--- Begin Message ---
Source: check-manifest
Version: 0.46-2
Severity: serious
X-Debbugs-CC: g...@packages.debian.org
Tags: sid bookworm
User: debian...@lists.debian.org
Usertags: needs-update
Control: affects -1 src:git
Dear maintainer(s),
With a recent upload of git the autopkgtest of check-manifest fails in
testing when that autopkgtest is run with the binary packages of git
from unstable. It passes when run with only packages from testing. In
tabular form:
pass fail
git from testing 1:2.38.1-1
check-manifest from testing 0.46-2
all others from testing from testing
I copied some of the output at the bottom of this report. This is due to """
* Addresses the security issue CVE-2022-39253: cloning an
attacker-controlled local repository could store arbitrary files
in the ".git" directory of the destination repository.
"""
This has a nice write up:
https://vielmetti.typepad.com/logbook/2022/10/git-security-fixes-lead-to-fatal-transport-file-not-allowed-error-in-ci-systems-cve-2022-39253.html
Currently this regression is blocking the migration of git to testing
[1]. Of course, git shouldn't just break your autopkgtest (or even
worse, your package), but it seems to me that the change in git was
intended and your package needs to update to the new situation.
If this is a real problem in your package (and not only in your
autopkgtest), the right binary package(s) from git should really add a
versioned Breaks on the unfixed version of (one of your) package(s).
Note: the Breaks is nice even if the issue is only in the autopkgtest as
it helps the migration software to figure out the right versions to
combine in the tests.
More information about this bug and the reason for filing it can be found on
https://wiki.debian.org/ContinuousIntegration/RegressionEmailInformation
Paul
[1] https://qa.debian.org/excuses.php?package=git
https://ci.debian.net/data/autopkgtest/testing/amd64/c/check-manifest/28079226/log.gz
=================================== FAILURES
===================================
_____________ TestGit.test_get_versioned_files_with_git_submodules
_____________
self = <tests.TestGit
testMethod=test_get_versioned_files_with_git_submodules>
def test_get_versioned_files_with_git_submodules(self):
from check_manifest import get_vcs_files
self._init_repo_with_files('repo1', ['file1', 'file2'])
self._init_repo_with_files('repo2', ['file3'])
self._init_repo_with_files('repo3', ['file4'])
self._add_submodule('repo2', 'sub3', '../repo3')
tests.py:1094: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _ _ _ _ _ _ _ _ _ _ tests.py:1074: in _add_submodule
self.vcs._run('git', 'submodule', 'add', subrepo, subdir)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _ _ _
self = <tests.GitHelper object at 0x7f8258761a20>
command = ('git', 'submodule', 'add', '../repo3', 'sub3')
p = <Popen: returncode: 128 args: ('git', 'submodule', 'add',
'../repo3', 'sub3')>
stdout = b"Cloning into
'/tmp/test-62xpxof5-check-manifest/repo2/sub3'...\nfatal: transport
'file' not allowed\nfatal: clone of
'/tmp/test-62xpxof5-check-manifest/repo3' into submodule path
'/tmp/test-62xpxof5-check-manifest/repo2/sub3' failed\n"
stderr = None
def _run(self, *command):
# Windows doesn't like Unicode arguments to subprocess.Popen(),
on Py2:
#
https://github.com/mgedmin/check-manifest/issues/23#issuecomment-33933031
if str is bytes:
command = [s.encode(locale.getpreferredencoding()) for s in
command]
print('$', ' '.join(command))
p = subprocess.Popen(command, stdout=subprocess.PIPE,
stderr=subprocess.STDOUT)
stdout, stderr = p.communicate()
rc = p.wait()
if stdout:
print(
stdout if isinstance(stdout, str) else
stdout.decode('ascii', 'backslashreplace')
)
if rc:
raise subprocess.CalledProcessError(rc, command[0], output=stdout)
E subprocess.CalledProcessError: Command 'git' returned
non-zero exit status 128.
