<feed xmlns='http://www.w3.org/2005/Atom'>
<title>delta/libgit2.git, branch v1.3.2</title>
<subtitle>github.com: libgit2/libgit2.git
</subtitle>
<link rel='alternate' type='text/html' href='http://trove.baserock.org/cgit/delta/libgit2.git/'/>
<entry>
<title>meta: update changelog for v1.3.2</title>
<updated>2022-07-12T17:09:15+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2022-07-12T17:09:15+00:00</published>
<link rel='alternate' type='text/html' href='http://trove.baserock.org/cgit/delta/libgit2.git/commit/?id=a6c822e353e01f690728a082fe32f09b01b845c6'/>
<id>a6c822e353e01f690728a082fe32f09b01b845c6</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>meta: update version number to 1.3.2</title>
<updated>2022-07-12T17:08:23+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2022-07-12T17:08:23+00:00</published>
<link rel='alternate' type='text/html' href='http://trove.baserock.org/cgit/delta/libgit2.git/commit/?id=351da8af77ff7ce03ebfb3b501e3abb02dce3413'/>
<id>351da8af77ff7ce03ebfb3b501e3abb02dce3413</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>zlib: Silence some warnings from Visual Studio C.</title>
<updated>2022-07-07T04:27:03+00:00</updated>
<author>
<name>Mark Adler</name>
<email>madler@alumni.caltech.edu</email>
</author>
<published>2022-03-28T17:50:16+00:00</published>
<link rel='alternate' type='text/html' href='http://trove.baserock.org/cgit/delta/libgit2.git/commit/?id=d4e1ae3588feb1a1ef8170f06f35507326c01c8f'/>
<id>d4e1ae3588feb1a1ef8170f06f35507326c01c8f</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>zlib: slide_hash: add MSAN annotation to suppress known read from uninitialised memory</title>
<updated>2022-07-07T04:27:03+00:00</updated>
<author>
<name>Andrzej Hunt</name>
<email>andrzej@ahunt.org</email>
</author>
<published>2021-06-04T16:25:19+00:00</published>
<link rel='alternate' type='text/html' href='http://trove.baserock.org/cgit/delta/libgit2.git/commit/?id=c01435b848080fc56c641d9c67eee1083b22aea3'/>
<id>c01435b848080fc56c641d9c67eee1083b22aea3</id>
<content type='text'>
slide_hash knowingly reads (possibly) uninitialised memory, see comment
lower down about prev[n] potentially being garbage. In this case, the
result is never used - so we don't care about MSAN complaining about
this read.

By adding the no_sanitize("memory") attribute, clients of zlib won't
see this (unnecessary) error when building and running with
MemorySanitizer. An alternative approach is for clients to build zlib
with -fsanitize-ignorelist=... where the ignorelist contains something
like 'fun:slide_hash'. But that's more work and needs to be redone
for any and all CI systems running a given project with MSAN. Adding
this annotation to zlib's sources is overall more convenient - but
also won't affect non-MSAN builds.

This specific issue was found while running git's test suite, but has
also been reported by other clients, see e.g. #518.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
slide_hash knowingly reads (possibly) uninitialised memory, see comment
lower down about prev[n] potentially being garbage. In this case, the
result is never used - so we don't care about MSAN complaining about
this read.

By adding the no_sanitize("memory") attribute, clients of zlib won't
see this (unnecessary) error when building and running with
MemorySanitizer. An alternative approach is for clients to build zlib
with -fsanitize-ignorelist=... where the ignorelist contains something
like 'fun:slide_hash'. But that's more work and needs to be redone
for any and all CI systems running a given project with MSAN. Adding
this annotation to zlib's sources is overall more convenient - but
also won't affect non-MSAN builds.

