--- Begin Message ---
Source: git-evtag
Version: 2016.1-2
Severity: serious
X-Debbugs-CC: g...@packages.debian.org
Tags: sid bookworm
User: debian...@lists.debian.org
Usertags: needs-update
Control: affects -1 src:git
Dear maintainer(s),
With a recent upload of git the autopkgtest of git-evtag fails in
testing when that autopkgtest is run with the binary packages of git
from unstable. It passes when run with only packages from testing. In
tabular form:
pass fail
git from testing 1:2.38.1-1
git-evtag from testing 2016.1-2
all others from testing from testing
I copied some of the output at the bottom of this report. This is due to """
* Addresses the security issue CVE-2022-39253: cloning an
attacker-controlled local repository could store arbitrary files
in the ".git" directory of the destination repository.
"""
This has a nice write up:
https://vielmetti.typepad.com/logbook/2022/10/git-security-fixes-lead-to-fatal-transport-file-not-allowed-error-in-ci-systems-cve-2022-39253.html
Currently this regression is blocking the migration of git to testing
[1]. Of course, git shouldn't just break your autopkgtest (or even
worse, your package), but it seems to me that the change in git was
intended and your package needs to update to the new situation.
If this is a real problem in your package (and not only in your
autopkgtest), the right binary package(s) from git should really add a
versioned Breaks on the unfixed version of (one of your) package(s).
Note: the Breaks is nice even if the issue is only in the autopkgtest as
it helps the migration software to figure out the right versions to
combine in the tests.
More information about this bug and the reason for filing it can be found on
https://wiki.debian.org/ContinuousIntegration/RegressionEmailInformation
Paul
[1] https://qa.debian.org/excuses.php?package=git
https://ci.debian.net/data/autopkgtest/testing/amd64/g/git-evtag/28079227/log.gz
Running test: git-evtag/test-basic.test
+ set -o pipefail
+ echo 1..6
1..6
++ dirname /usr/libexec/git-evtag/installed-tests/test-basic.sh
+ . /usr/libexec/git-evtag/installed-tests/libtest.sh
+++ dirname /usr/libexec/git-evtag/installed-tests/test-basic.sh
++ SRCDIR=/usr/libexec/git-evtag/installed-tests
+++ pwd
++ test_tmpdir=/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1
++ export G_DEBUG=fatal-warnings
++ G_DEBUG=fatal-warnings
++ export TEST_GPG_KEYID_1=472CDAFA
++ TEST_GPG_KEYID_1=472CDAFA
++ export TEST_GPG_KEYID_2=CA950D41
++ TEST_GPG_KEYID_2=CA950D41
++ export TEST_GPG_KEYID_3=DF444D67
++ TEST_GPG_KEYID_3=DF444D67
++ export 'GIT_AUTHOR_NAME=Colin Walters'
++ GIT_AUTHOR_NAME='Colin Walters'
++ export GIT_AUTHOR_EMAIL=walt...@verbum.org
++ GIT_AUTHOR_EMAIL=walt...@verbum.org
++ export 'GIT_COMMITTER_NAME=Colin Walters'
++ GIT_COMMITTER_NAME='Colin Walters'
++ export GIT_COMMITTER_EMAIL=walt...@verbum.org
++ GIT_COMMITTER_EMAIL=walt...@verbum.org
++ cp -a /usr/libexec/git-evtag/installed-tests/gpghome
/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1
++ chmod 0700 /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/gpghome
++ export GNUPGHOME=/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/gpghome
++ GNUPGHOME=/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/gpghome
++ test -n ''
+ setup_test_repository
++ pwd
+ oldpwd=/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1
+ cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1
+ mkdir coolproject
+ cd coolproject
+ git init
hint: Using 'master' as the name for the initial branch. This default
branch name
hint: is subject to change. To configure the initial branch name to use
in all
hint: of your new repositories, which will suppress this warning, call:
hint: hint: git config --global init.defaultBranch <name>
hint: hint: Names commonly chosen instead of 'master' are 'main',
'trunk' and
hint: 'development'. The just-created branch can be renamed via this
command:
hint: hint: git branch -m <name>
Initialized empty Git repository in
/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/coolproject/.git/
+ gitcommit_reset_time
+ TSCOUNTER=1436222301
+ echo 'So cool!'
+ git add .
+ gitcommit_inctime -a -m 'Initial commit'
+ TSCOUNTER=1436222302
+ TSV='1436222302 +0000'
+ env 'GIT_AUTHOR_DATE=1436222302 +0000' 'GIT_COMMITTER_DATE=1436222302
+0000' git commit -a -m 'Initial commit'
[master (root-commit) a83a4b8] Initial commit
1 file changed, 1 insertion(+)
create mode 100644 README.md
+ mkdir src
+ echo 'printf("hello world")'
+ git add .
