Compare commits
No commits in common. "c9s" and "c8" have entirely different histories.
2
.git-lfs.metadata
Normal file
2
.git-lfs.metadata
Normal file
@ -0,0 +1,2 @@
|
||||
e76897da8f89170b2e23db7723408a7bdd038ee8 SOURCES/git-lfs-v3.4.1.tar.gz
|
||||
8f640c97e9736385e8cad79c91c983de895d6053 SOURCES/manpages.tgz
|
||||
29
.gitignore
vendored
29
.gitignore
vendored
@ -1,27 +1,2 @@
|
||||
/git-lfs-2.2.1.tar.gz
|
||||
/git-lfs-2.3.4.tar.gz
|
||||
/git-lfs-2.4.0.tar.gz
|
||||
/git-lfs-2.4.1.tar.gz
|
||||
/git-lfs-2.4.2.tar.gz
|
||||
/git-lfs-2.5.0.tar.gz
|
||||
/git-lfs-2.5.1.tar.gz
|
||||
/git-lfs-2.5.2.tar.gz
|
||||
/git-lfs-2.6.1.tar.gz
|
||||
/git-lfs-2.7.0.tar.gz
|
||||
/git-lfs-2.7.1.tar.gz
|
||||
/git-lfs-2.7.2.tar.gz
|
||||
/git-lfs-v2.8.0.tar.gz
|
||||
/git-lfs-v2.9.0.tar.gz
|
||||
/git-lfs-v2.9.2.tar.gz
|
||||
/git-lfs-v2.10.0.tar.gz
|
||||
/git-lfs-v2.11.0.tar.gz
|
||||
/git-lfs-v2.12.0.tar.gz
|
||||
/git-lfs-v2.12.1.tar.gz
|
||||
/git-lfs-v2.13.0.tar.gz
|
||||
/git-lfs-2.13.3.tar.gz
|
||||
/git-lfs-v2.13.3.tar.gz
|
||||
/git-lfs-v3.3.0.tar.gz
|
||||
/git-lfs-v3.2.0.tar.gz
|
||||
/git-lfs-v3.4.1.tar.gz
|
||||
/git-lfs-v3.6.0.tar.gz
|
||||
/git-lfs-v3.6.1.tar.gz
|
||||
SOURCES/git-lfs-v3.4.1.tar.gz
|
||||
SOURCES/manpages.tgz
|
||||
|
||||
@ -1,25 +0,0 @@
|
||||
From a119ca768dfeefef7609b55acbf6400fafb0ee5a Mon Sep 17 00:00:00 2001
|
||||
From: "brian m. carlson" <bk2204@github.com>
|
||||
Date: Mon, 25 Jul 2022 17:29:34 +0000
|
||||
Subject: [PATCH] t: set init.defaultBranch
|
||||
|
||||
Previously, we used a template to set the default HEAD ref to "main" so
|
||||
that our branch would be correct. It appears that Git has changed
|
||||
things so that that no longer works, so set init.defaultBranch as well
|
||||
to make sure we initialize new repositories properly.
|
||||
---
|
||||
t/testhelpers.sh | 1 +
|
||||
1 file changed, 1 insertion(+)
|
||||
|
||||
diff --git a/t/testhelpers.sh b/t/testhelpers.sh
|
||||
index 7c921f43e8..ea5dc05c4f 100644
|
||||
--- a/t/testhelpers.sh
|
||||
+++ b/t/testhelpers.sh
|
||||
@@ -607,6 +607,7 @@ setup() {
|
||||
git config --global http.$LFS_CLIENT_CERT_URL/.sslKey "$LFS_CLIENT_KEY_FILE"
|
||||
git config --global http.$LFS_CLIENT_CERT_URL/.sslCert "$LFS_CLIENT_CERT_FILE"
|
||||
git config --global http.$LFS_CLIENT_CERT_URL/.sslVerify "false"
|
||||
+ git config --global init.defaultBranch main
|
||||
fi | sed -e 's/^/# /g'
|
||||
|
||||
# setup the git credential password storage
|
||||
@ -1,11 +0,0 @@
|
||||
git-lfs on Fedora
|
||||
=================
|
||||
|
||||
By default, the package will run a post-install/post-uninstall task to
|
||||
enable/disable git-lfs filters in the system git configuration.
|
||||
|
||||
If you wish to enable/disable git-lfs manually, you can set the following
|
||||
option in the system git config, and package install/uninstall will no longer
|
||||
do this:
|
||||
|
||||
# git config --system 'fedora.git-lfs.no-modify-config' true
|
||||
15
SOURCES/gen-manpages.sh
Normal file
15
SOURCES/gen-manpages.sh
Normal file
@ -0,0 +1,15 @@
|
||||
# As `asciidoctor` package has not been packaged to RHEL 8:
|
||||
|
||||
# Pass package version(eg. `3.4.0`) as argument
|
||||
|
||||
VERSION=$1
|
||||
|
||||
cd git-lfs-$VERSION
|
||||
|
||||
make man GIT_LFS_SHA=unused VERSION=unused PREFIX=unused
|
||||
rm -r man/html
|
||||
|
||||
tar -czvf manpages.tgz man/*
|
||||
|
||||
cp manpages.tgz ../
|
||||
|
||||
358
SOURCES/git-lfs-3.4.1-cve-2024-53263.patch
Normal file
358
SOURCES/git-lfs-3.4.1-cve-2024-53263.patch
Normal file
@ -0,0 +1,358 @@
|
||||
diff -urN b/creds/creds.go a/creds/creds.go
|
||||
--- b/creds/creds.go 2023-12-13 19:56:25.000000000 +0100
|
||||
+++ a/creds/creds.go 2025-01-17 08:55:10.175959181 +0100
|
||||
@@ -53,11 +53,20 @@
|
||||
// as input.
