Compare commits

..

78 Commits

Author SHA1 Message Date
eb88fe1ff5 Git 2.37.6
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2023-02-06 09:38:32 +01:00
16004682f9 Sync with 2.36.5
* maint-2.36:
  Git 2.36.5
  Git 2.35.7
  Git 2.34.7
  http: support CURLOPT_PROTOCOLS_STR
  http: prefer CURLOPT_SEEKFUNCTION to CURLOPT_IOCTLFUNCTION
  http-push: prefer CURLOPT_UPLOAD to CURLOPT_PUT
  Git 2.33.7
  Git 2.32.6
  Git 2.31.7
  Git 2.30.8
  apply: fix writing behind newly created symbolic links
  dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS
  clone: delay picking a transport until after get_repo_path()
  t5619: demonstrate clone_local() with ambiguous transport
2023-02-06 09:38:31 +01:00
673472a963 Git 2.36.5
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2023-02-06 09:37:53 +01:00
40843216c5 Sync with 2.35.7
* maint-2.35:
  Git 2.35.7
  Git 2.34.7
  http: support CURLOPT_PROTOCOLS_STR
  http: prefer CURLOPT_SEEKFUNCTION to CURLOPT_IOCTLFUNCTION
  http-push: prefer CURLOPT_UPLOAD to CURLOPT_PUT
  Git 2.33.7
  Git 2.32.6
  Git 2.31.7
  Git 2.30.8
  apply: fix writing behind newly created symbolic links
  dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS
  clone: delay picking a transport until after get_repo_path()
  t5619: demonstrate clone_local() with ambiguous transport
2023-02-06 09:37:52 +01:00
b7a92d078b Git 2.35.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2023-02-06 09:29:45 +01:00
6a53a59bf9 Sync with 2.34.7
* maint-2.34:
  Git 2.34.7
  http: support CURLOPT_PROTOCOLS_STR
  http: prefer CURLOPT_SEEKFUNCTION to CURLOPT_IOCTLFUNCTION
  http-push: prefer CURLOPT_UPLOAD to CURLOPT_PUT
  Git 2.33.7
  Git 2.32.6
  Git 2.31.7
  Git 2.30.8
  apply: fix writing behind newly created symbolic links
  dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS
  clone: delay picking a transport until after get_repo_path()
  t5619: demonstrate clone_local() with ambiguous transport
2023-02-06 09:29:44 +01:00
91da4a29e1 Git 2.34.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2023-02-06 09:29:17 +01:00
a7237f5ae9 Sync with 2.33.7
* maint-2.33:
  Git 2.33.7
  Git 2.32.6
  Git 2.31.7
  Git 2.30.8
  apply: fix writing behind newly created symbolic links
  dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS
  clone: delay picking a transport until after get_repo_path()
  t5619: demonstrate clone_local() with ambiguous transport
2023-02-06 09:29:16 +01:00
bd6d3de01f Merge branch 'jk/curl-avoid-deprecated-api'
Deal with a few deprecation warning from cURL library.

* jk/curl-avoid-deprecated-api:
  http: support CURLOPT_PROTOCOLS_STR
  http: prefer CURLOPT_SEEKFUNCTION to CURLOPT_IOCTLFUNCTION
  http-push: prefer CURLOPT_UPLOAD to CURLOPT_PUT
2023-02-06 09:27:41 +01:00
f44e6a2105 http: support CURLOPT_PROTOCOLS_STR
The CURLOPT_PROTOCOLS (and matching CURLOPT_REDIR_PROTOCOLS) flag was
deprecated in curl 7.85.0, and using it generate compiler warnings as of
curl 7.87.0. The path forward is to use CURLOPT_PROTOCOLS_STR, but we
can't just do so unilaterally, as it was only introduced less than a
year ago in 7.85.0.

Until that version becomes ubiquitous, we have to either disable the
deprecation warning or conditionally use the "STR" variant on newer
versions of libcurl. This patch switches to the new variant, which is
nice for two reasons:

  - we don't have to worry that silencing curl's deprecation warnings
    might cause us to miss other more useful ones

  - we'd eventually want to move to the new variant anyway, so this gets
    us set up (albeit with some extra ugly boilerplate for the
    conditional)

There are a lot of ways to split up the two cases. One way would be to
abstract the storage type (strbuf versus a long), how to append
(strbuf_addstr vs bitwise OR), how to initialize, which CURLOPT to use,
and so on. But the resulting code looks pretty magical:

  GIT_CURL_PROTOCOL_TYPE allowed = GIT_CURL_PROTOCOL_TYPE_INIT;
  if (...http is allowed...)
	GIT_CURL_PROTOCOL_APPEND(&allowed, "http", CURLOPT_HTTP);

and you end up with more "#define GIT_CURL_PROTOCOL_TYPE" macros than
actual code.

On the other end of the spectrum, we could just implement two separate
functions, one that handles a string list and one that handles bits. But
then we end up repeating our list of protocols (http, https, ftp, ftp).

This patch takes the middle ground. The run-time code is always there to
handle both types, and we just choose which one to feed to curl.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2023-02-06 09:27:09 +01:00
4bd481e0ad http: prefer CURLOPT_SEEKFUNCTION to CURLOPT_IOCTLFUNCTION
The IOCTLFUNCTION option has been deprecated, and generates a compiler
warning in recent versions of curl. We can switch to using SEEKFUNCTION
instead. It was added in 2008 via curl 7.18.0; our INSTALL file already
indicates we require at least curl 7.19.4.

But there's one catch: curl says we should use CURL_SEEKFUNC_{OK,FAIL},
and those didn't arrive until 7.19.5. One workaround would be to use a
bare 0/1 here (or define our own macros).  But let's just bump the
minimum required version to 7.19.5. That version is only a minor version
bump from our existing requirement, and is only a 2 month time bump for
versions that are almost 13 years old. So it's not likely that anybody
cares about the distinction.

Switching means we have to rewrite the ioctl functions into seek
functions. In some ways they are simpler (seeking is the only
operation), but in some ways more complex (the ioctl allowed only a full
rewind, but now we can seek to arbitrary offsets).

Curl will only ever use SEEK_SET (per their documentation), so I didn't
bother implementing anything else, since it would naturally be
completely untested. This seems unlikely to change, but I added an
assertion just in case.

Likewise, I doubt curl will ever try to seek outside of the buffer sizes
we've told it, but I erred on the defensive side here, rather than do an
out-of-bounds read.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2023-02-06 09:27:09 +01:00
4fab049258 http-push: prefer CURLOPT_UPLOAD to CURLOPT_PUT
The two options do exactly the same thing, but the latter has been
deprecated and in recent versions of curl may produce a compiler
warning. Since the UPLOAD form is available everywhere (it was
introduced in the year 2000 by curl 7.1), we can just switch to it.

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2023-02-06 09:27:08 +01:00
ed4404af3c Git 2.33.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2023-02-06 09:25:58 +01:00
87248c5933 Sync with 2.32.6
* maint-2.32:
  Git 2.32.6
  Git 2.31.7
  Git 2.30.8
  apply: fix writing behind newly created symbolic links
  dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS
  clone: delay picking a transport until after get_repo_path()
  t5619: demonstrate clone_local() with ambiguous transport
2023-02-06 09:25:56 +01:00
2aedeff35f Git 2.32.6
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2023-02-06 09:25:09 +01:00
aeb93d7da2 Sync with 2.31.7
* maint-2.31:
  Git 2.31.7
  Git 2.30.8
  apply: fix writing behind newly created symbolic links
  dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS
  clone: delay picking a transport until after get_repo_path()
  t5619: demonstrate clone_local() with ambiguous transport
2023-02-06 09:25:08 +01:00
0bbcf95194 Git 2.31.7
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2023-02-06 09:24:07 +01:00
e14d6b8408 Sync with 2.30.8
* maint-2.30:
  Git 2.30.8
  apply: fix writing behind newly created symbolic links
  dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS
  clone: delay picking a transport until after get_repo_path()
  t5619: demonstrate clone_local() with ambiguous transport
2023-02-06 09:24:06 +01:00
394a759d2b Git 2.30.8
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2023-02-06 09:14:45 +01:00
a3033a68ac Merge branch 'ps/apply-beyond-symlink' into maint-2.30
Fix a vulnerability (CVE-2023-23946) that allows crafted input to trick
`git apply` into writing files outside of the working tree.

