Source: git-evtag Version: 2016.1-2 Severity: serious X-Debbugs-CC: g...@packages.debian.org Tags: sid bookworm User: debian...@lists.debian.org Usertags: needs-update Control: affects -1 src:git
Dear maintainer(s),With a recent upload of git the autopkgtest of git-evtag fails in testing when that autopkgtest is run with the binary packages of git from unstable. It passes when run with only packages from testing. In tabular form:
pass fail
git from testing 1:2.38.1-1
git-evtag from testing 2016.1-2
all others from testing from testing
I copied some of the output at the bottom of this report. This is due to """
* Addresses the security issue CVE-2022-39253: cloning an
attacker-controlled local repository could store arbitrary files
in the ".git" directory of the destination repository.
"""
This has a nice write up:
https://vielmetti.typepad.com/logbook/2022/10/git-security-fixes-lead-to-fatal-transport-file-not-allowed-error-in-ci-systems-cve-2022-39253.html
Currently this regression is blocking the migration of git to testing
[1]. Of course, git shouldn't just break your autopkgtest (or even
worse, your package), but it seems to me that the change in git was
intended and your package needs to update to the new situation.
If this is a real problem in your package (and not only in your autopkgtest), the right binary package(s) from git should really add a versioned Breaks on the unfixed version of (one of your) package(s). Note: the Breaks is nice even if the issue is only in the autopkgtest as it helps the migration software to figure out the right versions to combine in the tests.
More information about this bug and the reason for filing it can be found on https://wiki.debian.org/ContinuousIntegration/RegressionEmailInformation Paul [1] https://qa.debian.org/excuses.php?package=git https://ci.debian.net/data/autopkgtest/testing/amd64/g/git-evtag/28079227/log.gz Running test: git-evtag/test-basic.test + set -o pipefail + echo 1..6 1..6 ++ dirname /usr/libexec/git-evtag/installed-tests/test-basic.sh + . /usr/libexec/git-evtag/installed-tests/libtest.sh +++ dirname /usr/libexec/git-evtag/installed-tests/test-basic.sh ++ SRCDIR=/usr/libexec/git-evtag/installed-tests +++ pwd ++ test_tmpdir=/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1 ++ export G_DEBUG=fatal-warnings ++ G_DEBUG=fatal-warnings ++ export TEST_GPG_KEYID_1=472CDAFA ++ TEST_GPG_KEYID_1=472CDAFA ++ export TEST_GPG_KEYID_2=CA950D41 ++ TEST_GPG_KEYID_2=CA950D41 ++ export TEST_GPG_KEYID_3=DF444D67 ++ TEST_GPG_KEYID_3=DF444D67 ++ export 'GIT_AUTHOR_NAME=Colin Walters' ++ GIT_AUTHOR_NAME='Colin Walters' ++ export GIT_AUTHOR_EMAIL=walt...@verbum.org ++ GIT_AUTHOR_EMAIL=walt...@verbum.org ++ export 'GIT_COMMITTER_NAME=Colin Walters' ++ GIT_COMMITTER_NAME='Colin Walters' ++ export GIT_COMMITTER_EMAIL=walt...@verbum.org ++ GIT_COMMITTER_EMAIL=walt...@verbum.org++ cp -a /usr/libexec/git-evtag/installed-tests/gpghome /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1
++ chmod 0700 /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/gpghome ++ export GNUPGHOME=/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/gpghome ++ GNUPGHOME=/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/gpghome ++ test -n '' + setup_test_repository ++ pwd + oldpwd=/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1 + cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1 + mkdir coolproject + cd coolproject + git inithint: Using 'master' as the name for the initial branch. This default branch name hint: is subject to change. To configure the initial branch name to use in all
hint: of your new repositories, which will suppress this warning, call: hint: hint: git config --global init.defaultBranch <name>hint: hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and hint: 'development'. The just-created branch can be renamed via this command:
hint: hint: git branch -m <name>Initialized empty Git repository in /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/coolproject/.git/
+ gitcommit_reset_time + TSCOUNTER=1436222301 + echo 'So cool!' + git add . + gitcommit_inctime -a -m 'Initial commit' + TSCOUNTER=1436222302 + TSV='1436222302 +0000'+ env 'GIT_AUTHOR_DATE=1436222302 +0000' 'GIT_COMMITTER_DATE=1436222302 +0000' git commit -a -m 'Initial commit'
[master (root-commit) a83a4b8] Initial commit
1 file changed, 1 insertion(+)
create mode 100644 README.md
+ mkdir src
+ echo 'printf("hello world")'
+ git add .