|
||||
type Creds map[string][]string
|
||||
|
||||
-func bufferCreds(c Creds) *bytes.Buffer {
|
||||
+func (c Creds) buffer(protectProtocol bool) (*bytes.Buffer, error) {
|
||||
buf := new(bytes.Buffer)
|
||||
|
||||
for k, v := range c {
|
||||
for _, item := range v {
|
||||
+ if strings.Contains(item, "\n") {
|
||||
+ return nil, errors.Errorf(tr.Tr.Get("credential value for %s contains newline: %q", k, item))
|
||||
+ }
|
||||
+ if protectProtocol && strings.Contains(item, "\r") {
|
||||
+ return nil, errors.Errorf(tr.Tr.Get("credential value for %s contains carriage return: %q\nIf this is intended, set `credential.protectProtocol=false`", k, item))
|
||||
+ }
|
||||
+ if strings.Contains(item, string(rune(0))) {
|
||||
+ return nil, errors.Errorf(tr.Tr.Get("credential value for %s contains null byte: %q", k, item))
|
||||
+ }
|
||||
buf.Write([]byte(k))
|
||||
buf.Write([]byte("="))
|
||||
buf.Write([]byte(item))
|
||||
@@ -65,7 +74,7 @@
|
||||
}
|
||||
}
|
||||
|
||||
- return buf
|
||||
+ return buf, nil
|
||||
}
|
||||
|
||||
type CredentialHelperContext struct {
|
||||
@@ -153,6 +162,9 @@
|
||||
helpers = append(helpers, ctxt.askpassCredHelper)
|
||||
}
|
||||
}
|
||||
+
|
||||
+ ctxt.commandCredHelper.protectProtocol = ctxt.urlConfig.Bool("credential", rawurl, "protectProtocol", true)
|
||||
+
|
||||
return CredentialHelperWrapper{CredentialHelper: NewCredentialHelpers(append(helpers, ctxt.commandCredHelper)), Input: input, Url: u}
|
||||
}
|
||||
|
||||
@@ -292,7 +304,8 @@
|
||||
}
|
||||
|
||||
type commandCredentialHelper struct {
|
||||
- SkipPrompt bool
|
||||
+ SkipPrompt bool
|
||||
+ protectProtocol bool
|
||||
}
|
||||
|
||||
func (h *commandCredentialHelper) Fill(creds Creds) (Creds, error) {
|
||||
@@ -323,7 +336,10 @@
|
||||
if err != nil {
|
||||
return nil, errors.New(tr.Tr.Get("failed to find `git credential %s`: %v", subcommand, err))
|
||||
}
|
||||
- cmd.Stdin = bufferCreds(input)
|
||||
+ cmd.Stdin, err = input.buffer(h.protectProtocol)
|
||||
+ if err != nil {
|
||||
+ return nil, errors.New(tr.Tr.Get("invalid input to `git credential %s`: %v", subcommand, err))
|
||||
+ }
|
||||
cmd.Stdout = output
|
||||
/*
|
||||
There is a reason we don't read from stderr here:
|
||||
diff -urN b/creds/creds_test.go a/creds/creds_test.go
|
||||
--- b/creds/creds_test.go 2023-12-13 19:56:25.000000000 +0100
|
||||
+++ a/creds/creds_test.go 2025-01-17 08:55:21.318023782 +0100
|
||||
@@ -1,12 +1,89 @@
|
||||
package creds
|
||||
|
||||
import (
|
||||
+ "bytes"
|
||||
"errors"
|
||||
+ "slices"
|
||||
+ "strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
|
||||
+func assertCredsLinesMatch(t *testing.T, expected []string, buf *bytes.Buffer) {
|
||||
+ actual := strings.SplitAfter(buf.String(), "\n")
|
||||
+
|
||||
+ slices.Sort(expected)
|
||||
+ slices.Sort(actual)
|
||||
+
|
||||
+ assert.Equal(t, expected, actual)
|
||||
+}
|
||||
+func TestCredsBufferFormat(t *testing.T) {
|
||||
+ creds := make(Creds)
|
||||
+
|
||||
+ expected := []string{""}
|
||||
+
|
||||
+ buf, err := creds.buffer(true)
|
||||
+ assert.NoError(t, err)
|
||||
+ assertCredsLinesMatch(t, expected, buf)
|
||||
+
|
||||
+ creds["protocol"] = []string{"https"}
|
||||
+ creds["host"] = []string{"example.com"}
|
||||
+
|
||||
+ expected = []string{"host=example.com\n", "protocol=https\n", ""}
|
||||
+
|
||||
+ buf, err = creds.buffer(true)
|
||||
+ assert.NoError(t, err)
|
||||
+ assertCredsLinesMatch(t, expected, buf)
|
||||
+
|
||||
+ creds["wwwauth[]"] = []string{"Basic realm=test", "Negotiate"}
|
||||
+
|
||||
+ expected = append(expected, "wwwauth[]=Basic realm=test\n", "wwwauth[]=Negotiate\n")
|
||||
+ buf, err = creds.buffer(true)
|
||||
+ assert.NoError(t, err)
|
||||
+ assertCredsLinesMatch(t, expected, buf)
|
||||
+}
|
||||
+
|
||||