* ps/apply-beyond-symlink:
  dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
2023-02-06 09:12:16 +01:00
2c9a4c7310 Merge branch 'tb/clone-local-symlinks' into maint-2.30
Resolve a security vulnerability (CVE-2023-22490) where `clone_local()`
is used in conjunction with non-local transports, leading to arbitrary
path exfiltration.

* tb/clone-local-symlinks:
  dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS
  clone: delay picking a transport until after get_repo_path()
  t5619: demonstrate clone_local() with ambiguous transport
2023-02-06 09:09:14 +01:00
fade728df1 apply: fix writing behind newly created symbolic links
When writing files git-apply(1) initially makes sure that none of the
files it is about to create are behind a symlink:

```
 $ git init repo
 Initialized empty Git repository in /tmp/repo/.git/
 $ cd repo/
 $ ln -s dir symlink
 $ git apply - <<EOF
 diff --git a/symlink/file b/symlink/file
 new file mode 100644
 index 0000000..e69de29
 EOF
 error: affected file 'symlink/file' is beyond a symbolic link
```

This safety mechanism is crucial to ensure that we don't write outside
of the repository's working directory. It can be fooled though when the
patch that is being applied creates the symbolic link in the first
place, which can lead to writing files in arbitrary locations.

Fix this by checking whether the path we're about to create is
beyond a symlink or not. Tightening these checks like this should be
fine as we already have these precautions in Git as explained
above. Ideally, we should update the check we do up-front before
starting to reflect the computed changes to the working tree so that
we catch this case as well, but as part of embargoed security work,
adding an equivalent check just before we try to write out a file
should serve us well as a reasonable first step.

Digging back into history shows that this vulnerability has existed
since at least Git v2.9.0. As Git v2.8.0 and older don't build on my
system anymore I cannot tell whether older versions are affected, as
well.

Reported-by: Joern Schneeweisz <jschneeweisz@gitlab.com>
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2023-02-03 14:41:31 -08:00
bffc762f87 dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS
When using the dir_iterator API, we first stat(2) the base path, and
then use that as a starting point to enumerate the directory's contents.

If the directory contains symbolic links, we will immediately die() upon
encountering them without the `FOLLOW_SYMLINKS` flag. The same is not
true when resolving the top-level directory, though.

As explained in a previous commit, this oversight in 6f054f9fb3
(builtin/clone.c: disallow `--local` clones with symlinks, 2022-07-28)
can be used as an attack vector to include arbitrary files on a victim's
filesystem from outside of the repository.

Prevent resolving top-level symlinks unless the FOLLOW_SYMLINKS flag is
given, which will cause clones of a repository with a symlink'd
"$GIT_DIR/objects" directory to fail.

Signed-off-by: Taylor Blau <me@ttaylorr.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2023-01-24 16:52:16 -08:00
cf8f6ce02a clone: delay picking a transport until after get_repo_path()
In the previous commit, t5619 demonstrates an issue where two calls to
`get_repo_path()` could trick Git into using its local clone mechanism
in conjunction with a non-local transport.

That sequence is:

 - the starting state is that the local path https:/example.com/foo is a
   symlink that points to ../../../.git/modules/foo. So it's dangling.

 - get_repo_path() sees that no such path exists (because it's
   dangling), and thus we do not canonicalize it into an absolute path

 - because we're using --separate-git-dir, we create .git/modules/foo.
   Now our symlink is no longer dangling!

 - we pass the url to transport_get(), which sees it as an https URL.

 - we call get_repo_path() again, on the url. This second call was
   introduced by f38aa83f9a (use local cloning if insteadOf makes a
   local URL, 2014-07-17). The idea is that we want to pull the url
   fresh from the remote.c API, because it will apply any aliases.

And of course now it sees that there is a local file, which is a
mismatch with the transport we already selected.

The issue in the above sequence is calling `transport_get()` before
deciding whether or not the repository is indeed local, and not passing
in an absolute path if it is local.

This is reminiscent of a similar bug report in [1], where it was
suggested to perform the `insteadOf` lookup earlier. Taking that
approach may not be as straightforward, since the intent is to store the
original URL in the config, but to actually fetch from the insteadOf
one, so conflating the two early on is a non-starter.

Note: we pass the path returned by `get_repo_path(remote->url[0])`,
which should be the same as `repo_name` (aside from any `insteadOf`
rewrites).

We *could* pass `absolute_pathdup()` of the same argument, which
86521acaca (Bring local clone's origin URL in line with that of a remote
clone, 2008-09-01) indicates may differ depending on the presence of
".git/" for a non-bare repo. That matters for forming relative submodule
paths, but doesn't matter for the second call, since we're just feeding
it to the transport code, which is fine either way.

[1]: https://lore.kernel.org/git/CAMoD=Bi41mB3QRn3JdZL-FGHs4w3C2jGpnJB-CqSndO7FMtfzA@mail.gmail.com/

Signed-off-by: Jeff King <peff@peff.net>
Signed-off-by: Taylor Blau <me@ttaylorr.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2023-01-24 16:52:16 -08:00
58325b93c5 t5619: demonstrate clone_local() with ambiguous transport
When cloning a repository, Git must determine (a) what transport
mechanism to use, and (b) whether or not the clone is local.

Since f38aa83f9a (use local cloning if insteadOf makes a local URL,
2014-07-17), the latter check happens after the remote has been
initialized, and references the remote's URL instead of the local path.
This is done to make it possible for a `url.<base>.insteadOf` rule to
convert a remote URL into a local one, in which case the `clone_local()`
mechanism should be used.

However, with a specially crafted repository, Git can be tricked into
using a non-local transport while still setting `is_local` to "1" and
using the `clone_local()` optimization. The below test case
demonstrates such an instance, and shows that it can be used to include
arbitrary (known) paths in the working copy of a cloned repository on a
victim's machine[^1], even if local file clones are forbidden by
`protocol.file.allow`.

This happens in a few parts:

 1. We first call `get_repo_path()` to see if the remote is a local
    path. If it is, we replace the repo name with its absolute path.

 2. We then call `transport_get()` on the repo name and decide how to
    access it. If it was turned into an absolute path in the previous
    step, then we should always treat it like a file.

 3. We use `get_repo_path()` again, and set `is_local` as appropriate.
    But it's already too late to rewrite the repo name as an absolute
    path, since we've already fed it to the transport code.

The attack works by including a submodule whose URL corresponds to a
path on disk. In the below example, the repository "sub" is reachable
via the dumb HTTP protocol at (something like):

    http://127.0.0.1:NNNN/dumb/sub.git

However, the path "http:/127.0.0.1:NNNN/dumb" (that is, a top-level
directory called "http:", then nested directories "127.0.0.1:NNNN", and
"dumb") exists within the repository, too.

To determine this, it first picks the appropriate transport, which is
dumb HTTP. It then uses the remote's URL in order to determine whether
the repository exists locally on disk. However, the malicious repository
also contains an embedded stub repository which is the target of a
symbolic link at the local path corresponding to the "sub" repository on
disk (i.e., there is a symbolic link at "http:/127.0.0.1/dumb/sub.git",
pointing to the stub repository via ".git/modules/sub/../../../repo").

