This commit introduces libgit2 v1.5.0-alpha to git2go, which brings a
large number of bugfixes and features.
This also marks the start of the v34 release.
🔒 This is a security release to provide compatibility with git's
changes to address [CVE
2022-24765](https://github.blog/2022-04-12-git-security-vulnerability-announced/).
libgit2 (and by extension git2go) are not directly affected by this
vulnerability, because libgit2 does not directly invoke any executable.
But we are providing these changes as a security release for any users
that use libgit2 for repository discovery and then also use git on that
repository. In this release, we will now validate that the user opening
the repository is the same user that owns the on-disk repository. This
is to match git's behavior.
In addition, we are providing several correctness fixes where invalid
input can lead to a crash. These may prevent possible denial of service
attacks. At this time there are not known exploits to these issues.
This uprevs libgit2 to the latest and greatest. Notably,
* Fixes the interface of `git_mempack_reset`, since it now returns an
`int` instead of being `void`.
Fixes: #533
This includes updating the `Index.WriteTreeTo` test as it was abusing an
oversight of the object creation safety checks and creating a tree referencing
a non-existent blob. Instead we update it to the primary purpose of this method
which is to write into a repository from an unattached index.
There's been some changes to the checkout strategy, especially the
SAFE_CREATE mode, which is now the RECREATE_MISSING flag, though that
shouldn't be necessary to use in the general case.
The largest changes come from the removal of the signture from
ref-modifying functions/methods and the removal of the reflog string in
all but those directly related to moving references.
The option to ignore the server's certificate has been removed, replaced
witha callback for the user to perform their own checking.
Remote.Fetch() now performs opportunistic updates and takes a list of
refspecs to use as the active set for a particular fetch.
lhchavez
Suhaib Mujahid
Carlos Martín Nieto
Carlos Martín Nieto
Han-Wen Nienhuys
Calin Seciu
David Calavera