+func TestCredsBufferProtect(t *testing.T) {
|
||||
+ creds := make(Creds)
|
||||
+
|
||||
+ // Always disallow LF characters
|
||||
+ creds["protocol"] = []string{"https"}
|
||||
+ creds["host"] = []string{"one.example.com\nhost=two.example.com"}
|
||||
+
|
||||
+ buf, err := creds.buffer(false)
|
||||
+ assert.Error(t, err)
|
||||
+ assert.Nil(t, buf)
|
||||
+
|
||||
+ buf, err = creds.buffer(true)
|
||||
+ assert.Error(t, err)
|
||||
+ assert.Nil(t, buf)
|
||||
+
|
||||
+ // Disallow CR characters unless protocol protection disabled
|
||||
+ creds["host"] = []string{"one.example.com\rhost=two.example.com"}
|
||||
+
|
||||
+ expected := []string{"", "protocol=https\n", "host=one.example.com\rhost=two.example.com\n"}
|
||||
+
|
||||
+ buf, err = creds.buffer(false)
|
||||
+ assert.NoError(t, err)
|
||||
+ assertCredsLinesMatch(t, expected, buf)
|
||||
+
|
||||
+ buf, err = creds.buffer(true)
|
||||
+ assert.Error(t, err)
|
||||
+ assert.Nil(t, buf)
|
||||
+
|
||||
+ // Always disallow null bytes
|
||||
+ creds["host"] = []string{"one.example.com\x00host=two.example.com"}
|
||||
+
|
||||
+ buf, err = creds.buffer(false)
|
||||
+ assert.Error(t, err)
|
||||
+ assert.Nil(t, buf)
|
||||
+
|
||||
+ buf, err = creds.buffer(true)
|
||||
+ assert.Error(t, err)
|
||||
+ assert.Nil(t, buf)
|
||||
+}
|
||||
+
|
||||
type testCredHelper struct {
|
||||
fillErr error
|
||||
approveErr error
|
||||
diff -urN b/t/cmd/lfstest-gitserver.go a/t/cmd/lfstest-gitserver.go
|
||||
--- b/t/cmd/lfstest-gitserver.go 2023-12-13 19:56:25.000000000 +0100
|
||||
+++ a/t/cmd/lfstest-gitserver.go 2025-01-16 14:33:23.825991696 +0100
|
||||
@@ -27,6 +27,7 @@
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/textproto"
|
||||
+ "net/url"
|
||||
"os"
|
||||
"os/exec"
|
||||
"regexp"
|
||||
@@ -252,6 +253,7 @@
|
||||
}
|
||||
|
||||
func lfsUrl(repo, oid string, redirect bool) string {
|
||||
+ repo = url.QueryEscape(repo)
|
||||
if redirect {
|
||||
return server.URL + "/redirect307/objects/" + oid + "?r=" + repo
|
||||
}
|
||||
diff -urN b/t/t-credentials-protect.sh a/t/t-credentials-protect.sh
|
||||
--- b/t/t-credentials-protect.sh 1970-01-01 01:00:00.000000000 +0100
|
||||
+++ a/t/t-credentials-protect.sh 2025-01-16 14:03:23.597029590 +0100
|
||||
@@ -0,0 +1,146 @@
|
||||
+#!/usr/bin/env bash
|
||||
+
|
||||
+. "$(dirname "$0")/testlib.sh"
|
||||
+
|
||||
+ensure_git_version_isnt $VERSION_LOWER "2.3.0"
|
||||
+
|
||||
+export CREDSDIR="$REMOTEDIR/creds-credentials-protect"
|
||||
+setup_creds
|
||||
+
|
||||
+# Copy the default record file for the test credential helper to match the
|
||||
+# hostname used in the Git LFS configurations of the tests.
|
||||
+cp "$CREDSDIR/127.0.0.1" "$CREDSDIR/localhost"
|
||||
+
|
||||
+begin_test "credentials rejected with line feed"
|
||||
+(
|
||||
+ set -e
|
||||
+
|
||||
+ reponame="protect-linefeed"
|
||||
+ setup_remote_repo "$reponame"
|
||||
+ clone_repo "$reponame" "$reponame"
|
||||
+
|
||||
+ contents="a"
|
||||
+ contents_oid=$(calc_oid "$contents")
|
||||
+
|
||||
+ git lfs track "*.dat"
|
||||
+ printf "%s" "$contents" >a.dat
|
||||
+ git add .gitattributes a.dat
|
||||
+ git commit -m "add a.dat"
|
||||
+
|
||||
+ # Using localhost instead of 127.0.0.1 in the LFS API URL ensures this URL
|
||||
+ # is used when filling credentials rather than the Git remote URL, which
|
||||
+ # would otherwise be used since it would have the same scheme and hostname.
|
||||
+ gitserver="$(echo "$GITSERVER" | sed 's/127\.0\.0\.1/localhost/')"
|
||||
+ testreponame="test%0a$reponame"
|
||||
+ git config lfs.url "$gitserver/$testreponame.git/info/lfs"
|
||||
+
|
||||
+ GIT_TRACE=1 git lfs push origin main 2>&1 | tee push.log
|
||||
+ if [ "0" -eq "${PIPESTATUS[0]}" ]; then
|
||||
+ echo >&2 "fatal: expected 'git lfs push' to fail ..."
