<pre style='margin:0'>
Chris Jones (cjones051073) pushed a commit to branch git-declare-port-tree-safe
in repository macports-base.
</pre>
<p><a href="https://github.com/macports/macports-base/commit/b1a64bf8aab333185f8b3542060574bc0d194836">https://github.com/macports/macports-base/commit/b1a64bf8aab333185f8b3542060574bc0d194836</a></p>
<pre style="white-space: pre; background: #F8F8F8"><span style='display:block; white-space:pre;color:#808000;'>commit b1a64bf8aab333185f8b3542060574bc0d194836
</span>Author: Chris Jones <cjones051073@icloud.com>
AuthorDate: Wed Apr 20 11:19:55 2022 +0100
<span style='display:block; white-space:pre;color:#404040;'> Declare git ports tree as a 'safe directory' to work around CVE-2022-24765
</span>---
src/macports1.0/macports.tcl | 44 ++++++++++++++++++++++++++++----------------
1 file changed, 28 insertions(+), 16 deletions(-)
<span style='display:block; white-space:pre;color:#808080;'>diff --git a/src/macports1.0/macports.tcl b/src/macports1.0/macports.tcl
</span><span style='display:block; white-space:pre;color:#808080;'>index b59f5d1d..14be366b 100644
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>--- a/src/macports1.0/macports.tcl
</span><span style='display:block; white-space:pre;background:#e0e0ff;'>+++ b/src/macports1.0/macports.tcl
</span><span style='display:block; white-space:pre;background:#e0e0e0;'>@@ -2611,22 +2611,34 @@ proc macports::GetVCSUpdateCmd portDir {
</span> }
# Git
<span style='display:block; white-space:pre;background:#ffe0e0;'>- if {![catch {macports::findBinary git} git] &&
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- ![catch {exec $git rev-parse --is-inside-work-tree}]
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- } then {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- if {![catch {exec $git config --local --get svn-remote.svn.url}]} {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # git-svn repository
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- return [list git-svn "$git svn rebase" $portDir]
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- }
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # regular git repository
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- set autostash ""
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- if {![catch {exec $git --version} git_version_string] && \
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- [regexp -nocase "git version (\[^ ]+)" $git_version_string -> gitversion] && \
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- [vercmp $gitversion 2.9.0] >= 0} {
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- # https://github.com/git/git/blob/v2.9.0/Documentation/RelNotes/2.9.0.txt#L84-L86
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- set autostash " --autostash"
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- }
</span><span style='display:block; white-space:pre;background:#ffe0e0;'>- return [list Git "$git pull --rebase${autostash}" $portDir]
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ if {![catch {macports::findBinary git} git] } {
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ # Get git version
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ set gitversion 0.0.0
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ if { ![catch {exec $git --version} git_version_string] } {
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ if { [regexp -nocase "git version (\[^ ]+)" $git_version_string -> gitversion] } {
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ ui_debug "Found GIT ${git} version ${gitversion}"
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ }
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ }
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ # https://github.blog/2022-04-12-git-security-vulnerability-announced/
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ # As of version 2.35.2 git will not access a git repo owned by someone else
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ # else it is declared as a 'safe directory'
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ if { [vercmp $gitversion 2.35.2] >= 0} {
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ exec $git config --global --add safe.directory $portDir
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ }
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ # check we are in a valid git tree
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ if { ![catch {exec $git rev-parse --is-inside-work-tree}] } {
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ if {![catch {exec $git config --local --get svn-remote.svn.url}]} {
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ # git-svn repository
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ return [list git-svn "$git svn rebase" $portDir]
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ }
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ # regular git repository
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ set autostash ""
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ if { [vercmp $gitversion 2.9.0] >= 0} {
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ # https://github.com/git/git/blob/v2.9.0/Documentation/RelNotes/2.9.0.txt#L84-L86
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ set autostash " --autostash"
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ }
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ return [list Git "$git pull --rebase${autostash}" $portDir]
</span><span style='display:block; white-space:pre;background:#e0ffe0;'>+ }
</span> }
# Add new VCSes here!
</pre><pre style='margin:0'>
</pre>