This stub repository fools Git into thinking that a local repository
exists at that URL and thus can be cloned locally. The affected call is
in `get_repo_path()`, which in turn calls `get_repo_path_1()`, which
locates a valid repository at that target.

This then causes Git to set the `is_local` variable to "1", and in turn
instructs Git to clone the repository using its local clone optimization
via the `clone_local()` function.

The exploit comes into play because the stub repository's top-level
"$GIT_DIR/objects" directory is a symbolic link which can point to an
arbitrary path on the victim's machine. `clone_local()` resolves the
top-level "objects" directory through a `stat(2)` call, meaning that we
read through the symbolic link and copy or hardlink the directory
contents at the destination of the link.

In other words, we can get steps (1) and (3) to disagree by leveraging
the dangling symlink to pick a non-local transport in the first step,
and then set is_local to "1" in the third step when cloning with
`--separate-git-dir`, which makes the symlink non-dangling.

This can result in data-exfiltration on the victim's machine when
sensitive data is at a known path (e.g., "/home/$USER/.ssh").

The appropriate fix is two-fold:

 - Resolve the transport later on (to avoid using the local
   clone optimization with a non-local transport).

 - Avoid reading through the top-level "objects" directory when
   (correctly) using the clone_local() optimization.

This patch merely demonstrates the issue. The following two patches will
implement each part of the above fix, respectively.

[^1]: Provided that any target directory does not contain symbolic
  links, in which case the changes from 6f054f9fb3 (builtin/clone.c:
  disallow `--local` clones with symlinks, 2022-07-28) will abort the
  clone.

Reported-by: yvvdwf <yvvdwf@gmail.com>
Signed-off-by: Taylor Blau <me@ttaylorr.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2023-01-24 16:52:16 -08:00
f2027d2626 Sync with maint-2.36
* maint-2.36:
  attr: adjust a mismatched data type
2023-01-19 13:48:17 -08:00
5c1fc48d68 Sync with maint-2.35
* maint-2.35:
  attr: adjust a mismatched data type
2023-01-19 13:48:08 -08:00
c508c30968 Sync with maint-2.34
* maint-2.34:
  attr: adjust a mismatched data type
2023-01-19 13:48:00 -08:00
f39fe8fcb2 Sync with maint-2.33
* maint-2.33:
  attr: adjust a mismatched data type
2023-01-19 13:47:42 -08:00
25d7cb600c Sync with maint-2.32
* maint-2.32:
  attr: adjust a mismatched data type
2023-01-19 13:46:04 -08:00
012e0d76dc Sync with maint-2.31
* maint-2.31:
  attr: adjust a mismatched data type
2023-01-19 13:45:37 -08:00
f8bf6b8f3d Sync with maint-2.30
* maint-2.30:
  attr: adjust a mismatched data type
2023-01-19 13:45:23 -08:00
0227130244 attr: adjust a mismatched data type
On platforms where `size_t` does not have the same width as `unsigned
long`, passing a pointer to the former when a pointer to the latter is
expected can lead to problems.

Windows and 32-bit Linux are among the affected platforms.

In this instance, we want to store the size of the blob that was read in
that variable. However, `read_blob_data_from_index()` passes that
pointer to `read_object_file()` which expects an `unsigned long *`.
Which means that on affected platforms, the variable is not fully
populated and part of its value is left uninitialized. (On Big-Endian
platforms, this problem would be even worse.)

The consequence is that depending on the uninitialized memory's
contents, we may erroneously reject perfectly fine attributes.

Let's address this by passing a pointer to a variable of the expected
data type.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2023-01-19 13:38:06 -08:00
e43ac5f23d Git 2.37.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-13 21:20:47 +09:00
431f6e67e6 Merge branch 'maint-2.36' into maint-2.37 2022-12-13 21:20:35 +09:00
ad949b24f8 Git 2.36.4
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-13 21:19:24 +09:00
8253c00421 Merge branch 'maint-2.35' into maint-2.36 2022-12-13 21:19:11 +09:00
02f4981723 Git 2.35.6
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-13 21:17:26 +09:00
fbabbc30e7 Merge branch 'maint-2.34' into maint-2.35 2022-12-13 21:17:10 +09:00
6c9466944c Git 2.34.6
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-13 21:15:39 +09:00
3748b5b7f5 Merge branch 'maint-2.33' into maint-2.34 2022-12-13 21:15:22 +09:00
7fe9bf55b8 Git 2.33.6
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-13 21:13:48 +09:00
5f22dcc02d Sync with Git 2.32.5 2022-12-13 21:13:11 +09:00
d96ea538e8 Git 2.32.5
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-13 21:10:27 +09:00
32e357b6df Merge branch 'ps/attr-limits-with-fsck' into maint-2.32 2022-12-13 21:09:56 +09:00
8a755eddf5 Sync with Git 2.31.6 2022-12-13 21:09:40 +09:00
82689d5e5d Git 2.31.6
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-13 21:04:03 +09:00
16128765d7 Sync with Git 2.30.7 2022-12-13 21:02:20 +09:00
b7b37a3371 Git 2.30.7
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-13 20:56:43 +09:00
27ab4784d5 fsck: implement checks for gitattributes
Recently, a vulnerability was reported that can lead to an out-of-bounds
write when reading an unreasonably large gitattributes file. The root
cause of this error are multiple integer overflows in different parts of
the code when there are either too many lines, when paths are too long,
when attribute names are too long, or when there are too many attributes
declared for a pattern.

As all of these are related to size, it seems reasonable to restrict the
size of the gitattributes file via git-fsck(1). This allows us to both
stop distributing known-vulnerable objects via common hosting platforms
that have fsck enabled, and users to protect themselves by enabling the
`fetch.fsckObjects` config.

There are basically two checks:

    1. We verify that size of the gitattributes file is smaller than
       100MB.

    2. We verify that the maximum line length does not exceed 2048
       bytes.

With the preceding commits, both of these conditions would cause us to
either ignore the complete gitattributes file or blob in the first case,
or the specific line in the second case. Now with these consistency
checks added, we also grow the ability to stop distributing such files
in the first place when `receive.fsckObjects` is enabled.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 17:07:04 +09:00
f8587c31c9 fsck: move checks for gitattributes
Move the checks for gitattributes so that they can be extended more
readily.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 17:05:00 +09:00
a59a8c687f fsck: pull out function to check a set of blobs
In `fsck_finish()` we check all blobs for consistency that we have found
during the tree walk, but that haven't yet been checked. This is only
required for gitmodules right now, but will also be required for a new
check for gitattributes.

Pull out a function `fsck_blobs()` that allows the caller to check a set
of blobs for consistency.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 17:05:00 +09:00
bb3a9265e5 fsck: refactor fsck_blob() to allow for more checks
In general, we don't need to validate blob contents as they are opaque
blobs about whose content Git doesn't need to care about. There are some
exceptions though when blobs are linked into trees so that they would be
interpreted by Git. We only have a single such check right now though,
which is the one for gitmodules that has been added in the context of
CVE-2018-11235.

Now we have found another vulnerability with gitattributes that can lead
to out-of-bounds writes and reads. So let's refactor `fsck_blob()` so
that it is more extensible and can check different types of blobs.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 17:05:00 +09:00
e0bfc0b3b9 Merge branch 'ps/attr-limits' into maint-2.32 2022-12-09 17:03:49 +09:00
6662a836eb Merge branch 'ps/attr-limits' into maint-2.30 2022-12-09 16:05:52 +09:00
3305300f4c Merge branch 'ps/format-padding-fix' into maint-2.30 2022-12-09 16:02:39 +09:00
304a50adff pretty: restrict input lengths for padding and wrapping formats
Both the padding and wrapping formatting directives allow the caller to
specify an integer that ultimately leads to us adding this many chars to
the result buffer. As a consequence, it is trivial to e.g. allocate 2GB
of RAM via a single formatting directive and cause resource exhaustion
on the machine executing this logic. Furthermore, it is debatable
whether there are any sane usecases that require the user to pad data to
2GB boundaries or to indent wrapped data by 2GB.