|
||||
+ exit 1
|
||||
+ fi
|
||||
+ grep "batch response: Git credentials for $gitserver.* not found" push.log
|
||||
+ grep "credential value for path contains newline" push.log
|
||||
+ refute_server_object "$testreponame" "$contents_oid"
|
||||
+
|
||||
+ git config credential.protectProtocol false
|
||||
+
|
||||
+ GIT_TRACE=1 git lfs push origin main 2>&1 | tee push.log
|
||||
+ if [ "0" -eq "${PIPESTATUS[0]}" ]; then
|
||||
+ echo >&2 "fatal: expected 'git lfs push' to fail ..."
|
||||
+ exit 1
|
||||
+ fi
|
||||
+ grep "batch response: Git credentials for $gitserver.* not found" push.log
|
||||
+ grep "credential value for path contains newline" push.log
|
||||
+ refute_server_object "$testreponame" "$contents_oid"
|
||||
+)
|
||||
+end_test
|
||||
+
|
||||
+begin_test "credentials rejected with carriage return"
|
||||
+(
|
||||
+ set -e
|
||||
+
|
||||
+ reponame="protect-return"
|
||||
+ setup_remote_repo "$reponame"
|
||||
+ clone_repo "$reponame" "$reponame"
|
||||
+
|
||||
+ contents="a"
|
||||
+ contents_oid=$(calc_oid "$contents")
|
||||
+
|
||||
+ git lfs track "*.dat"
|
||||
+ printf "%s" "$contents" >a.dat
|
||||
+ git add .gitattributes a.dat
|
||||
+ git commit -m "add a.dat"
|
||||
+
|
||||
+ # Using localhost instead of 127.0.0.1 in the LFS API URL ensures this URL
|
||||
+ # is used when filling credentials rather than the Git remote URL, which
|
||||
+ # would otherwise be used since it would have the same scheme and hostname.
|
||||
+ gitserver="$(echo "$GITSERVER" | sed 's/127\.0\.0\.1/localhost/')"
|
||||
+ testreponame="test%0d$reponame"
|
||||
+ git config lfs.url "$gitserver/$testreponame.git/info/lfs"
|
||||
+
|
||||
+ GIT_TRACE=1 git lfs push origin main 2>&1 | tee push.log
|
||||
+ if [ "0" -eq "${PIPESTATUS[0]}" ]; then
|
||||
+ echo >&2 "fatal: expected 'git lfs push' to fail ..."
|
||||
+ exit 1
|
||||
+ fi
|
||||
+ grep "batch response: Git credentials for $gitserver.* not found" push.log
|
||||
+ grep "credential value for path contains carriage return" push.log
|
||||
+ refute_server_object "$testreponame" "$contents_oid"
|
||||
+
|
||||
+ git config credential.protectProtocol false
|
||||
+
|
||||
+ git lfs push origin main 2>&1 | tee push.log
|
||||
+ if [ "0" -ne "${PIPESTATUS[0]}" ]; then
|
||||
+ echo >&2 "fatal: expected 'git lfs push' to succeed ..."
|
||||
+ exit 1
|
||||
+ fi
|
||||
+ [ $(grep -c "Uploading LFS objects: 100% (1/1)" push.log) -eq 1 ]
|
||||
+ assert_server_object "$testreponame" "$contents_oid"
|
||||
+)
|
||||
+end_test
|
||||
+
|
||||
+begin_test "credentials rejected with null byte"
|
||||
+(
|
||||
+ set -e
|
||||
+
|
||||
+ reponame="protect-null"
|
||||
+ setup_remote_repo "$reponame"
|
||||
+ clone_repo "$reponame" "$reponame"
|
||||
+
|
||||
+ contents="a"
|
||||
+ contents_oid=$(calc_oid "$contents")
|
||||
+
|
||||
+ git lfs track "*.dat"
|
||||
+ printf "%s" "$contents" >a.dat
|
||||
+ git add .gitattributes a.dat
|
||||
+ git commit -m "add a.dat"
|
||||
+
|
||||
+ # Using localhost instead of 127.0.0.1 in the LFS API URL ensures this URL
|
||||
+ # is used when filling credentials rather than the Git remote URL, which
|
||||
+ # would otherwise be used since it would have the same scheme and hostname.
|
||||
+ gitserver="$(echo "$GITSERVER" | sed 's/127\.0\.0\.1/localhost/')"
|
||||
+ testreponame="test%00$reponame"
|
||||
+ git config lfs.url "$gitserver/$testreponame.git/info/lfs"
|
||||
+
|
||||
+ GIT_TRACE=1 git lfs push origin main 2>&1 | tee push.log
|
||||
+ if [ "0" -eq "${PIPESTATUS[0]}" ]; then
|
||||
+ echo >&2 "fatal: expected 'git lfs push' to fail ..."
|
||||
+ exit 1
|
||||
+ fi
|
||||
+ grep "batch response: Git credentials for $gitserver.* not found" push.log
|
||||
+ grep "credential value for path contains null byte" push.log
|
||||
+ refute_server_object "$testreponame" "$contents_oid"
|
||||
+
|
||||
+ git config credential.protectProtocol false
|
||||
+
|
||||
+ GIT_TRACE=1 git lfs push origin main 2>&1 | tee push.log
|
||||
+ if [ "0" -eq "${PIPESTATUS[0]}" ]; then
|
||||
+ echo >&2 "fatal: expected 'git lfs push' to fail ..."
