mirror/guix
1
0
Fork 0
mirror of https://git.savannah.gnu.org/git/guix.git synced 2025-01-24 11:16:38 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

gnu: libgit2: Update to 1.5.1 [security fixes].

Browse source 
Fixes CVE-2023-22742. Follows up on fixes to CVE-2022-24765.
Provides compatibility with git changes to address CVE-2022-29187.

* gnu/packages/version-control.scm (libgit2): Update to 1.5.1.
[source]: Remove snippet to comment out the "10 years ago" test, which
was removed on newer versions.
(libgit2-1.4): New variable. Update to 1.4.5.
(libgit2-1.3): Inherit from 'libgit2-1.4'. Update to 1.3.2.

Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
This commit is contained in:
André Batista 2023-02-17 16:07:10 -03:00 committed by Maxim Cournoyer
parent 7b4b271378
commit 8d8e1438ae
No known key found for this signature in database
GPG key ID: 1260E46482E63562
1 changed files with 21 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
gnu/packages/version-control.scm
View file

@ -804,7 +804,7 @@ (define-public git-cal
(define-public libgit2 (define-public libgit2
(package (package
(name "libgit2") (name "libgit2")
(version "1.4.3") (version "1.5.1")
(source (origin (source (origin
;; Since v1.1.1, release artifacts are no longer offered (see: ;; Since v1.1.1, release artifacts are no longer offered (see:
;; https://github.com/libgit2/libgit2/discussions/5932#discussioncomment-1682729). ;; https://github.com/libgit2/libgit2/discussions/5932#discussioncomment-1682729).
@ -815,18 +815,11 @@ (define-public libgit2
(file-name (git-file-name name version)) (file-name (git-file-name name version))
(sha256 (sha256
(base32 (base32
"02x1a4zrzpzjd0yxnsi8njh5hgihc1iy1v4r0fnl8m4ckcgp6x2s")) "04ypzpicpgq1wh6anwcmjjyh2b854lvjhxq0hq2hbsx7kb14qc1b"))
(modules '((guix build utils))) (modules '((guix build utils)))
(snippet (snippet
'(begin '(begin
(delete-file-recursively "deps") (delete-file-recursively "deps")))))
;; The "refs:revparse::date" test is time-dependent: it
;; assumes "HEAD@{10 years ago}" matches a specific commit.
;; See <https://github.com/libgit2/libgit2/pull/6299>.
(substitute* "tests/refs/revparse.c"
(("test_object.*10 years ago.*" all)
(string-append "// " all "\n")))))))
(build-system cmake-build-system) (build-system cmake-build-system)
(outputs '("out" "debug")) (outputs '("out" "debug"))
(arguments (arguments
@ -868,10 +861,10 @@ (define-public libgit2
;; GPLv2 with linking exception ;; GPLv2 with linking exception
(license license:gpl2))) (license license:gpl2)))
(define-public libgit2-1.3 (define-public libgit2-1.4
(package (package
(inherit libgit2) (inherit libgit2)
(version "1.3.0") (version "1.4.5")
(source (origin (source (origin
(inherit (package-source libgit2)) (inherit (package-source libgit2))
(method git-fetch) (method git-fetch)
@ -881,7 +874,22 @@ (define-public libgit2-1.3
(file-name (git-file-name "libgit2" version)) (file-name (git-file-name "libgit2" version))
(sha256 (sha256
(base32 (base32
"0vgpb2175a5dhqiy1iwywwppahgqhi340i8bsvafjpvkw284vazd")))) "0q754ipc6skagszi93lcy6qr09ibavivm2q5i5fhpdblvlnv2p7x"))))))
(define-public libgit2-1.3
(package
(inherit libgit2-1.4)
(version "1.3.2")
(source (origin
(inherit (package-source libgit2-1.4))
(method git-fetch)
(uri (git-reference
(url "https://github.com/libgit2/libgit2")
(commit (string-append "v" version))))
(file-name (git-file-name "libgit2" version))
(sha256
(base32
"1dngga8jq419z6ps65wpmh2jihcf70k6r98pb1m1yiwj7qqh9792"))))
(arguments (arguments
(substitute-keyword-arguments (package-arguments libgit2) (substitute-keyword-arguments (package-arguments libgit2)
((#:phases _ '%standard-phases) ((#:phases _ '%standard-phases)