go install go.wit.com/apps/go-clone@latest
go install go.wit.com/apps/go-mod-clean@latest
go-clone --recusive go.wit.com/lib/git2go
Signed-off-by: Jeff Carr <jcarr@wit.com>
The golang.org/x/crypto/openpgp library has been deprecated for over a
year now (see golang.org/issue/44226, and the deprecation notice in the
package documentation). The library is unmaintained and has a number of
API and usability issues. ProtonMail maintains a community fork which
is actively maintained, and for most cases is a drop-in replacement.
This change switches usages of golang.org/x/crypto/openpgp/... with
github.com/ProtonMail/go-crypto/openpgp/..., the only other code changes
are adding a nil packet.Config to a openpgp.CheckArmoredDetachedSignature
call.
(This change is part of a wider effort by the Go Security team to remove
usages of golang.org/x/crypto/openpgp from the Go ecosystem.)
This prevents error "read/write on closed pipe".
Go's http.client::send() always closes req.Body, so if the first request attempt
is unsuccessful, any subsequent requests after calling the `CredentialsCallback`
will attempt to read/write on a closed pipe.
🔒 This is a security release to provide compatibility with git's
changes to address [CVE
2022-24765](https://github.blog/2022-04-12-git-security-vulnerability-announced/).
libgit2 (and by extension git2go) are not directly affected by this
vulnerability, because libgit2 does not directly invoke any executable.
But we are providing these changes as a security release for any users
that use libgit2 for repository discovery and then also use git on that
repository. In this release, we will now validate that the user opening
the repository is the same user that owns the on-disk repository. This
is to match git's behavior.
In addition, we are providing several correctness fixes where invalid
input can lead to a crash. These may prevent possible denial of service
attacks. At this time there are not known exploits to these issues.
* rebase: Fix missing initialization of the repo pointer
While the `Rebase` structure has a pointer to the repository the rebase
is creatde in, this pointer isn't ever initialized. Fix this.
* rebase: Add wrapper for `git_rebase_inmemory_index()`
Add a new wrapper for `git_rebase_inmemory_index()`, which can be used
to retrieve the index for an in-memory rebase.
Co-authored-by: Patrick Steinhardt <psteinhardt@gitlab.com>
The GoDoc link currently refers to the initial version of this package, but usually folks are looking
for whatever matches the current main branch. This should be updated whenever the package
version changes.
Added `stringer` annotations to `git.go` for `ErrorClass` and
`ErrorCode`. Added `generate` rule for `Makefile` to generate
string representations for these types (first building cgo files
in `_obj` dir to get C constants). Finally, updated `ci` actions
workflow to check that generated files are up to date.
Fixes: #543
* Fix ssh commands used in go SmartSubtransport
Before the fix, the commands sent were of the form:
```
git-upload-pack "/bar/test-reponame"
```
This resulted in the git server returning error:
`error parsing command: invalid git command`
This change replaces the double quotes with single quotes:
```
git-upload-pack '/bar/test-reponame'
```
* Update ssh.go
Co-authored-by: lhchavez <lhchavez@lhchavez.com>
It is now possible to skip expanding an entry in `tree.Walk()` by
returning `TreeWalkSkip`, in addition to stopping altogether by
returning a non-nil error.
Fixes: #837
This change makes all Options objects have child Option fields as values
(instead of pointers) to mirror the libgit2 interface. It also names
them Options instead of Opts to match the current libgit2 nomenclature
and removes the Version fields.
This change adds support for git smart transports. This will be then
used to implement http, https, and ssh transports that don't rely on the
libgit2 library.
This change makes all non-user-creatable structures non-comparable. This
makes it easier to add changes later that don't introduce breaking
changes from the go compatibility guarantees perspective.
This, of course, implies that this change _is_ a breaking change, but since
these structures are not intended to be created by users (or de-referenced),
it should be okay.
We can't yet ship a fully libgit2 v1.2.0-compatible library due to a
missing public symbol, but we can allow the v1.1.0-era codebase to link
against libgit2 v1.2.0 in the meantime.
These builds are no longer working because some of the dependencies now
require newer versions of Go. Seems like the ecosystem has moved to Go
1.11+, so we are now forced to follow suit.
seems like need more libraries in LDFLAGS:
* ws2_32 for socket, connect, htonl, etc
* ole32 for CoInitializeEx
* rpcrt4 for UuidCreate
* crypt32 for CertFreeCertificateContext
From gorelease:
```
Compatible changes:
- IndexTime.Nanoseconds: added
- IndexTime.Seconds: added
```
There are no extra tests because there isn't really anything to test
closes#304
This change renames the build files so they come lexicographically
before any source files. This makes the compile errors (due to
mismatched libgit2 versions) easier to understand, since the
`Build_*.go` files will be tried before the rest, and the `#error` in
those files will kick in, leading to a much better experience.
This unfortunately goes a bit against the defacto standard of using only
lowercase characters in filenames, but the better developer experience
(and better self-diagnosis when things go wrong instead of having to
open a new issue) is worth the deviation.
Fixes: #711Fixes: #617
Jeff Carr
Roland Shoemaker
lhchavez
Sanskar Jaiswal
Calin
William Bain
Patrick Steinhardt
Dylan Richardson
Aurélien
James Fargher
Kirill
Ignacio Taranto
Sunny
Yashodhan Ghadge
Gustav Westling
Vladimir Buzuev
michael boulton
Suhaib Mujahid
Byoungchan Lee
Byoungchan Lee