+ gitcommit_inctime -a -m 'Add C source'
+ TSCOUNTER=1436222303
+ TSV='1436222303 +0000'
+ env 'GIT_AUTHOR_DATE=1436222303 +0000' 'GIT_COMMITTER_DATE=1436222303
+0000' git commit -a -m 'Add C source'
[master 91df757] Add C source
1 file changed, 1 insertion(+)
create mode 100644 src/cool.c
+ cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1
+ mkdir -p repos/coolproject
+ cd repos/coolproject
+ git init --bare
hint: Using 'master' as the name for the initial branch. This default
branch name
hint: is subject to change. To configure the initial branch name to use
in all
hint: of your new repositories, which will suppress this warning, call:
hint: hint: git config --global init.defaultBranch <name>
hint: hint: Names commonly chosen instead of 'master' are 'main',
'trunk' and
hint: 'development'. The just-created branch can be renamed via this
command:
hint: hint: git branch -m <name>
Initialized empty Git repository in
/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/coolproject/
+ cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/coolproject
+ git remote add origin
file:///tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/coolproject
+ git push --set-upstream origin master
To file:///tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/coolproject
* [new branch] master -> master
branch 'master' set up to track 'origin/master'.
+ cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1
+ mkdir subproject
+ cd subproject
+ git init
hint: Using 'master' as the name for the initial branch. This default
branch name
hint: is subject to change. To configure the initial branch name to use
in all
hint: of your new repositories, which will suppress this warning, call:
hint: hint: git config --global init.defaultBranch <name>
hint: hint: Names commonly chosen instead of 'master' are 'main',
'trunk' and
hint: 'development'. The just-created branch can be renamed via this
command:
hint: hint: git branch -m <name>
Initialized empty Git repository in
/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/subproject/.git/
+ echo 'this is libsub.c'
+ echo 'An example submodule'
+ git add .
+ gitcommit_inctime -a -m init
+ TSCOUNTER=1436222304
+ TSV='1436222304 +0000'
+ env 'GIT_AUTHOR_DATE=1436222304 +0000' 'GIT_COMMITTER_DATE=1436222304
+0000' git commit -a -m init
[master (root-commit) 1139963] init
2 files changed, 2 insertions(+)
create mode 100644 README.md
create mode 100644 libsub.c
+ mkdir src
+ mv libsub.c src
+ echo 'an update to libsub.c, now in src/'
+ gitcommit_inctime -a -m 'an update'
+ TSCOUNTER=1436222305
+ TSV='1436222305 +0000'
+ env 'GIT_AUTHOR_DATE=1436222305 +0000' 'GIT_COMMITTER_DATE=1436222305
+0000' git commit -a -m 'an update'
[master daa4f15] an update
1 file changed, 1 deletion(-)
delete mode 100644 libsub.c
+ cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1
+ mkdir -p repos/subproject
+ cd repos/subproject
+ git init --bare
hint: Using 'master' as the name for the initial branch. This default
branch name
hint: is subject to change. To configure the initial branch name to use
in all
hint: of your new repositories, which will suppress this warning, call:
hint: hint: git config --global init.defaultBranch <name>
hint: hint: Names commonly chosen instead of 'master' are 'main',
'trunk' and
hint: 'development'. The just-created branch can be renamed via this
command:
hint: hint: git branch -m <name>
Initialized empty Git repository in
/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/subproject/
+ cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/subproject
+ git remote add origin
file:///tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/subproject
+ git push --set-upstream origin master
To file:///tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/subproject
* [new branch] master -> master
branch 'master' set up to track 'origin/master'.
+ cd /tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/coolproject
+ git submodule add ../subproject subproject
Cloning into
'/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/coolproject/subproject'...
fatal: transport 'file' not allowed
fatal: clone of
'file:///tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/repos/subproject'
into submodule path
'/tmp/test-tmp-git-evtag_test-basic.test-2FD4U1/coolproject/subproject'
failed
FAIL: git-evtag/test-basic.test (Child process exited with code 128)
SUMMARY: total=1; passed=0; skipped=0; failed=1; user=0.1s; system=0.1s;
maxrss=6544
FAIL: git-evtag/test-basic.test (Child process exited with code 128)
autopkgtest [20:14:53]: test installed-tests
OpenPGP_signature
Description: OpenPGP digital signature
--- End Message ---
