Fri Jan 13 20:34:41 2017 UTC ()
Pullup ticket #5191 - requested by taca
devel/libgit2: security fix

Revisions pulled up:
- devel/libgit2/Makefile                                        1.14-1.16
- devel/libgit2/PLIST                                           1.6
- devel/libgit2/distinfo                                        1.8

---
   Module Name:	pkgsrc
   Committed By:	wiz
   Date:		Sun Jan  1 14:44:09 UTC 2017

   Modified Files:
   	[...]
   	pkgsrc/devel/libgit2: Makefile
   	[...]

   Log Message:
   Add python-3.6 to incompatible versions.

---
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Sun Jan  1 16:06:40 UTC 2017

   Modified Files:
   	[...]
   	pkgsrc/devel/libgit2: Makefile
   	[...]

   Log Message:
   Revbump after boost update

---
   Module Name:	pkgsrc
   Committed By:	taca
   Date:		Wed Jan 11 00:11:24 UTC 2017

   Modified Files:
   	pkgsrc/devel/libgit2: Makefile PLIST distinfo

   Log Message:
   Update libgit2 to 0.25.1, it includes security problem.

   For full changes, please refer CHANGESLOG.md file.

   * libgit2 v0.24.6 and libgit2 v0.25.1, January 9th, 2017

   Includes two fixes, one performs extra sanitization for some edge cases in
   the Git Smart Protocol which can lead to attempting to parse outside of the
   buffer.

   The second fix affects the certificate check callback. It provides a valid
   parameter to indicate whether the native cryptographic library considered
   the certificate to be correct. This parameter is always 1/true before these
   releases leading to a possible MITM.

   This does not affect you if you do not use the custom certificate callback
   or if you do not take this value into account. This does affect you if you
   use pygit2 or git2go regardless of whether you specify a certificate check
   callback.


(bsiegert)
diff -r1.13 -r1.13.2.1 pkgsrc/devel/libgit2/Makefile
diff -r1.5 -r1.5.4.1 pkgsrc/devel/libgit2/PLIST
diff -r1.7 -r1.7.4.1 pkgsrc/devel/libgit2/distinfo
cvs diff -r1.13 -r1.13.2.1 pkgsrc/devel/libgit2/Makefile (expand / switch to unified diff)

--- pkgsrc/devel/libgit2/Makefile 2016/10/07 18:25:43 1.13
+++ pkgsrc/devel/libgit2/Makefile 2017/01/13 20:34:41 1.13.2.1
@@ -1,27 +1,26 @@ @@ -1,27 +1,26 @@
1# $NetBSD: Makefile,v 1.13 2016/10/07 18:25:43 adam Exp $ 1# $NetBSD: Makefile,v 1.13.2.1 2017/01/13 20:34:41 bsiegert Exp $
2 2
3DISTNAME= libgit2-0.24.1 3DISTNAME= libgit2-0.25.1
4PKGREVISION= 1 
5CATEGORIES= devel 4CATEGORIES= devel
6MASTER_SITES= ${MASTER_SITE_GITHUB:=libgit2/} 5MASTER_SITES= ${MASTER_SITE_GITHUB:=libgit2/}
7GITHUB_TAG= v${PKGVERSION_NOREV} 6GITHUB_TAG= v${PKGVERSION_NOREV}
8 7
9MAINTAINER= pkgsrc-users@NetBSD.org 8MAINTAINER= pkgsrc-users@NetBSD.org
10HOMEPAGE= https://libgit2.github.com/ 9HOMEPAGE= https://libgit2.github.com/
11COMMENT= Portable, pure C implementation of the Git core methods 10COMMENT= Portable, pure C implementation of the Git core methods
12LICENSE= gnu-gpl-v2 # linking exception (linking allowed in more ways) 11LICENSE= gnu-gpl-v2 # linking exception (linking allowed in more ways)
13 12
14EXTRACT_USING= bsdtar 13EXTRACT_USING= bsdtar
15USE_TOOLS+= pkg-config 14USE_TOOLS+= pkg-config
16USE_CMAKE= yes 15USE_CMAKE= yes
17 16
18PKGCONFIG_OVERRIDE+= libgit2.pc.in 17PKGCONFIG_OVERRIDE+= libgit2.pc.in
19PYTHON_VERSIONS_INCOMPATIBLE= 34 35 # not yet ported as of 0.21.1 18PYTHON_VERSIONS_INCOMPATIBLE= 34 35 36 # not yet ported as of 0.21.1
20 19
21.include "../../devel/zlib/buildlink3.mk" 20.include "../../devel/zlib/buildlink3.mk"
22.include "../../security/libssh2/buildlink3.mk" 21.include "../../security/libssh2/buildlink3.mk"
23.include "../../security/openssl/buildlink3.mk" 22.include "../../security/openssl/buildlink3.mk"
24.include "../../lang/python/pyversion.mk" 23.include "../../lang/python/pyversion.mk"
25.include "../../www/curl/buildlink3.mk" 24.include "../../www/curl/buildlink3.mk"
26.include "../../www/http-parser/buildlink3.mk" 25.include "../../www/http-parser/buildlink3.mk"
27.include "../../mk/bsd.pkg.mk" 26.include "../../mk/bsd.pkg.mk"
cvs diff -r1.5 -r1.5.4.1 pkgsrc/devel/libgit2/PLIST (expand / switch to unified diff)