Restrict the input sizes to 16 kilobytes at a maximum to limit the
amount of bytes that can be requested by the user. This is not meant
as a fix because there are ways to trivially amplify the amount of
data we generate via formatting directives; the real protection is
achieved by the changes in previous steps to catch and avoid integer
wraparound that causes us to under-allocate and access beyond the
end of allocated memory reagions. But having such a limit
significantly helps fuzzing the pretty format, because the fuzzer is
otherwise quite fast to run out-of-memory as it discovers these
formatters.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 14:26:21 +09:00
f930a23943 utf8: refactor strbuf_utf8_replace to not rely on preallocated buffer
In `strbuf_utf8_replace`, we preallocate the destination buffer and then
use `memcpy` to copy bytes into it at computed offsets. This feels
rather fragile and is hard to understand at times. Refactor the code to
instead use `strbuf_add` and `strbuf_addstr` so that we can be sure that
there is no possibility to perform an out-of-bounds write.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 14:26:21 +09:00
81c2d4c3a5 utf8: fix checking for glyph width in strbuf_utf8_replace()
In `strbuf_utf8_replace()`, we call `utf8_width()` to compute the width
of the current glyph. If the glyph is a control character though it can
be that `utf8_width()` returns `-1`, but because we assign this value to
a `size_t` the conversion will cause us to underflow. This bug can
easily be triggered with the following command:

    $ git log --pretty='format:xxx%<|(1,trunc)%x10'

>From all I can see though this seems to be a benign underflow that has
no security-related consequences.

Fix the bug by using an `int` instead. When we see a control character,
we now copy it into the target buffer but don't advance the current
width of the string.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 14:26:21 +09:00
937b71cc8b utf8: fix overflow when returning string width
The return type of both `utf8_strwidth()` and `utf8_strnwidth()` is
`int`, but we operate on string lengths which are typically of type
`size_t`. This means that when the string is longer than `INT_MAX`, we
will overflow and thus return a negative result.

This can lead to an out-of-bounds write with `--pretty=format:%<1)%B`
and a commit message that is 2^31+1 bytes long:

    =================================================================
    ==26009==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000001168 at pc 0x7f95c4e5f427 bp 0x7ffd8541c900 sp 0x7ffd8541c0a8
    WRITE of size 2147483649 at 0x603000001168 thread T0
        #0 0x7f95c4e5f426 in __interceptor_memcpy /usr/src/debug/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
        #1 0x5612bbb1068c in format_and_pad_commit pretty.c:1763
        #2 0x5612bbb1087a in format_commit_item pretty.c:1801
        #3 0x5612bbc33bab in strbuf_expand strbuf.c:429
        #4 0x5612bbb110e7 in repo_format_commit_message pretty.c:1869
        #5 0x5612bbb12d96 in pretty_print_commit pretty.c:2161
        #6 0x5612bba0a4d5 in show_log log-tree.c:781
        #7 0x5612bba0d6c7 in log_tree_commit log-tree.c:1117
        #8 0x5612bb691ed5 in cmd_log_walk_no_free builtin/log.c:508
        #9 0x5612bb69235b in cmd_log_walk builtin/log.c:549
        #10 0x5612bb6951a2 in cmd_log builtin/log.c:883
        #11 0x5612bb56c993 in run_builtin git.c:466
        #12 0x5612bb56d397 in handle_builtin git.c:721
        #13 0x5612bb56db07 in run_argv git.c:788
        #14 0x5612bb56e8a7 in cmd_main git.c:923
        #15 0x5612bb803682 in main common-main.c:57
        #16 0x7f95c4c3c28f  (/usr/lib/libc.so.6+0x2328f)
        #17 0x7f95c4c3c349 in __libc_start_main (/usr/lib/libc.so.6+0x23349)
        #18 0x5612bb5680e4 in _start ../sysdeps/x86_64/start.S:115

    0x603000001168 is located 0 bytes to the right of 24-byte region [0x603000001150,0x603000001168)
    allocated by thread T0 here:
        #0 0x7f95c4ebe7ea in __interceptor_realloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:85
        #1 0x5612bbcdd556 in xrealloc wrapper.c:136
        #2 0x5612bbc310a3 in strbuf_grow strbuf.c:99
        #3 0x5612bbc32acd in strbuf_add strbuf.c:298
        #4 0x5612bbc33aec in strbuf_expand strbuf.c:418
        #5 0x5612bbb110e7 in repo_format_commit_message pretty.c:1869
        #6 0x5612bbb12d96 in pretty_print_commit pretty.c:2161
        #7 0x5612bba0a4d5 in show_log log-tree.c:781
        #8 0x5612bba0d6c7 in log_tree_commit log-tree.c:1117
        #9 0x5612bb691ed5 in cmd_log_walk_no_free builtin/log.c:508
        #10 0x5612bb69235b in cmd_log_walk builtin/log.c:549
        #11 0x5612bb6951a2 in cmd_log builtin/log.c:883
        #12 0x5612bb56c993 in run_builtin git.c:466
        #13 0x5612bb56d397 in handle_builtin git.c:721
        #14 0x5612bb56db07 in run_argv git.c:788
        #15 0x5612bb56e8a7 in cmd_main git.c:923
        #16 0x5612bb803682 in main common-main.c:57
        #17 0x7f95c4c3c28f  (/usr/lib/libc.so.6+0x2328f)

    SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/src/debug/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 in __interceptor_memcpy
    Shadow bytes around the buggy address:
      0x0c067fff81d0: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
      0x0c067fff81e0: fa fa fd fd fd fd fa fa fd fd fd fd fa fa fd fd
      0x0c067fff81f0: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
      0x0c067fff8200: fd fd fd fa fa fa fd fd fd fd fa fa 00 00 00 fa
      0x0c067fff8210: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
    =>0x0c067fff8220: fd fa fa fa fd fd fd fa fa fa 00 00 00[fa]fa fa
      0x0c067fff8230: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c067fff8240: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c067fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c067fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c067fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
    ==26009==ABORTING

Now the proper fix for this would be to convert both functions to return
an `size_t` instead of an `int`. But given that this commit may be part
of a security release, let's instead do the minimal viable fix and die
in case we see an overflow.

Add a test that would have previously caused us to crash.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 14:26:21 +09:00
17d23e8a38 utf8: fix returning negative string width
The `utf8_strnwidth()` function calls `utf8_width()` in a loop and adds
its returned width to the end result. `utf8_width()` can return `-1`
though in case it reads a control character, which means that the
computed string width is going to be wrong. In the worst case where
there are more control characters than non-control characters, we may
even return a negative string width.

Fix this bug by treating control characters as having zero width.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 14:26:21 +09:00
522cc87fdc utf8: fix truncated string lengths in utf8_strnwidth()
The `utf8_strnwidth()` function accepts an optional string length as
input parameter. This parameter can either be set to `-1`, in which case
we call `strlen()` on the input. Or it can be set to a positive integer
that indicates a precomputed length, which callers typically compute by
calling `strlen()` at some point themselves.

The input parameter is an `int` though, whereas `strlen()` returns a
`size_t`. This can lead to implementation-defined behaviour though when
the `size_t` cannot be represented by the `int`. In the general case
though this leads to wrap-around and thus to negative string sizes,
which is sure enough to not lead to well-defined behaviour.