+ gitcommit_inctime -a -m 'Add C source'
+ TSCOUNTER=1436222303
+ TSV='1436222303 +0000'
+ env 'GIT_AUTHOR_DATE=1436222303 +0000' 'GIT_COMMITTER_DATE=1436222303
+0000' git commit -a -m 'Add C source'
[master 91df757] Add C source 1 file changed, 1 insertion(+) create mode 100644 src/cool.c + cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1 + mkdir -p repos/coolproject + cd repos/coolproject + git init --barehint: Using 'master' as the name for the initial branch. This default branch name hint: is subject to change. To configure the initial branch name to use in all
hint: of your new repositories, which will suppress this warning, call: hint: hint: git config --global init.defaultBranch <name>hint: hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and hint: 'development'. The just-created branch can be renamed via this command:
hint: hint: git branch -m <name>Initialized empty Git repository in /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/coolproject/
+ cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/coolproject+ git remote add origin file:///tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/coolproject
+ git push --set-upstream origin master To file:///tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/coolproject * [new branch] master -> master branch 'master' set up to track 'origin/master'. + cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1 + mkdir subproject + cd subproject + git inithint: Using 'master' as the name for the initial branch. This default branch name hint: is subject to change. To configure the initial branch name to use in all
hint: of your new repositories, which will suppress this warning, call: hint: hint: git config --global init.defaultBranch <name>hint: hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and hint: 'development'. The just-created branch can be renamed via this command:
hint: hint: git branch -m <name>Initialized empty Git repository in /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/subproject/.git/
+ echo 'this is libsub.c' + echo 'An example submodule' + git add . + gitcommit_inctime -a -m init + TSCOUNTER=1436222304 + TSV='1436222304 +0000'+ env 'GIT_AUTHOR_DATE=1436222304 +0000' 'GIT_COMMITTER_DATE=1436222304 +0000' git commit -a -m init
[master (root-commit) 1139963] init 2 files changed, 2 insertions(+) create mode 100644 README.md create mode 100644 libsub.c + mkdir src + mv libsub.c src + echo 'an update to libsub.c, now in src/' + gitcommit_inctime -a -m 'an update' + TSCOUNTER=1436222305 + TSV='1436222305 +0000'+ env 'GIT_AUTHOR_DATE=1436222305 +0000' 'GIT_COMMITTER_DATE=1436222305 +0000' git commit -a -m 'an update'
[master daa4f15] an update 1 file changed, 1 deletion(-) delete mode 100644 libsub.c + cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1 + mkdir -p repos/subproject + cd repos/subproject + git init --barehint: Using 'master' as the name for the initial branch. This default branch name hint: is subject to change. To configure the initial branch name to use in all
hint: of your new repositories, which will suppress this warning, call: hint: hint: git config --global init.defaultBranch <name>hint: hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and hint: 'development'. The just-created branch can be renamed via this command:
hint: hint: git branch -m <name>Initialized empty Git repository in /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/subproject/
+ cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/subproject+ git remote add origin file:///tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/subproject
+ git push --set-upstream origin master To file:///tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/subproject * [new branch] master -> master branch 'master' set up to track 'origin/master'. + cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/coolproject + git submodule add ../subproject subprojectCloning into '/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/coolproject/subproject'...
fatal: transport 'file' not allowedfatal: clone of 'file:///tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/subproject' into submodule path '/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/coolproject/subproject' failed
FAIL: git-evtag/test-basic.test (Child process exited with code 128)SUMMARY: total=1; passed=0; skipped=0; failed=1; user=0.1s; system=0.1s; maxrss=6544
FAIL: git-evtag/test-basic.test (Child process exited with code 128) autopkgtest [20:14:53]: test installed-tests
OpenPGP_signature
Description: OpenPGP digital signature