--- pkgsrc/devel/libgit2/PLIST 2016/08/30 10:24:40 1.5
+++ pkgsrc/devel/libgit2/PLIST 2017/01/13 20:34:41 1.5.4.1
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1@comment $NetBSD: PLIST,v 1.5 2016/08/30 10:24:40 jperkin Exp $ 1@comment $NetBSD: PLIST,v 1.5.4.1 2017/01/13 20:34:41 bsiegert Exp $
2include/git2.h 2include/git2.h
3include/git2/annotated_commit.h 3include/git2/annotated_commit.h
4include/git2/attr.h 4include/git2/attr.h
5include/git2/blame.h 5include/git2/blame.h
6include/git2/blob.h 6include/git2/blob.h
7include/git2/branch.h 7include/git2/branch.h
8include/git2/buffer.h 8include/git2/buffer.h
9include/git2/checkout.h 9include/git2/checkout.h
10include/git2/cherrypick.h 10include/git2/cherrypick.h
11include/git2/clone.h 11include/git2/clone.h
12include/git2/commit.h 12include/git2/commit.h
13include/git2/common.h 13include/git2/common.h
14include/git2/config.h 14include/git2/config.h
@@ -25,56 +25,60 @@ include/git2/indexer.h @@ -25,56 +25,60 @@ include/git2/indexer.h
25include/git2/inttypes.h 25include/git2/inttypes.h
26include/git2/merge.h 26include/git2/merge.h
27include/git2/message.h 27include/git2/message.h
28include/git2/net.h 28include/git2/net.h
29include/git2/notes.h 29include/git2/notes.h
30include/git2/object.h 30include/git2/object.h
31include/git2/odb.h 31include/git2/odb.h
32include/git2/odb_backend.h 32include/git2/odb_backend.h
33include/git2/oid.h 33include/git2/oid.h
34include/git2/oidarray.h 34include/git2/oidarray.h
35include/git2/pack.h 35include/git2/pack.h
36include/git2/patch.h 36include/git2/patch.h
37include/git2/pathspec.h 37include/git2/pathspec.h
 38include/git2/proxy.h
38include/git2/rebase.h 39include/git2/rebase.h
39include/git2/refdb.h 40include/git2/refdb.h
40include/git2/reflog.h 41include/git2/reflog.h
41include/git2/refs.h 42include/git2/refs.h
42include/git2/refspec.h 43include/git2/refspec.h
43include/git2/remote.h 44include/git2/remote.h
44include/git2/repository.h 45include/git2/repository.h
45include/git2/reset.h 46include/git2/reset.h
46include/git2/revert.h 47include/git2/revert.h
47include/git2/revparse.h 48include/git2/revparse.h
48include/git2/revwalk.h 49include/git2/revwalk.h
49include/git2/signature.h 50include/git2/signature.h
50include/git2/stash.h 51include/git2/stash.h
51include/git2/status.h 52include/git2/status.h
52include/git2/stdint.h 53include/git2/stdint.h
53include/git2/strarray.h 54include/git2/strarray.h
54include/git2/submodule.h 55include/git2/submodule.h
55include/git2/sys/commit.h 56include/git2/sys/commit.h
56include/git2/sys/config.h 57include/git2/sys/config.h
57include/git2/sys/diff.h 58include/git2/sys/diff.h
58include/git2/sys/filter.h 59include/git2/sys/filter.h
59include/git2/sys/hashsig.h 60include/git2/sys/hashsig.h
60include/git2/sys/index.h 61include/git2/sys/index.h
61include/git2/sys/mempack.h 62include/git2/sys/mempack.h
 63include/git2/sys/merge.h
62include/git2/sys/odb_backend.h 64include/git2/sys/odb_backend.h
63include/git2/sys/openssl.h 65include/git2/sys/openssl.h
64include/git2/sys/refdb_backend.h 66include/git2/sys/refdb_backend.h
65include/git2/sys/reflog.h 67include/git2/sys/reflog.h
66include/git2/sys/refs.h 68include/git2/sys/refs.h
 69include/git2/sys/remote.h
67include/git2/sys/repository.h 70include/git2/sys/repository.h
68include/git2/sys/stream.h 71include/git2/sys/stream.h
 72include/git2/sys/time.h
69include/git2/sys/transport.h 73include/git2/sys/transport.h
70include/git2/tag.h 74include/git2/tag.h
71include/git2/trace.h 75include/git2/trace.h
72include/git2/transaction.h 76include/git2/transaction.h
73include/git2/transport.h 77include/git2/transport.h
74include/git2/tree.h 78include/git2/tree.h
75include/git2/types.h 79include/git2/types.h
76include/git2/version.h 80include/git2/version.h
77lib/libgit2.so 81lib/libgit2.so
78lib/libgit2.so.0.24.0 82lib/libgit2.so.0.25.1
79lib/libgit2.so.24 83lib/libgit2.so.25
80lib/pkgconfig/libgit2.pc 84lib/pkgconfig/libgit2.pc
cvs diff -r1.7 -r1.7.4.1 pkgsrc/devel/libgit2/distinfo (expand / switch to unified diff)