|
||||
+ exit 1
|
||||
+ fi
|
||||
+ grep "batch response: Git credentials for $gitserver.* not found" push.log
|
||||
+ grep "credential value for path contains null byte" push.log
|
||||
+ refute_server_object "$testreponame" "$contents_oid"
|
||||
+)
|
||||
+end_test
|
||||
diff -urN b/t/testhelpers.sh a/t/testhelpers.sh
|
||||
--- b/t/testhelpers.sh 2023-12-13 19:56:25.000000000 +0100
|
||||
+++ a/t/testhelpers.sh 2025-01-16 14:15:19.240279305 +0100
|
||||
@@ -557,6 +557,14 @@
|
||||
fi
|
||||
}
|
||||
|
||||
+
|
||||
+setup_creds() {
|
||||
+ mkdir -p "$CREDSDIR"
|
||||
+ write_creds_file "user:pass" "$CREDSDIR/127.0.0.1"
|
||||
+ write_creds_file ":pass" "$CREDSDIR/--$certpath"
|
||||
+ write_creds_file ":pass" "$CREDSDIR/--$keypath"
|
||||
+}
|
||||
+
|
||||
# setup initializes the clean, isolated environment for integration tests.
|
||||
setup() {
|
||||
cd "$ROOTDIR"
|
||||
@@ -613,10 +621,7 @@
|
||||
# setup the git credential password storage
|
||||
local certpath="$(echo "$LFS_CLIENT_CERT_FILE" | tr / -)"
|
||||
local keypath="$(echo "$LFS_CLIENT_KEY_FILE_ENCRYPTED" | tr / -)"
|
||||
- mkdir -p "$CREDSDIR"
|
||||
- write_creds_file "user:pass" "$CREDSDIR/127.0.0.1"
|
||||
- write_creds_file ":pass" "$CREDSDIR/--$certpath"
|
||||
- write_creds_file ":pass" "$CREDSDIR/--$keypath"
|
||||
+ setup_creds
|
||||
|
||||
echo "#"
|
||||
echo "# HOME: $HOME"
|
||||
@ -1,22 +1,39 @@
|
||||
# Build man pages
|
||||
%global with_manpages 1
|
||||
|
||||
%bcond_without check
|
||||
|
||||
# https://github.com/git-lfs/git-lfs
|
||||
%global goipath github.com/git-lfs/git-lfs/v3
|
||||
Version: 3.6.1
|
||||
%global goipath github.com/git-lfs/git-lfs
|
||||
Version: 3.4.1
|
||||
|
||||
# golang doesn't ship i686 binaries, we don't need the build
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1752991#c9
|
||||
%global golang_arches %(echo %{golang_arches} | sed "s|%{ix86}||")
|
||||
%gometa
|
||||
|
||||
%global gobuilddir %{_builddir}/%{name}-%{version}/_build
|
||||
|
||||
# define gobuild macro to not lose hardening, because of macro conflict
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1919348
|
||||
%global gobuild CGO_CPPFLAGS="-D_FORTIFY_SOURCE=2 -fstack-protector-all" go build -compiler gc -buildmode pie '-tags=rpm_crashtraceback libtrust_openssl ' -ldflags "-linkmode=external -compressdwarf=false ${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -An -tx1|tr -d ' \\n') -extldflags '%__global_ldflags'" -a -v -x %{?**}
|
||||
|
||||
Name: git-lfs
|
||||
Release: 2%{?dist}
|
||||
Release: 5%{?dist}
|
||||
Summary: Git extension for versioning large files
|
||||
|
||||
License: MIT
|
||||
URL: https://git-lfs.github.io/
|
||||
Source0: https://github.com/%{name}/%{name}/releases/download/v%{version}/%{name}-v%{version}.tar.gz
|
||||
Source1: README.Fedora
|
||||
Source1: manpages.tgz
|
||||
# See this script. Generating of manpages is performed on other distros due to some missing rubygem-asciidoctor on RHEL-8
|
||||
Source2: gen-manpages.sh
|
||||
|
||||
# https://github.com/advisories/GHSA-q6r2-x2cc-vrp7
|
||||
# Backports 268628b, 4423696, 0345b6f and f6904cc that resolves the CVE-2024-53263
|
||||
# Aditionally backports b326b63
|
||||
# Commits had to be adapted as git-lfs-3.4.1 doesn't support multistage authentication
|
||||
Patch: git-lfs-3.4.1-cve-2024-53263.patch
|
||||
|
||||
# Generated provides by vendor2provides.py
|
||||
# https://src.fedoraproject.org/rpms/syncthing/blob/603e4e03a92a7d704d199629dd85304018e8279d/f/vendor2provides.py
|
||||
@ -29,40 +46,36 @@ Provides: bundled(golang(github.com/git-lfs/go-netrc)) = f0c862d
|
||||
Provides: bundled(golang(github.com/git-lfs/pktline)) = 06e9096
|
||||
Provides: bundled(golang(github.com/git-lfs/wildmatch/v2)) = 2.0.1
|
||||
Provides: bundled(golang(github.com/hashicorp/go-uuid)) = 1.0.2
|
||||
Provides: bundled(golang(github.com/inconshreveable/mousetrap)) = 1.1.0
|
||||
Provides: bundled(golang(github.com/inconshreveable/mousetrap)) = 1.0.1
