🔒 This is a security release to provide compatibility with git's
changes to address [CVE
2022-24765](https://github.blog/2022-04-12-git-security-vulnerability-announced/).
libgit2 (and by extension git2go) are not directly affected by this
vulnerability, because libgit2 does not directly invoke any executable.
But we are providing these changes as a security release for any users
that use libgit2 for repository discovery and then also use git on that
repository. In this release, we will now validate that the user opening
the repository is the same user that owns the on-disk repository. This
is to match git's behavior.
In addition, we are providing several correctness fixes where invalid
input can lead to a crash. These may prevent possible denial of service
attacks. At this time there are not known exploits to these issues.
Added `stringer` annotations to `git.go` for `ErrorClass` and
`ErrorCode`. Added `generate` rule for `Makefile` to generate
string representations for these types (first building cgo files
in `_obj` dir to get C constants). Finally, updated `ci` actions
workflow to check that generated files are up to date.
Fixes: #543
We can't yet ship a fully libgit2 v1.2.0-compatible library due to a
missing public symbol, but we can allow the v1.1.0-era codebase to link
against libgit2 v1.2.0 in the meantime.
These builds are no longer working because some of the dependencies now
require newer versions of Go. Seems like the ecosystem has moved to Go
1.11+, so we are now forced to follow suit.
This change adds `NewCredentialSSHKeyFromSigner`, which allows idiomatic
use of SSH keys from Go. This also lets us spin off an SSH server in the
tests.
The major version must still be an exact match since libgit2 uses
semantic versioning and changes to the major number indicate backwards
incompatible changes to the API.
Fixes: #695
This change:
* Makes the Travis tests only run tip, since the rest of the Go versions are better served by GitHub Actions.
* Use Go 1.15 in the CI. This has been released for a while.
This change adds:
* `tag.yml`: Creates a new tag every time the master or a release branch
is pushed.
* `backport.yml`: Creates a cherry-pick in older release branches to
keep them up to date with little cost.
This change:
* Builds the library with Go 1.14, too.
* Builds the non-legacy tests with Ubuntu Focal (20.04).
* Adds testing for system-wide libraries, both static and dynamic
versions.
* Fixes a typo in the README.
This change:
* Updates the GitHub actions so that they run different commands for the
dynamic and static flavors of libgit2.
* Updates the .travis.yml file so that it does roughly the same as the
GitHub actions.
* Adds the release-* branches to the CI configurations.
lhchavez
Kirill
nmeum
Suhaib Mujahid
michael boulton
Carlos Martín Nieto
Carlos Martín Nieto