Fix this by accepting a `size_t` instead of an `int` as string length.
While this takes away the ability of callers to simply pass in `-1` as
string length, it really is trivial enough to convert them to instead
pass in `strlen()` instead.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 14:26:21 +09:00
48050c42c7 pretty: fix integer overflow in wrapping format
The `%w(width,indent1,indent2)` formatting directive can be used to
rewrap text to a specific width and is designed after git-shortlog(1)'s
`-w` parameter. While the three parameters are all stored as `size_t`
internally, `strbuf_add_wrapped_text()` accepts integers as input. As a
result, the casted integers may overflow. As these now-negative integers
are later on passed to `strbuf_addchars()`, we will ultimately run into
implementation-defined behaviour due to casting a negative number back
to `size_t` again. On my platform, this results in trying to allocate
9000 petabyte of memory.

Fix this overflow by using `cast_size_t_to_int()` so that we reject
inputs that cannot be represented as an integer.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 14:26:21 +09:00
1de69c0cdd pretty: fix adding linefeed when placeholder is not expanded
When a formatting directive has a `+` or ` ` after the `%`, then we add
either a line feed or space if the placeholder expands to a non-empty
string. In specific cases though this logic doesn't work as expected,
and we try to add the character even in the case where the formatting
directive is empty.

One such pattern is `%w(1)%+d%+w(2)`. `%+d` expands to reference names
pointing to a certain commit, like in `git log --decorate`. For a tagged
commit this would for example expand to `\n (tag: v1.0.0)`, which has a
leading newline due to the `+` modifier and a space added by `%d`. Now
the second wrapping directive will cause us to rewrap the text to
`\n(tag:\nv1.0.0)`, which is one byte shorter due to the missing leading
space. The code that handles the `+` magic now notices that the length
has changed and will thus try to insert a leading line feed at the
original posititon. But as the string was shortened, the original
position is past the buffer's boundary and thus we die with an error.

Now there are two issues here:

    1. We check whether the buffer length has changed, not whether it
       has been extended. This causes us to try and add the character
       past the string boundary.

    2. The current logic does not make any sense whatsoever. When the
       string got expanded due to the rewrap, putting the separator into
       the original position is likely to put it somewhere into the
       middle of the rewrapped contents.

It is debatable whether `%+w()` makes any sense in the first place.
Strictly speaking, the placeholder never expands to a non-empty string,
and consequentially we shouldn't ever accept this combination. We thus
fix the bug by simply refusing `%+w()`.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 14:26:21 +09:00
f6e0b9f389 pretty: fix out-of-bounds read when parsing invalid padding format
An out-of-bounds read can be triggered when parsing an incomplete
padding format string passed via `--pretty=format` or in Git archives
when files are marked with the `export-subst` gitattribute.

This bug exists since we have introduced support for truncating output
via the `trunc` keyword a7f01c6b4d (pretty: support truncating in %>, %<
and %><, 2013-04-19). Before this commit, we used to find the end of the
formatting string by using strchr(3P). This function returns a `NULL`
pointer in case the character in question wasn't found. The subsequent
check whether any character was found thus simply checked the returned
pointer. After the commit we switched to strcspn(3P) though, which only
returns the offset to the first found character or to the trailing NUL
byte. As the end pointer is now computed by adding the offset to the
start pointer it won't be `NULL` anymore, and as a consequence the check
doesn't do anything anymore.

The out-of-bounds data that is being read can in fact end up in the
formatted string. As a consequence, it is possible to leak memory
contents either by calling git-log(1) or via git-archive(1) when any of
the archived files is marked with the `export-subst` gitattribute.

    ==10888==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000398 at pc 0x7f0356047cb2 bp 0x7fff3ffb95d0 sp 0x7fff3ffb8d78
    READ of size 1 at 0x602000000398 thread T0
        #0 0x7f0356047cb1 in __interceptor_strchrnul /usr/src/debug/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:725
        #1 0x563b7cec9a43 in strbuf_expand strbuf.c:417
        #2 0x563b7cda7060 in repo_format_commit_message pretty.c:1869
        #3 0x563b7cda8d0f in pretty_print_commit pretty.c:2161
        #4 0x563b7cca04c8 in show_log log-tree.c:781
        #5 0x563b7cca36ba in log_tree_commit log-tree.c:1117
        #6 0x563b7c927ed5 in cmd_log_walk_no_free builtin/log.c:508
        #7 0x563b7c92835b in cmd_log_walk builtin/log.c:549
        #8 0x563b7c92b1a2 in cmd_log builtin/log.c:883
        #9 0x563b7c802993 in run_builtin git.c:466
        #10 0x563b7c803397 in handle_builtin git.c:721
        #11 0x563b7c803b07 in run_argv git.c:788
        #12 0x563b7c8048a7 in cmd_main git.c:923
        #13 0x563b7ca99682 in main common-main.c:57
        #14 0x7f0355e3c28f  (/usr/lib/libc.so.6+0x2328f)
        #15 0x7f0355e3c349 in __libc_start_main (/usr/lib/libc.so.6+0x23349)
        #16 0x563b7c7fe0e4 in _start ../sysdeps/x86_64/start.S:115

    0x602000000398 is located 0 bytes to the right of 8-byte region [0x602000000390,0x602000000398)
    allocated by thread T0 here:
        #0 0x7f0356072faa in __interceptor_strdup /usr/src/debug/gcc/libsanitizer/asan/asan_interceptors.cpp:439
        #1 0x563b7cf7317c in xstrdup wrapper.c:39
        #2 0x563b7cd9a06a in save_user_format pretty.c:40
        #3 0x563b7cd9b3e5 in get_commit_format pretty.c:173
        #4 0x563b7ce54ea0 in handle_revision_opt revision.c:2456
        #5 0x563b7ce597c9 in setup_revisions revision.c:2850
        #6 0x563b7c9269e0 in cmd_log_init_finish builtin/log.c:269
        #7 0x563b7c927362 in cmd_log_init builtin/log.c:348
        #8 0x563b7c92b193 in cmd_log builtin/log.c:882
        #9 0x563b7c802993 in run_builtin git.c:466
        #10 0x563b7c803397 in handle_builtin git.c:721
        #11 0x563b7c803b07 in run_argv git.c:788
        #12 0x563b7c8048a7 in cmd_main git.c:923
        #13 0x563b7ca99682 in main common-main.c:57
        #14 0x7f0355e3c28f  (/usr/lib/libc.so.6+0x2328f)
        #15 0x7f0355e3c349 in __libc_start_main (/usr/lib/libc.so.6+0x23349)
        #16 0x563b7c7fe0e4 in _start ../sysdeps/x86_64/start.S:115

    SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/src/debug/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:725 in __interceptor_strchrnul
    Shadow bytes around the buggy address:
      0x0c047fff8020: fa fa fd fd fa fa 00 06 fa fa 05 fa fa fa fd fd
      0x0c047fff8030: fa fa 00 02 fa fa 06 fa fa fa 05 fa fa fa fd fd
      0x0c047fff8040: fa fa 00 07 fa fa 03 fa fa fa fd fd fa fa 00 00
      0x0c047fff8050: fa fa 00 01 fa fa fd fd fa fa 00 00 fa fa 00 01
      0x0c047fff8060: fa fa 00 06 fa fa 00 06 fa fa 05 fa fa fa 05 fa
    =>0x0c047fff8070: fa fa 00[fa]fa fa fd fa fa fa fd fd fa fa fd fd
      0x0c047fff8080: fa fa fd fd fa fa 00 00 fa fa 00 fa fa fa fd fa
      0x0c047fff8090: fa fa fd fd fa fa 00 00 fa fa fa fa fa fa fa fa
      0x0c047fff80a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c047fff80b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c047fff80c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
    ==10888==ABORTING

Fix this bug by checking whether `end` points at the trailing NUL byte.
Add a test which catches this out-of-bounds read and which demonstrates
that we used to write out-of-bounds data into the formatted message.