|
||||
Provides: bundled(golang(github.com/jcmturner/aescts/v2)) = 2.0.0
|
||||
Provides: bundled(golang(github.com/jcmturner/dnsutils/v2)) = 2.0.0
|
||||
Provides: bundled(golang(github.com/jcmturner/gofork)) = 1.0.0
|
||||
Provides: bundled(golang(github.com/jcmturner/goidentity/v6)) = 6.0.1
|
||||
Provides: bundled(golang(github.com/jcmturner/gokrb5/v8)) = 8.4.2
|
||||
Provides: bundled(golang(github.com/jcmturner/rpc/v2)) = 2.0.3
|
||||
Provides: bundled(golang(github.com/jmhodges/clock)) = 1.2.0
|
||||
Provides: bundled(golang(github.com/leonelquinteros/gotext)) = 1.5.0
|
||||
Provides: bundled(golang(github.com/mattn/go-isatty)) = 0.0.4
|
||||
Provides: bundled(golang(github.com/olekukonko/ts)) = 78ecb04
|
||||
Provides: bundled(golang(github.com/pkg/errors)) = c605e28
|
||||
Provides: bundled(golang(github.com/pmezard/go-difflib)) = 1.0.0
|
||||
Provides: bundled(golang(github.com/rubyist/tracerx)) = 7879593
|
||||
Provides: bundled(golang(github.com/spf13/cobra)) = 1.7.0
|
||||
Provides: bundled(golang(github.com/spf13/cobra)) = 1.6.0
|
||||
Provides: bundled(golang(github.com/spf13/pflag)) = 1.0.5
|
||||
Provides: bundled(golang(github.com/ssgelm/cookiejarparser)) = 1.0.1
|
||||
Provides: bundled(golang(github.com/stretchr/testify)) = 1.6.1
|
||||
Provides: bundled(golang(github.com/xeipuuv/gojsonpointer)) = 4e3ac27
|
||||
Provides: bundled(golang(github.com/xeipuuv/gojsonreference)) = bd5ef7b
|
||||
Provides: bundled(golang(github.com/xeipuuv/gojsonschema)) = 6b67b3f
|
||||
Provides: bundled(golang(golang.org/x/crypto)) = 0.21.0
|
||||
Provides: bundled(golang(golang.org/x/net)) = 0.23.0
|
||||
Provides: bundled(golang(golang.org/x/crypto)) = 7b82a4e
|
||||
Provides: bundled(golang(golang.org/x/net)) = 0.7.0
|
||||
Provides: bundled(golang(golang.org/x/sync)) = 0.1.0
|
||||
Provides: bundled(golang(golang.org/x/sys)) = 0.18.0
|
||||
Provides: bundled(golang(golang.org/x/text)) = 0.14.0
|
||||
Provides: bundled(golang(golang.org/x/sys)) = 0.5.0
|
||||
Provides: bundled(golang(golang.org/x/text)) = 0.7.0
|
||||
Provides: bundled(golang(gopkg.in/yaml.v3)) = 3.0.1
|
||||
|
||||
|
||||
# Generate man pages
|
||||
BuildRequires: /usr/bin/asciidoctor
|
||||
|
||||
%if %{with check}
|
||||
# Tests
|
||||
%if 0%{?with_check}
|
||||
# For tests
|
||||
BuildRequires: perl-Digest-SHA
|
||||
BuildRequires: perl-Test-Harness
|
||||
# Tests require full git suite, but not generally needed.
|
||||
@ -84,6 +97,11 @@ install -m 0755 -vd %{gobuilddir}/bin
|
||||
install -m 0755 -vd "$(dirname %{gobuilddir}/src/%{goipath})"
|
||||
ln -fs "$(pwd)" "%{gobuilddir}/src/%{goipath}"
|
||||
|
||||
%if %{?with_manpages}
|
||||
# Unpack manpages generated by %%{SOURCE2}
|
||||
tar -xf %{SOURCE1}
|
||||
%endif
|
||||
|
||||
# Modify tests so that they expect binaries where we build them.
|
||||
sed -i -e 's!\.\./bin/!/%{gobuilddir}/bin/!g' t/Makefile
|
||||
sed -i -e 's!^BINPATH=.\+!BINPATH="%{gobuilddir}/bin"!g' t/testenv.sh
|
||||
@ -92,15 +110,13 @@ sed -i -e 's!^BINPATH=.\+!BINPATH="%{gobuilddir}/bin"!g' t/testenv.sh
|
||||
export GOPATH=%{gobuilddir}:%{gopath}
|
||||
export GO111MODULE=off
|
||||
|
||||
# Enable FIPS support at build time by enabling CGO and enforcing strict FIPS runtime
|
||||
export CGO_ENABLED=1
|
||||
export GOEXPERIMENT=strictfipsruntime
|
||||
|
||||
# Build manpages first (some embedding in the executable is done.)
|
||||
make man GIT_LFS_SHA=unused VERSION=unused PREFIX=unused
|
||||
pushd docs
|
||||
%gobuild -o %{gobuilddir}/bin/mangen man/mangen.go
|
||||
%{gobuilddir}/bin/mangen
|
||||
%gobuild -o mangen man/mangen.go
|
||||
./mangen
|
||||
# Removes unwanted source files
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1852842
|
||||
rm mangen man/mangen.go
|
||||
popd
|
||||
|
||||
%gobuild -o %{gobuilddir}/bin/git-lfs %{goipath}
|
||||
@ -113,17 +129,21 @@ done
|
||||
%gobuild -o "%{gobuilddir}/bin/git-lfs-test-server-api" t/git-lfs-test-server-api/*.go