tests.py:949: CalledProcessError
----------------------------- Captured stdout call
-----------------------------
$ git init
hint: Using 'master' as the name for the initial branch. This default
branch name
hint: is subject to change. To configure the initial branch name to use
in all
hint: of your new repositories, which will suppress this warning, call:
hint: hint: git config --global init.defaultBranch <name>
hint: hint: Names commonly chosen instead of 'master' are 'main',
'trunk' and
hint: 'development'. The just-created branch can be renamed via this
command:
hint: hint: git branch -m <name>
Initialized empty Git repository in
/tmp/test-62xpxof5-check-manifest/repo1/.git/
$ git config user.name Unit Test
$ git config user.email t...@example.com
$ git add --force -- file1 file2
$ git commit -m Initial
[master (root-commit) bbd8b65] Initial
2 files changed, 0 insertions(+), 0 deletions(-)
create mode 100644 file1
create mode 100644 file2
$ git init
hint: Using 'master' as the name for the initial branch. This default
branch name
hint: is subject to change. To configure the initial branch name to use
in all
hint: of your new repositories, which will suppress this warning, call:
hint: hint: git config --global init.defaultBranch <name>
hint: hint: Names commonly chosen instead of 'master' are 'main',
'trunk' and
hint: 'development'. The just-created branch can be renamed via this
command:
hint: hint: git branch -m <name>
Initialized empty Git repository in
/tmp/test-62xpxof5-check-manifest/repo2/.git/
$ git config user.name Unit Test
$ git config user.email t...@example.com
$ git add --force -- file3
$ git commit -m Initial
[master (root-commit) 65cf975] Initial
1 file changed, 0 insertions(+), 0 deletions(-)
create mode 100644 file3
$ git init
hint: Using 'master' as the name for the initial branch. This default
branch name
hint: is subject to change. To configure the initial branch name to use
in all
hint: of your new repositories, which will suppress this warning, call:
hint: hint: git config --global init.defaultBranch <name>
hint: hint: Names commonly chosen instead of 'master' are 'main',
'trunk' and
hint: 'development'. The just-created branch can be renamed via this
command:
hint: hint: git branch -m <name>
Initialized empty Git repository in
/tmp/test-62xpxof5-check-manifest/repo3/.git/
$ git config user.name Unit Test
$ git config user.email t...@example.com
$ git add --force -- file4
$ git commit -m Initial
[master (root-commit) 4b782fa] Initial
1 file changed, 0 insertions(+), 0 deletions(-)
create mode 100644 file4
$ git submodule add ../repo3 sub3
Cloning into '/tmp/test-62xpxof5-check-manifest/repo2/sub3'...
fatal: transport 'file' not allowed
fatal: clone of '/tmp/test-62xpxof5-check-manifest/repo3' into submodule
path '/tmp/test-62xpxof5-check-manifest/repo2/sub3' failed
_
TestGit.test_get_versioned_files_with_git_submodules_with_git_index_file_set
_
self = <tests.TestGit
testMethod=test_get_versioned_files_with_git_submodules_with_git_index_file_set>
def
test_get_versioned_files_with_git_submodules_with_git_index_file_set(self):
with mock.patch.dict(os.environ, {"GIT_INDEX_FILE": ".git/index"}):
self.test_get_versioned_files_with_git_submodules()
tests.py:1115: _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _ _ _ _ _ _ _ _ _ _ tests.py:1094: in
test_get_versioned_files_with_git_submodules
self._add_submodule('repo2', 'sub3', '../repo3')
tests.py:1074: in _add_submodule
self.vcs._run('git', 'submodule', 'add', subrepo, subdir)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _ _ _
self = <tests.GitHelper object at 0x7f8258761a20>
command = ('git', 'submodule', 'add', '../repo3', 'sub3')
p = <Popen: returncode: 128 args: ('git', 'submodule', 'add',
'../repo3', 'sub3')>
stdout = b"Cloning into
'/tmp/test-vgr4o291-check-manifest/repo2/sub3'...\nfatal: transport
'file' not allowed\nfatal: clone of
'/tmp/test-vgr4o291-check-manifest/repo3' into submodule path
'/tmp/test-vgr4o291-check-manifest/repo2/sub3' failed\n"
stderr = None
def _run(self, *command):
# Windows doesn't like Unicode arguments to subprocess.Popen(),
on Py2:
#
https://github.com/mgedmin/check-manifest/issues/23#issuecomment-33933031
if str is bytes:
command = [s.encode(locale.getpreferredencoding()) for s in
command]
print('$', ' '.join(command))
p = subprocess.Popen(command, stdout=subprocess.PIPE,
stderr=subprocess.STDOUT)
stdout, stderr = p.communicate()
rc = p.wait()
if stdout:
print(
stdout if isinstance(stdout, str) else
stdout.decode('ascii', 'backslashreplace')
)
if rc:
raise subprocess.CalledProcessError(rc, command[0], output=stdout)
E subprocess.CalledProcessError: Command 'git' returned
non-zero exit status 128.
tests.py:949: CalledProcessError
----------------------------- Captured stdout call
-----------------------------
$ git init
hint: Using 'master' as the name for the initial branch. This default
branch name
hint: is subject to change. To configure the initial branch name to use
in all
hint: of your new repositories, which will suppress this warning, call:
hint: hint: git config --global init.defaultBranch <name>
hint: hint: Names commonly chosen instead of 'master' are 'main',
'trunk' and
hint: 'development'. The just-created branch can be renamed via this
command:
hint: hint: git branch -m <name>
Initialized empty Git repository in
/tmp/test-vgr4o291-check-manifest/repo1/.git/
$ git config user.name Unit Test
$ git config user.email t...@example.com
$ git add --force -- file1 file2
$ git commit -m Initial
[master (root-commit) bbd8b65] Initial
2 files changed, 0 insertions(+), 0 deletions(-)
create mode 100644 file1
create mode 100644 file2
$ git init
hint: Using 'master' as the name for the initial branch. This default
branch name
hint: is subject to change. To configure the initial branch name to use
in all
hint: of your new repositories, which will suppress this warning, call:
hint: hint: git config --global init.defaultBranch <name>
hint: hint: Names commonly chosen instead of 'master' are 'main',
'trunk' and
hint: 'development'. The just-created branch can be renamed via this
command:
hint: hint: git branch -m <name>
Initialized empty Git repository in
/tmp/test-vgr4o291-check-manifest/repo2/.git/
$ git config user.name Unit Test
$ git config user.email t...@example.com
$ git add --force -- file3
$ git commit -m Initial
[master (root-commit) 65cf975] Initial
1 file changed, 0 insertions(+), 0 deletions(-)
create mode 100644 file3
$ git init
hint: Using 'master' as the name for the initial branch. This default
branch name
hint: is subject to change. To configure the initial branch name to use
in all
hint: of your new repositories, which will suppress this warning, call:
hint: hint: git config --global init.defaultBranch <name>
hint: hint: Names commonly chosen instead of 'master' are 'main',
'trunk' and
hint: 'development'. The just-created branch can be renamed via this
command:
hint: hint: git branch -m <name>
Initialized empty Git repository in
/tmp/test-vgr4o291-check-manifest/repo3/.git/
$ git config user.name Unit Test
$ git config user.email t...@example.com
$ git add --force -- file4
$ git commit -m Initial
[master (root-commit) 4b782fa] Initial
1 file changed, 0 insertions(+), 0 deletions(-)
create mode 100644 file4
$ git submodule add ../repo3 sub3
Cloning into '/tmp/test-vgr4o291-check-manifest/repo2/sub3'...
fatal: transport 'file' not allowed
fatal: clone of '/tmp/test-vgr4o291-check-manifest/repo3' into submodule
path '/tmp/test-vgr4o291-check-manifest/repo2/sub3' failed
=========================== short test summary info
============================
FAILED tests.py::TestGit::test_get_versioned_files_with_git_submodules -
subp...
FAILED
tests.py::TestGit::test_get_versioned_files_with_git_submodules_with_git_index_file_set
=========== 2 failed, 142 passed, 2 skipped, 2 deselected in 14.74s
============
autopkgtest [20:15:27]: test run-tests
OpenPGP_signature
Description: OpenPGP digital signature
--- End Message ---