--- pkgsrc/devel/libgit2/distinfo 2016/08/30 10:24:40 1.7
+++ pkgsrc/devel/libgit2/distinfo 2017/01/13 20:34:41 1.7.4.1
@@ -1,6 +1,6 @@ @@ -1,6 +1,6 @@
1$NetBSD: distinfo,v 1.7 2016/08/30 10:24:40 jperkin Exp $ 1$NetBSD: distinfo,v 1.7.4.1 2017/01/13 20:34:41 bsiegert Exp $
2 2
3SHA1 (libgit2-0.24.1.tar.gz) = 198ac53d713c521d940951ab5d6b90b75b941918 3SHA1 (libgit2-0.25.1.tar.gz) = c65238d0e0a698b202a3a886d003228cac6dacc3
4RMD160 (libgit2-0.24.1.tar.gz) = c9c75373fedb66c1732d472dda05dfc4fe40d5fa 4RMD160 (libgit2-0.25.1.tar.gz) = a9f3315d22f79e1955761f156117105781aea442
5SHA512 (libgit2-0.24.1.tar.gz) = 7ad06cef694a293eb90569b042270425f1d012c1c9de8db595dd841942072110bc5342f0d9782479abbba355f5db170b9dad778e79dd23857003e9668cdc1e13 5SHA512 (libgit2-0.25.1.tar.gz) = bbd0d27c95406b548185ce02e2a9288a9dcb8c3b28476ba20f4f4917f6bd67f1ddee80de3054d30b79cdb9d973c3061a15ea7847c79bfa4e0c62e41d5195cb99
6Size (libgit2-0.24.1.tar.gz) = 4173317 bytes 6Size (libgit2-0.25.1.tar.gz) = 4252130 bytes