Reported-by: Markus Vervier <markus.vervier@x41-dsec.de>
Original-patch-by: Markus Vervier <markus.vervier@x41-dsec.de>
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 14:26:21 +09:00
b49f309aa1 pretty: fix out-of-bounds read when left-flushing with stealing
With the `%>>(<N>)` pretty formatter, you can ask git-log(1) et al to
steal spaces. To do so we need to look ahead of the next token to see
whether there are spaces there. This loop takes into account ANSI
sequences that end with an `m`, and if it finds any it will skip them
until it finds the first space. While doing so it does not take into
account the buffer's limits though and easily does an out-of-bounds
read.

Add a test that hits this behaviour. While we don't have an easy way to
verify this, the test causes the following failure when run with
`SANITIZE=address`:

    ==37941==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x603000000baf at pc 0x55ba6f88e0d0 bp 0x7ffc84c50d20 sp 0x7ffc84c50d10
    READ of size 1 at 0x603000000baf thread T0
        #0 0x55ba6f88e0cf in format_and_pad_commit pretty.c:1712
        #1 0x55ba6f88e7b4 in format_commit_item pretty.c:1801
        #2 0x55ba6f9b1ae4 in strbuf_expand strbuf.c:429
        #3 0x55ba6f88f020 in repo_format_commit_message pretty.c:1869
        #4 0x55ba6f890ccf in pretty_print_commit pretty.c:2161
        #5 0x55ba6f7884c8 in show_log log-tree.c:781
        #6 0x55ba6f78b6ba in log_tree_commit log-tree.c:1117
        #7 0x55ba6f40fed5 in cmd_log_walk_no_free builtin/log.c:508
        #8 0x55ba6f41035b in cmd_log_walk builtin/log.c:549
        #9 0x55ba6f4131a2 in cmd_log builtin/log.c:883
        #10 0x55ba6f2ea993 in run_builtin git.c:466
        #11 0x55ba6f2eb397 in handle_builtin git.c:721
        #12 0x55ba6f2ebb07 in run_argv git.c:788
        #13 0x55ba6f2ec8a7 in cmd_main git.c:923
        #14 0x55ba6f581682 in main common-main.c:57
        #15 0x7f2d08c3c28f  (/usr/lib/libc.so.6+0x2328f)
        #16 0x7f2d08c3c349 in __libc_start_main (/usr/lib/libc.so.6+0x23349)
        #17 0x55ba6f2e60e4 in _start ../sysdeps/x86_64/start.S:115

    0x603000000baf is located 1 bytes to the left of 24-byte region [0x603000000bb0,0x603000000bc8)
    allocated by thread T0 here:
        #0 0x7f2d08ebe7ea in __interceptor_realloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:85
        #1 0x55ba6fa5b494 in xrealloc wrapper.c:136
        #2 0x55ba6f9aefdc in strbuf_grow strbuf.c:99
        #3 0x55ba6f9b0a06 in strbuf_add strbuf.c:298
        #4 0x55ba6f9b1a25 in strbuf_expand strbuf.c:418
        #5 0x55ba6f88f020 in repo_format_commit_message pretty.c:1869
        #6 0x55ba6f890ccf in pretty_print_commit pretty.c:2161
        #7 0x55ba6f7884c8 in show_log log-tree.c:781
        #8 0x55ba6f78b6ba in log_tree_commit log-tree.c:1117
        #9 0x55ba6f40fed5 in cmd_log_walk_no_free builtin/log.c:508
        #10 0x55ba6f41035b in cmd_log_walk builtin/log.c:549
        #11 0x55ba6f4131a2 in cmd_log builtin/log.c:883
        #12 0x55ba6f2ea993 in run_builtin git.c:466
        #13 0x55ba6f2eb397 in handle_builtin git.c:721
        #14 0x55ba6f2ebb07 in run_argv git.c:788
        #15 0x55ba6f2ec8a7 in cmd_main git.c:923
        #16 0x55ba6f581682 in main common-main.c:57
        #17 0x7f2d08c3c28f  (/usr/lib/libc.so.6+0x2328f)
        #18 0x7f2d08c3c349 in __libc_start_main (/usr/lib/libc.so.6+0x23349)
        #19 0x55ba6f2e60e4 in _start ../sysdeps/x86_64/start.S:115

    SUMMARY: AddressSanitizer: heap-buffer-overflow pretty.c:1712 in format_and_pad_commit
    Shadow bytes around the buggy address:
      0x0c067fff8120: fa fa fd fd fd fa fa fa fd fd fd fa fa fa fd fd
      0x0c067fff8130: fd fd fa fa fd fd fd fd fa fa fd fd fd fa fa fa
      0x0c067fff8140: fd fd fd fa fa fa fd fd fd fa fa fa fd fd fd fa
      0x0c067fff8150: fa fa fd fd fd fd fa fa 00 00 00 fa fa fa fd fd
      0x0c067fff8160: fd fa fa fa fd fd fd fa fa fa fd fd fd fa fa fa
    =>0x0c067fff8170: fd fd fd fa fa[fa]00 00 00 fa fa fa 00 00 00 fa
      0x0c067fff8180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c067fff8190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c067fff81a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c067fff81b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c067fff81c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb

Luckily enough, this would only cause us to copy the out-of-bounds data
into the formatted commit in case we really had an ANSI sequence
preceding our buffer. So this bug likely has no security consequences.

Fix it regardless by not traversing past the buffer's start.

Reported-by: Patrick Steinhardt <ps@pks.im>
Reported-by: Eric Sesterhenn <eric.sesterhenn@x41-dsec.de>
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 14:26:21 +09:00
81dc898df9 pretty: fix out-of-bounds write caused by integer overflow
When using a padding specifier in the pretty format passed to git-log(1)
we need to calculate the string length in several places. These string
lengths are stored in `int`s though, which means that these can easily
overflow when the input lengths exceeds 2GB. This can ultimately lead to
an out-of-bounds write when these are used in a call to memcpy(3P):

        ==8340==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7f1ec62f97fe at pc 0x7f2127e5f427 bp 0x7ffd3bd63de0 sp 0x7ffd3bd63588
    WRITE of size 1 at 0x7f1ec62f97fe thread T0
        #0 0x7f2127e5f426 in __interceptor_memcpy /usr/src/debug/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827
        #1 0x5628e96aa605 in format_and_pad_commit pretty.c:1762
        #2 0x5628e96aa7f4 in format_commit_item pretty.c:1801
        #3 0x5628e97cdb24 in strbuf_expand strbuf.c:429
        #4 0x5628e96ab060 in repo_format_commit_message pretty.c:1869
        #5 0x5628e96acd0f in pretty_print_commit pretty.c:2161
        #6 0x5628e95a44c8 in show_log log-tree.c:781
        #7 0x5628e95a76ba in log_tree_commit log-tree.c:1117
        #8 0x5628e922bed5 in cmd_log_walk_no_free builtin/log.c:508
        #9 0x5628e922c35b in cmd_log_walk builtin/log.c:549
        #10 0x5628e922f1a2 in cmd_log builtin/log.c:883
        #11 0x5628e9106993 in run_builtin git.c:466
        #12 0x5628e9107397 in handle_builtin git.c:721
        #13 0x5628e9107b07 in run_argv git.c:788
        #14 0x5628e91088a7 in cmd_main git.c:923
        #15 0x5628e939d682 in main common-main.c:57
        #16 0x7f2127c3c28f  (/usr/lib/libc.so.6+0x2328f)
        #17 0x7f2127c3c349 in __libc_start_main (/usr/lib/libc.so.6+0x23349)
        #18 0x5628e91020e4 in _start ../sysdeps/x86_64/start.S:115

