or directory, which causes git to die. git clone git://git.yoctoproject.org/poky Cloning into 'poky'... fatal: unable to access '/opt/poky/3.0+snapshot/sysroots/x86_64-pokysdk-linux/etc/gitconfig': Permission denied Switch to using the system gitconfig of the host. (From OE-Core rev: 5e44fb4dd106e3c4b9f072b25a93e54fa7bb1bce) Signed-off-by: Jeremy Puhlman Signed-off-by: Richard Purdie

git: upgrade 2.24.0 -> 2.24.1

2019-12-16T23:25:49+00:00

Fixes a bunch of CVEs: https://github.com/git/git/commit/53a06cf39b756eddfe4a2a34da93e3d04eb7b728 (From OE-Core rev: 8be3c48a418776c8480dbae2dcb5f46c8fb138ed) Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie