linux/poky.git/meta/recipes-devtools/git, branch yocto-4.0.8

git: upgrade 2.35.6 -> 2.35.7

2023-02-24T16:41:46+00:00

Upgrade git to latest 2.37.x release to address security issues CVE-2022-23521 and CVE-2022-41903. (From OE-Core rev: 0e7de5066491bc9b860ad4d65965d6f848898aff) Signed-off-by: Sakib Sajal Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: ignore CVE-2022-41953

2023-02-15T21:46:55+00:00

This is specific to Git-for-Windows. (From OE-Core rev: 72438f0a54296a12cfd770c5c67b1e038f019dee) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie (cherry picked from commit c8849af809e0213d43e18e5d01067eeeb61b330d) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: upgrade to 2.35.6

2023-02-15T21:46:55+00:00

upgrade include fix for CVE-2022-23521 and CVE-2022-41903 (From OE-Core rev: d21b033c2f8890989729bc1468254c9298f9a518) Signed-off-by: Chee Yang Lee Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: upgrade 2.35.4 -> 2.35.5

2022-10-29T15:32:24+00:00

This release addresses the security issues CVE-2022-39253 and CVE-2022-39260. * CVE-2022-39253: When relying on the `--local` clone optimization, Git dereferences symbolic links in the source repository before creating hardlinks (or copies) of the dereferenced link in the destination repository. This can lead to surprising behavior where arbitrary files are present in a repository's `$GIT_DIR` when cloning from a malicious repository. Git will no longer dereference symbolic links via the `--local` clone mechanism, and will instead refuse to clone repositories that have symbolic links present in the `$GIT_DIR/objects` directory. Additionally, the value of `protocol.file.allow` is changed to be "user" by default. * CVE-2022-39260: An overly-long command string given to `git shell` can result in overflow in `split_cmdline()`, leading to arbitrary heap writes and remote code execution when `git shell` is exposed and the directory `$HOME/git-shell-commands` exists. `git shell` is taught to refuse interactive commands that are longer than 4MiB in size. `split_cmdline()` is hardened to reject inputs larger than 2GiB. Credit for finding CVE-2022-39253 goes to Cory Snider of Mirantis. The fix was authored by Taylor Blau, with help from Johannes Schindelin. Credit for finding CVE-2022-39260 goes to Kevin Backhouse of GitHub. The fix was authored by Kevin Backhouse, Jeff King, and Taylor Blau. (From OE-Core rev: 43badfadb92a1d6684801f81fa2ed9c8b5652bb6) Signed-off-by: Tim Orling Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: upgrade v2.35.3 -> v2.35.4

2022-08-01T15:27:30+00:00

Minor upgrade which includes fix for CVE-2022-29187. (From OE-Core rev: 11943acaacd9b81b09ca378f40b17c393d33cb4b) Signed-off-by: Sakib Sajal Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: fix override syntax in RDEPENDS

2022-06-22T22:46:29+00:00

RDEPENDS_${PN}-tk -> RDEPENDS:${PN}-tk (From OE-Core rev: 025d22e9c90ec0a46c1295149f1d43187c76cbe9) Signed-off-by: Yi Zhao Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 1ed9267a318d53a302991a8ec7259d3bb809eaaa) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: upgrade 2.35.2 -> 2.35.3

2022-04-28T16:07:18+00:00

Bug fix release: 0f85c4a30b setup: opt-out of check with safe.directory=* bb50ec3cc3 setup: fix safe.directory key not being checked e47363e5a8 t0033: add tests for safe.directory (From OE-Core rev: c3b96e04e91eb9e28bcfe1c84e159193a82d302c) Signed-off-by: Zheng Ruoqin Signed-off-by: Richard Purdie (cherry picked from commit 457b5d4dad3e6fa77e80bed66666c36caa452380) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: correct license

2022-04-28T16:07:18+00:00

by default git pulls in several code fragments not being licensed under just GPL-2.0-only. obstack and poll are licensed under GPL-2.0-or-later reftable being BSD-3-Clause sha1dc and inet_ntop being MIT netmalloc being Bosst-1.0 aka BSL-1.0 regex being LGPL-2.1-or-later (From OE-Core rev: d12513f066baca13a5be0c00792b1bd7d8b07c17) Signed-off-by: Konrad Weihmann Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 5184e651651ed949d198882a10f406cef5939b7b) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

git: Upgrade 2.35.1 -> 2.35.2

2022-04-15T16:30:34+00:00

This includes a fix for CVE-2022-24765 (From OE-Core rev: a17dc42d82b12d7f891c903a02a0302b31829c88) Signed-off-by: Richard Purdie

git: Ignore CVE-2022-24975

2022-04-13T15:52:24+00:00

Everyone I've talked to doesn't see this as a major issue. The CVE asks for a documentation improvement on the --mirror option to git clone as deleted content could be leaked into a mirror. For OE's general users/use cases, we wouldn't build or ship docs so this wouldn't affect us. (From OE-Core rev: 5dfe2dd5482c9a446f8e722fe51903d205e6770d) Signed-off-by: Richard Purdie