    0x7f1ec62f97fe is located 2 bytes to the left of 4831838265-byte region [0x7f1ec62f9800,0x7f1fe62f9839)
    allocated by thread T0 here:
        #0 0x7f2127ebe7ea in __interceptor_realloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:85
        #1 0x5628e98774d4 in xrealloc wrapper.c:136
        #2 0x5628e97cb01c in strbuf_grow strbuf.c:99
        #3 0x5628e97ccd42 in strbuf_addchars strbuf.c:327
        #4 0x5628e96aa55c in format_and_pad_commit pretty.c:1761
        #5 0x5628e96aa7f4 in format_commit_item pretty.c:1801
        #6 0x5628e97cdb24 in strbuf_expand strbuf.c:429
        #7 0x5628e96ab060 in repo_format_commit_message pretty.c:1869
        #8 0x5628e96acd0f in pretty_print_commit pretty.c:2161
        #9 0x5628e95a44c8 in show_log log-tree.c:781
        #10 0x5628e95a76ba in log_tree_commit log-tree.c:1117
        #11 0x5628e922bed5 in cmd_log_walk_no_free builtin/log.c:508
        #12 0x5628e922c35b in cmd_log_walk builtin/log.c:549
        #13 0x5628e922f1a2 in cmd_log builtin/log.c:883
        #14 0x5628e9106993 in run_builtin git.c:466
        #15 0x5628e9107397 in handle_builtin git.c:721
        #16 0x5628e9107b07 in run_argv git.c:788
        #17 0x5628e91088a7 in cmd_main git.c:923
        #18 0x5628e939d682 in main common-main.c:57
        #19 0x7f2127c3c28f  (/usr/lib/libc.so.6+0x2328f)
        #20 0x7f2127c3c349 in __libc_start_main (/usr/lib/libc.so.6+0x23349)
        #21 0x5628e91020e4 in _start ../sysdeps/x86_64/start.S:115

    SUMMARY: AddressSanitizer: heap-buffer-overflow /usr/src/debug/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:827 in __interceptor_memcpy
    Shadow bytes around the buggy address:
      0x0fe458c572a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0fe458c572b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0fe458c572c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0fe458c572d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0fe458c572e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    =>0x0fe458c572f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa[fa]
      0x0fe458c57300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0fe458c57310: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0fe458c57320: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0fe458c57330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
      0x0fe458c57340: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
    ==8340==ABORTING

The pretty format can also be used in `git archive` operations via the
`export-subst` attribute. So this is what in our opinion makes this a
critical issue in the context of Git forges which allow to download an
archive of user supplied Git repositories.

Fix this vulnerability by using `size_t` instead of `int` to track the
string lengths. Add tests which detect this vulnerability when Git is
compiled with the address sanitizer.

Reported-by: Joern Schneeweisz <jschneeweisz@gitlab.com>
Original-patch-by: Joern Schneeweisz <jschneeweisz@gitlab.com>
Modified-by: Taylor  Blau <me@ttalorr.com>
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 14:26:21 +09:00
a244dc5b0a test-lib: add prerequisite for 64-bit platforms
Allow tests that assume a 64-bit `size_t` to be skipped in 32-bit
platforms and regardless of the size of `long`.

This imitates the `LONG_IS_64BIT` prerequisite.

Signed-off-by: Carlo Marcelo Arenas Belón <carenas@gmail.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-09 14:26:04 +09:00
3c50032ff5 attr: ignore overly large gitattributes files
Similar as with the preceding commit, start ignoring gitattributes files
that are overly large to protect us against out-of-bounds reads and
writes caused by integer overflows. Unfortunately, we cannot just define
"overly large" in terms of any preexisting limits in the codebase.

Instead, we choose a very conservative limit of 100MB. This is plenty of
room for specifying gitattributes, and incidentally it is also the limit
for blob sizes for GitHub. While we don't want GitHub to dictate limits
here, it is still sensible to use this fact for an informed decision
given that it is hosting a huge set of repositories. Furthermore, over
at GitLab we scanned a subset of repositories for their root-level
attribute files. We found that 80% of them have a gitattributes file
smaller than 100kB, 99.99% have one smaller than 1MB, and only a single
repository had one that was almost 3MB in size. So enforcing a limit of
100MB seems to give us ample of headroom.

With this limit in place we can be reasonably sure that there is no easy
way to exploit the gitattributes file via integer overflows anymore.
Furthermore, it protects us against resource exhaustion caused by
allocating the in-memory data structures required to represent the
parsed attributes.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-05 15:50:03 +09:00
dfa6b32b5e attr: ignore attribute lines exceeding 2048 bytes
There are two different code paths to read gitattributes: once via a
file, and once via the index. These two paths used to behave differently
because when reading attributes from a file, we used fgets(3P) with a
buffer size of 2kB. Consequentially, we silently truncate line lengths
when lines are longer than that and will then parse the remainder of the
line as a new pattern. It goes without saying that this is entirely
unexpected, but it's even worse that the behaviour depends on how the
gitattributes are parsed.

While this is simply wrong, the silent truncation saves us with the
recently discovered vulnerabilities that can cause out-of-bound writes
or reads with unreasonably long lines due to integer overflows. As the
common path is to read gitattributes via the worktree file instead of
via the index, we can assume that any gitattributes file that had lines
longer than that is already broken anyway. So instead of lifting the
limit here, we can double down on it to fix the vulnerabilities.

Introduce an explicit line length limit of 2kB that is shared across all
paths that read attributes and ignore any line that hits this limit
while printing a warning.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-05 15:33:07 +09:00
d74b1fd54f attr: fix silently splitting up lines longer than 2048 bytes
When reading attributes from a file we use fgets(3P) with a buffer size
of 2048 bytes. This means that as soon as a line exceeds the buffer size
we split it up into multiple parts and parse each of them as a separate
pattern line. This is of course not what the user intended, and even
worse the behaviour is inconsistent with how we read attributes from the
index.

Fix this bug by converting the code to use `strbuf_getline()` instead.
This will indeed read in the whole line, which may theoretically lead to
an out-of-memory situation when the gitattributes file is huge. We're
about to reject any gitattributes files larger than 100MB in the next
commit though, which makes this less of a concern.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-05 15:29:30 +09:00
a60a66e409 attr: harden allocation against integer overflows
When parsing an attributes line, we need to allocate an array that holds
all attributes specified for the given file pattern. The calculation to
determine the number of bytes that need to be allocated was prone to an
overflow though when there was an unreasonable amount of attributes.

Harden the allocation by instead using the `st_` helper functions that
cause us to die when we hit an integer overflow.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-05 15:14:16 +09:00
e1e12e97ac attr: fix integer overflow with more than INT_MAX macros
Attributes have a field that tracks the position in the `all_attrs`
array they're stored inside. This field gets set via `hashmap_get_size`
when adding the attribute to the global map of attributes. But while the
field is of type `int`, the value returned by `hashmap_get_size` is an
`unsigned int`. It can thus happen that the value overflows, where we
would now dereference teh `all_attrs` array at an out-of-bounds value.

We do have a sanity check for this overflow via an assert that verifies
the index matches the new hashmap's size. But asserts are not a proper
mechanism to detect against any such overflows as they may not in fact
be compiled into production code.

Fix this by using an `unsigned int` to track the index and convert the
assert to a call `die()`.

Reported-by: Jeff King <peff@peff.net>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-05 15:14:16 +09:00
447ac906e1 attr: fix out-of-bounds read with unreasonable amount of patterns
The `struct attr_stack` tracks the stack of all patterns together with
their attributes. When parsing a gitattributes file that has more than
2^31 such patterns though we may trigger multiple out-of-bounds reads on
64 bit platforms. This is because while the `num_matches` variable is an
unsigned integer, we always use a signed integer to iterate over them.

I have not been able to reproduce this issue due to memory constraints
on my systems. But despite the out-of-bounds reads, the worst thing that
can seemingly happen is to call free(3P) with a garbage pointer when
calling `attr_stack_free()`.