|
||||
popd
|
||||
|
||||
# Remove man pages from docs so they don't get installed twice.
|
||||
rm -r docs/man
|
||||
|
||||
|
||||
%install
|
||||
# In Fedora this is done by using %%gopkginstall
|
||||
install -Dpm0755 %{gobuilddir}/bin/git-lfs %{buildroot}%{_bindir}/%{name}
|
||||
for section in 1 5 7; do
|
||||
install -d -p %{buildroot}%{_mandir}/man${section}/
|
||||
install -Dpm0644 man/man${section}/*.${section} %{buildroot}%{_mandir}/man${section}/
|
||||
done
|
||||
install -d -p %{buildroot}%{_mandir}/man1/
|
||||
install -Dpm0644 man/man1/*.1 %{buildroot}%{_mandir}/man1/
|
||||
install -d -p %{buildroot}%{_mandir}/man5/
|
||||
install -Dpm0644 man/man5/*.5 %{buildroot}%{_mandir}/man5/
|
||||
install -d -p %{buildroot}%{_mandir}/man7/
|
||||
install -Dpm0644 man/man7/*.7 %{buildroot}%{_mandir}/man7/
|
||||
|
||||
# Remove unwanted files from man folder
|
||||
# https://bugzilla.redhat.com/show_bug.cgi?id=1852842
|
||||
rm -r man/*
|
||||
|
||||
|
||||
%post
|
||||
%{_bindir}/%{name} install --system --skip-repo
|
||||
@ -137,7 +157,6 @@ exit 0
|
||||
|
||||
%if %{with check}
|
||||
%check
|
||||
%gocheck
|
||||
PATH=%{buildroot}%{_bindir}:%{gobuilddir}/bin:$PATH \
|
||||
# https://github.com/git-lfs/git-lfs/issues/5609
|
||||
# tests fails when running with low level of parallelism
|
||||
@ -156,140 +175,58 @@ PATH=%{buildroot}%{_bindir}:%{gobuilddir}/bin:$PATH \
|
||||
|
||||
|
||||
%changelog
|
||||
* Tue Jun 03 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.6.1-2
|
||||
* Tue Jun 10 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-5
|
||||
- Rebuild with new Golang
|
||||
- Resolves: RHEL-89304
|
||||
- Resolves: RHEL-89264
|
||||
|
||||
* Wed Jan 15 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.6.1-1
|
||||
- Update to 3.6.1
|
||||
- Resolves: RHEL-73940
|
||||
* Fri Jan 17 2025 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-4
|
||||
- Backport CVE-2024-53263 fixes
|
||||
- Resolves: RHEL-73931
|
||||
|
||||
* Thu Nov 28 2024 Ondřej Pohořelský <opohorel@redhat.com> - 3.6.0-1
|
||||
- Update to 3.6.0
|
||||
- Resolves: RHEL-63968, RHEL-61045, RHEL-47219, RHEL-43318, RHEL-35936, RHEL-2791
|
||||
|
||||
* Wed Aug 07 2024 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-3
|
||||
- Make Git-LFS FIPS compliant
|
||||
- Resolves: RHEL-53086
|
||||
|
||||
* Wed May 22 2024 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-2
|
||||
* Mon Sep 23 2024 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-3
|
||||
- Rebuild with new Golang
|
||||
- Resolves: RHEL-32571
|
||||
- Resolves: RHEL-57900
|
||||
|
||||
* Mon Dec 18 2023 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-1
|
||||
- Update to 3.4.1
|
||||
- Resolves: RHEL-17101
|
||||
* Mon Apr 22 2024 Ondřej Pohořelský <opohorel@redhat.com> - 3.4.1-2
|
||||
- Rebuild with new Golang
|
||||
- Resolves: RHEL-32543, RHEL-28377, RHEL-28399, RHEL-28423
|
||||
|
||||
* Thu Jan 05 2023 Ondřej Pohořelský <opohorel@redhat.com> - 3.2.0-1
|
||||
- Update to 3.2.0
|
||||
- Resolves: #2139383
|
||||
* Mon Dec 18 2023 Ondrej Pohorelsky <opohorel@redhat.com> - 3.4.1-1
|
||||
- Update to version 3.4.1
|
||||
- Resolves: RHEL-17102
|
||||
|
||||
* Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 2.13.3-4
|
||||
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
|
||||
Related: rhbz#1991688
|
||||
* Mon Jan 30 2023 Ondrej Pohorelsky <opohorel@redhat.com> - 3.2.0-2
|
||||
- Rebuild with Golang-1.19.4
|
||||
- Resolves: #2163744
|
||||
|
||||
* Tue Jun 22 2021 Mohan Boddu <mboddu@redhat.com> - 2.13.3-3
|
||||
- Rebuilt for RHEL 9 BETA for openssl 3.0
|
||||
Related: rhbz#1971065
|
||||
* Mon Jan 09 2023 Ondrej Pohorelsky <opohorel@redhat.com> - 3.2.0-1
|
||||
- Update to version 3.2.0
|
||||
- Resolves: #2139382
|
||||
|
||||
* Wed May 05 2021 Ondřej Pohořelský <opohorel@redhat.com> - 2.13.3-2
|
||||
- Fixed name of source tarball
|
||||
- Fixed date in the latest changelog entry
|
||||
- Related: #1952517
|
||||
* Mon Jan 17 2022 Ondrej Pohorelsky <opohorel@redhat.com> - 2.13.3-2
|
||||
- Define %%gobuild macro with proper ldflags
|
||||
- Related: rhbz#2021549
|
||||
|
||||
* Thu Apr 22 2021 Ondřej Pohořelský <opohorel@redhat.com> - 2.13.3-1
|
||||
- Update to latest version
|
||||
- Resolves: #1952517
|
||||
* Tue Nov 23 2021 Ondrej Pohorelsky <opohorel@redhat.com> - 2.13.3-1
|
||||
- Update to version 2.13.3
|
||||
- Fixed round brackets in Provides
|
||||
- Moved manpages.tgz to look-a-side cache
|
||||
- Resolves: rhbz#2021549, rhbz#1870080, rhbz#1866441
|
||||
|
||||
* Thu Apr 15 2021 Mohan Boddu <mboddu@redhat.com> - 2.13.0-2
|
||||
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
|
||||
* Wed Jul 1 2020 Ondrej Pohorelsky <opohorel@redhat.com> - 2.11.0-2
|
||||
- Removed mangen source file
|
||||
- Cleaned docs/man folder
|
||||
- Resolves: rhbz#1852842
|
||||
|
||||
* Wed Jan 06 2021 Ondřej Pohořelský <opohorel@redhat.com> - 2.13.0-1
|
||||
- Enable bundling
|
||||
- Update to latest version
|
||||
* Wed Jun 10 2020 Ondrej Pohorelsky <opohorel@redhat.com> - 2.11.0-1
|
||||
- Update to version 2.11.0
|
||||
- Resolves: rhbz#1783391
|
||||
|
||||
* Mon Nov 09 2020 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.12.1-1
|
||||
- Update to latest version (#1894780)
|
||||
* Thu Jul 19 2018 Sebastian Kisela <skisela@redhat.com> - 2.4.1-3
|
||||
- Add pregenerated manpages, due to missing dependency 'ronn' in rhel7.
|
||||
|
||||
* Thu Sep 03 2020 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.12.0-1
|
||||
- Update to latest version (#1874604)
|
||||
- Remove duplicate docs/man directory (#1852765)
|
||||
- Add an option to disable modifying the git filter config (#1768060)
|
||||
|
||||
* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.11.0-3
|
||||
- Second attempt - Rebuilt for
|
||||
https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.11.0-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
|
||||
|
||||
* Sun May 10 2020 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.11.0-1
|
||||
- Update to latest version
|
||||
|
||||
* Thu Feb 20 2020 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.10.0-1
|
||||
- Update to latest version
|
||||
|
||||
* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.2-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
|
||||
|
||||
* Tue Jan 07 2020 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.9.2-1
|
||||
- Update to latest version
|
||||
|
||||
* Wed Jan 01 2020 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.9.0-1
|
||||
- Update to latest version
|
||||
|
||||
* Fri Aug 30 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.8.0-4
|
||||
- Customize vendor information in version
|
||||
|
||||
* Fri Aug 30 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.8.0-3
|
||||
- Update to latest version
|
||||
|
||||
* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-3
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
|
||||
|
||||
* Wed Jul 10 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.7.2-2
|
||||
- Update to latest Go macros
|
||||
|
||||
* Wed Apr 24 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.7.2-1
|
||||
- Update to latest version
|
||||
|
||||
* Wed Feb 27 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.7.1-1
|
||||
- Update to latest version
|
||||
|
||||
* Thu Feb 21 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.7.0-1
|
||||
- Update to latest version
|
||||
|
||||
* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.1-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
|
||||
|
||||
* Tue Jan 15 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.6.1-1
|
||||
- Update to latest version
|
||||
|
||||
* Mon Jan 14 2019 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.5.2-4
|
||||
- Rebuilt for dependencies
|
||||
|
||||
* Tue Oct 23 2018 Nicolas Mailhot <nim@fedoraproject.org>
|
||||
- 2.5.2-3
|
||||
- redhat-rpm-config-123 triggers bugs in gosetup, remove it from Go spec files as it’s just an alias
|
||||
- https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/RWD5YATAYAFWKIDZBB7EB6N5DAO4ZKFM/
|
||||
|
||||
* Fri Oct 12 2018 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.5.2-2
|
||||
- rebuilt
|
||||
|
||||
* Wed Oct 10 2018 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.5.2-1
|
||||
- Update to latest version
|
||||
|
||||
* Tue Sep 04 2018 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.5.1-1
|
||||
- Update to latest version
|
||||
|
||||
* Mon Sep 03 2018 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.5.0-1
|
||||
- Update to 2.5.0
|
||||
|
||||
* Wed Aug 29 2018 Elliott Sales de Andrade <quantum.analyst@gmail.com> - 2.4.2-1
|
||||
- Update to 2.4.2
|
||||
|
||||
* Tue Jul 31 2018 Florian Weimer <fweimer@redhat.com> - 2.4.1-3
|
||||
- Rebuild with fixed binutils
|
||||
* Wed Jul 18 2018 Sebastian Kisela <skisela@redhat.com> - 2.4.1-2
|
||||
- Initial build for rh-git218-git-lfs-2.4.1
|
||||
|
||||
* Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.1-2
|
||||
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
|
||||
@ -1,6 +0,0 @@
|
||||
--- !Policy
|
||||
product_versions:
|
||||
- rhel-9
|
||||
decision_context: osci_compose_gate
|
||||
rules:
|
||||
- !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}
|
||||
Loading…
Reference in New Issue
Block a user