From nobody Wed Jul 13 06:36:44 2022 X-Original-To: dev-commits-ports-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id ED2C01D0842D; Wed, 13 Jul 2022 06:36:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4LjSZh6VWlz4MMg; Wed, 13 Jul 2022 06:36:44 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1657694204; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/eQBNC+rQcMfDyyCXtPrtHeocEnHzBCl5E5bp3Syf+I=; b=LJ6LMApz/QIjwAKM94f0qOaWNr9ildlGbRY8NWYVZhq4JvNtLrmxr+sK9mem1HuQX2clan r7oikI8eofvDl+ly5m0mcUPl6rOCIpsUEOyiPoTPv5XU5z/Q60bq3pofmQmodUfkwGZhHN DRpXE/sgWh5KRgSNCwjaTp8tKHDmkIBXUS4TB6F9M69wRiXJc18p5n3XofopjiYk0/VE6O dd+ySsDsXVSz8q9D+9Scn1q95MeoUKI/UxlaR98NVOhI+s0eCeUlZ7/2BBV3+3mQgcORh4 o4yuljU8a/hC3cRhU/aU3mgaT9YH2rpMo3hxBtQhS3hFljyrijI3m8MzHvYRvQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4LjSZh5SzhzDk7; Wed, 13 Jul 2022 06:36:44 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 26D6ai7p025534; Wed, 13 Jul 2022 06:36:44 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 26D6aiwV025533; Wed, 13 Jul 2022 06:36:44 GMT (envelope-from git) Date: Wed, 13 Jul 2022 06:36:44 GMT Message-Id: <202207130636.26D6aiwV025533@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org From: Matthias Fechner Subject: git: de1569c878b4 - main - devel/libgit2: security update to 1.3.2 List-Id: Commits to the main branch of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-main@freebsd.org X-BeenThere: dev-commits-ports-main@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: mfechner X-Git-Repository: ports X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: de1569c878b4a565f5bf35ad20a08ec8ec0ccb19 Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1657694204; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=/eQBNC+rQcMfDyyCXtPrtHeocEnHzBCl5E5bp3Syf+I=; b=l7CGddvd7EcYSjMRmLoGbwi9j13ZESY+jvHuayEtdcbMcu4YjYOtSpsk2Wxqog6h2R/UkV dlVo868Ik/9nOF22ibLU0ye7tIOT7l3Mvs/4InrRrtdpmdT+yszuCcDSRTEQPEw1IPLPw0 FKjF1C3hMjDCIEGoCfG1sme3xCON9iU1ebD0zPnq0zpZdBScTRmpVGx8zo57s8ekQmzo/z +mSTk487TGEM5mthH5FhyrPkmmmD9J+ckgm05aJBcSdY0Cc40X26uVaYPeLhz4Vrcssoui 7SGs7l0VEQKq1ZWOpIwb+zLCq+uNdCuCtWVeSxM/vrt0S8N0pywTKqcF+r4Tyg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1657694204; a=rsa-sha256; cv=none; b=j0XptQscG6lmzFHKi5vomf53A+Fk9dVamZFqEyAlJe7F9P6zX1onDrZbZmqbwwqJr/FDCr R+v6irB4PFg87nRKFD07944iNueIUlPDVpn7894hA7y3gzVMuexufe2sAI5EouhnL/tYXC v7OE/gvFyEjeI/7h5lkMC8armTjwgq15W5/PURpLZ0ffJikkwcMLV9vVgxxzxldp46AvBJ J6x/BrIZeeMSe2c8cU7O194o1R5cr3+3WWagu4AgOdMXjy5l9i/82ObLqU4DSrsgtnzwWN 95Oh5WEzQ3WiEWMXuSxNzoNdP5vnNJaoCxLQ6voCavHRmUGUz2hwkrILS2ixKg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch main has been updated by mfechner: URL: https://cgit.FreeBSD.org/ports/commit/?id=de1569c878b4a565f5bf35ad20a08ec8ec0ccb19 commit de1569c878b4a565f5bf35ad20a08ec8ec0ccb19 Author: Matthias Fechner AuthorDate: 2022-07-13 06:34:58 +0000 Commit: Matthias Fechner CommitDate: 2022-07-13 06:36:36 +0000 devel/libgit2: security update to 1.3.2 Changelog: https://github.com/libgit2/libgit2/releases/tag/v1.3.2 This is a security release with multiple changes. This provides compatibility with git's changes to address CVE 2022-29187. As a follow up to CVE 2022-24765, now not only is the working directory of a non-bare repository examined for its ownership, but the .git directory and the .git file (if present) are also examined for their ownership. A fix for compatibility with git's (new) behavior for CVE 2022-24765 allows users on POSIX systems to access a git repository that is owned by them when they are running in sudo. A fix for further compatibility with git's (existing) behavior for CVE 2022-24765 allows users on Windows to access a git repository that is owned by the Administrator when running with escalated privileges (using runas Administrator). The bundled zlib is updated to v1.2.12, as prior versions had memory corruption bugs. It is not known that there is a security vulnerability in libgit2 based on these bugs, but we are updating to be cautious. MFH: 2022Q3 --- devel/libgit2/Makefile | 2 +- devel/libgit2/distinfo | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/devel/libgit2/Makefile b/devel/libgit2/Makefile index 269fcf01efc2..e1a5adc474a3 100644 --- a/devel/libgit2/Makefile +++ b/devel/libgit2/Makefile @@ -5,7 +5,7 @@ PORTNAME= libgit2 DISTVERSIONPREFIX= v -DISTVERSION= 1.3.1 +DISTVERSION= 1.3.2 CATEGORIES= devel MAINTAINER= mfechner@FreeBSD.org diff --git a/devel/libgit2/distinfo b/devel/libgit2/distinfo index f862bbd2ecb9..9e0e5ff0cdf9 100644 --- a/devel/libgit2/distinfo +++ b/devel/libgit2/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1655709923 -SHA256 (libgit2-libgit2-v1.3.1_GH0.tar.gz) = a2a0a90d577f1771ba9f7e98042865c3f6386c896eeefa846c3fc0c37ce7c6e0 -SIZE (libgit2-libgit2-v1.3.1_GH0.tar.gz) = 5602265 +TIMESTAMP = 1657692035 +SHA256 (libgit2-libgit2-v1.3.2_GH0.tar.gz) = 3a4469b32b73d53f9dbb7bf17b61b0cfb7dae9020e199f928fa96f12d6eb29cb +SIZE (libgit2-libgit2-v1.3.2_GH0.tar.gz) = 5824473