This specific issue was found while running git's test suite, but has
also been reported by other clients, see e.g. #518.
</pre>
</div>
</content>
</entry>
<entry>
<title>zlib: declare prototypes for new functions</title>
<updated>2022-07-07T04:27:01+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2022-07-06T13:52:22+00:00</published>
<link rel='alternate' type='text/html' href='http://trove.baserock.org/cgit/delta/libgit2.git/commit/?id=b1cbb56e528ba066a1f49ecbb323b85e37e8a576'/>
<id>b1cbb56e528ba066a1f49ecbb323b85e37e8a576</id>
<content type='text'>
The `crc32_combine_gen64` missed a prototype in our define path.
Add one.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The `crc32_combine_gen64` missed a prototype in our define path.
Add one.
</pre>
</div>
</content>
</entry>
<entry>
<title>zlib: updated bundled zlib to v1.2.12</title>
<updated>2022-07-07T04:26:12+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2022-07-06T13:50:55+00:00</published>
<link rel='alternate' type='text/html' href='http://trove.baserock.org/cgit/delta/libgit2.git/commit/?id=c25d1a1b2f346e9521cc05482d88c85be50cd14b'/>
<id>c25d1a1b2f346e9521cc05482d88c85be50cd14b</id>
<content type='text'>
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
</pre>
</div>
</content>
</entry>
<entry>
<title>repo: allow users running with sudo to access their repositories</title>
<updated>2022-07-07T04:26:12+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2022-07-06T03:47:15+00:00</published>
<link rel='alternate' type='text/html' href='http://trove.baserock.org/cgit/delta/libgit2.git/commit/?id=749f5fdbdc1a923ca3c49db328f448b613e75585'/>
<id>749f5fdbdc1a923ca3c49db328f448b613e75585</id>
<content type='text'>
In the ownership checks implemented for CVE-2022-24765, we disallowed
users to access their own repositories when running with `sudo`.

Examine the `SUDO_UID` environment variable and allow users running
with `sudo`. This matches git's behavior.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In the ownership checks implemented for CVE-2022-24765, we disallowed
users to access their own repositories when running with `sudo`.

Examine the `SUDO_UID` environment variable and allow users running
with `sudo`. This matches git's behavior.
</pre>
</div>
</content>
</entry>
<entry>
<title>repo: validate gitdir and gitlink ownership</title>
<updated>2022-07-07T04:26:12+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2022-07-02T14:19:33+00:00</published>
<link rel='alternate' type='text/html' href='http://trove.baserock.org/cgit/delta/libgit2.git/commit/?id=2e4ea7b7fb593dea0b96e3bca659c3594e7fe734'/>
<id>2e4ea7b7fb593dea0b96e3bca659c3594e7fe734</id>
<content type='text'>
To match git's behavior with CVE 2022-29187, validate not only the
working directory, but also the gitdir and gitlink (if it exists). This
a follow up to CVE-2022-24765 that was fixed earlier.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
To match git's behavior with CVE 2022-29187, validate not only the
working directory, but also the gitdir and gitlink (if it exists). This
a follow up to CVE-2022-24765 that was fixed earlier.
</pre>
</div>
</content>
</entry>
<entry>
<title>repo: allow admin owned configs by admin users</title>
<updated>2022-07-07T04:26:12+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2022-07-04T20:03:10+00:00</published>
<link rel='alternate' type='text/html' href='http://trove.baserock.org/cgit/delta/libgit2.git/commit/?id=9e35f96e616300a04789b6572f874753dc5579af'/>
<id>9e35f96e616300a04789b6572f874753dc5579af</id>
<content type='text'>
Allow users in the administrator group to use git configs that are owned
by administrators.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Allow users in the administrator group to use git configs that are owned
by administrators.
</pre>
</div>
</content>
</entry>
<entry>
<title>fs: allow ownership match if user is in admin group</title>
<updated>2022-07-07T04:02:19+00:00</updated>
<author>
<name>Edward Thomson</name>
<email>ethomson@edwardthomson.com</email>
</author>
<published>2022-07-07T04:02:19+00:00</published>
<link rel='alternate' type='text/html' href='http://trove.baserock.org/cgit/delta/libgit2.git/commit/?id=decffcf2efd67da717e1d8ff0cc757d076afe861'/>
<id>decffcf2efd67da717e1d8ff0cc757d076afe861</id>
<content type='text'>
Allow the user ownership to match if the file is owned by the admin
group and the user is in the admin group, even if the current process is
not running as administrator directly.
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Allow the user ownership to match if the file is owned by the admin
group and the user is in the admin group, even if the current process is
not running as administrator directly.
</pre>
</div>
</content>
</entry>
</feed>