Fix this bug by using unsigned integers to iterate over the array. While
this makes the iteration somewhat awkward when iterating in reverse, it
is at least better than knowingly running into an out-of-bounds read.
While at it, convert the call to `ALLOC_GROW` to use `ALLOC_GROW_BY`
instead.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-05 15:14:16 +09:00
34ace8bad0 attr: fix out-of-bounds write when parsing huge number of attributes
It is possible to trigger an integer overflow when parsing attribute
names when there are more than 2^31 of them for a single pattern. This
can either lead to us dying due to trying to request too many bytes:

     blob=$(perl -e 'print "f" . " a=" x 2147483649' | git hash-object -w --stdin)
     git update-index --add --cacheinfo 100644,$blob,.gitattributes
     git attr-check --all file

    =================================================================
    ==1022==ERROR: AddressSanitizer: requested allocation size 0xfffffff800000032 (0xfffffff800001038 after adjustments for alignment, red zones etc.) exceeds maximum supported size of 0x10000000000 (thread T0)
        #0 0x7fd3efabf411 in __interceptor_calloc /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:77
        #1 0x5563a0a1e3d3 in xcalloc wrapper.c:150
        #2 0x5563a058d005 in parse_attr_line attr.c:384
        #3 0x5563a058e661 in handle_attr_line attr.c:660
        #4 0x5563a058eddb in read_attr_from_index attr.c:769
        #5 0x5563a058ef12 in read_attr attr.c:797
        #6 0x5563a058f24c in bootstrap_attr_stack attr.c:867
        #7 0x5563a058f4a3 in prepare_attr_stack attr.c:902
        #8 0x5563a05905da in collect_some_attrs attr.c:1097
        #9 0x5563a059093d in git_all_attrs attr.c:1128
        #10 0x5563a02f636e in check_attr builtin/check-attr.c:67
        #11 0x5563a02f6c12 in cmd_check_attr builtin/check-attr.c:183
        #12 0x5563a02aa993 in run_builtin git.c:466
        #13 0x5563a02ab397 in handle_builtin git.c:721
        #14 0x5563a02abb2b in run_argv git.c:788
        #15 0x5563a02ac991 in cmd_main git.c:926
        #16 0x5563a05432bd in main common-main.c:57
        #17 0x7fd3ef82228f  (/usr/lib/libc.so.6+0x2328f)

    ==1022==HINT: if you don't care about these errors you may set allocator_may_return_null=1
    SUMMARY: AddressSanitizer: allocation-size-too-big /usr/src/debug/gcc/libsanitizer/asan/asan_malloc_linux.cpp:77 in __interceptor_calloc
    ==1022==ABORTING

Or, much worse, it can lead to an out-of-bounds write because we
underallocate and then memcpy(3P) into an array:

    perl -e '
        print "A " . "\rh="x2000000000;
        print "\rh="x2000000000;
        print "\rh="x294967294 . "\n"
    ' >.gitattributes
    git add .gitattributes
    git commit -am "evil attributes"

    $ git clone --quiet /path/to/repo
    =================================================================
    ==15062==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000002550 at pc 0x5555559884d5 bp 0x7fffffffbc60 sp 0x7fffffffbc58
    WRITE of size 8 at 0x602000002550 thread T0
        #0 0x5555559884d4 in parse_attr_line attr.c:393
        #1 0x5555559884d4 in handle_attr_line attr.c:660
        #2 0x555555988902 in read_attr_from_index attr.c:784
        #3 0x555555988902 in read_attr_from_index attr.c:747
        #4 0x555555988a1d in read_attr attr.c:800
        #5 0x555555989b0c in bootstrap_attr_stack attr.c:882
        #6 0x555555989b0c in prepare_attr_stack attr.c:917
        #7 0x555555989b0c in collect_some_attrs attr.c:1112
        #8 0x55555598b141 in git_check_attr attr.c:1126
        #9 0x555555a13004 in convert_attrs convert.c:1311
        #10 0x555555a95e04 in checkout_entry_ca entry.c:553
        #11 0x555555d58bf6 in checkout_entry entry.h:42
        #12 0x555555d58bf6 in check_updates unpack-trees.c:480
        #13 0x555555d5eb55 in unpack_trees unpack-trees.c:2040
        #14 0x555555785ab7 in checkout builtin/clone.c:724
        #15 0x555555785ab7 in cmd_clone builtin/clone.c:1384
        #16 0x55555572443c in run_builtin git.c:466
        #17 0x55555572443c in handle_builtin git.c:721
        #18 0x555555727872 in run_argv git.c:788
        #19 0x555555727872 in cmd_main git.c:926
        #20 0x555555721fa0 in main common-main.c:57
        #21 0x7ffff73f1d09 in __libc_start_main ../csu/libc-start.c:308
        #22 0x555555723f39 in _start (git+0x1cff39)

    0x602000002552 is located 0 bytes to the right of 2-byte region [0x602000002550,0x602000002552) allocated by thread T0 here:
        #0 0x7ffff768c037 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:154
        #1 0x555555d7fff7 in xcalloc wrapper.c:150
        #2 0x55555598815f in parse_attr_line attr.c:384
        #3 0x55555598815f in handle_attr_line attr.c:660
        #4 0x555555988902 in read_attr_from_index attr.c:784
        #5 0x555555988902 in read_attr_from_index attr.c:747
        #6 0x555555988a1d in read_attr attr.c:800
        #7 0x555555989b0c in bootstrap_attr_stack attr.c:882
        #8 0x555555989b0c in prepare_attr_stack attr.c:917
        #9 0x555555989b0c in collect_some_attrs attr.c:1112
        #10 0x55555598b141 in git_check_attr attr.c:1126
        #11 0x555555a13004 in convert_attrs convert.c:1311
        #12 0x555555a95e04 in checkout_entry_ca entry.c:553
        #13 0x555555d58bf6 in checkout_entry entry.h:42
        #14 0x555555d58bf6 in check_updates unpack-trees.c:480
        #15 0x555555d5eb55 in unpack_trees unpack-trees.c:2040
        #16 0x555555785ab7 in checkout builtin/clone.c:724
        #17 0x555555785ab7 in cmd_clone builtin/clone.c:1384
        #18 0x55555572443c in run_builtin git.c:466
        #19 0x55555572443c in handle_builtin git.c:721
        #20 0x555555727872 in run_argv git.c:788
        #21 0x555555727872 in cmd_main git.c:926
        #22 0x555555721fa0 in main common-main.c:57
        #23 0x7ffff73f1d09 in __libc_start_main ../csu/libc-start.c:308

    SUMMARY: AddressSanitizer: heap-buffer-overflow attr.c:393 in parse_attr_line
    Shadow bytes around the buggy address:
      0x0c047fff8450: fa fa 00 02 fa fa 00 07 fa fa fd fd fa fa 00 00
      0x0c047fff8460: fa fa 02 fa fa fa fd fd fa fa 00 06 fa fa 05 fa
      0x0c047fff8470: fa fa fd fd fa fa 00 02 fa fa 06 fa fa fa 05 fa
      0x0c047fff8480: fa fa 07 fa fa fa fd fd fa fa 00 01 fa fa 00 02
      0x0c047fff8490: fa fa 00 03 fa fa 00 fa fa fa 00 01 fa fa 00 03
    =>0x0c047fff84a0: fa fa 00 01 fa fa 00 02 fa fa[02]fa fa fa fa fa
      0x0c047fff84b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c047fff84c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c047fff84d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c047fff84e0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
      0x0c047fff84f0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
    Shadow byte legend (one shadow byte represents 8 application bytes):
      Addressable:           00
      Partially addressable: 01 02 03 04 05 06 07
      Heap left redzone:       fa
      Freed heap region:       fd
      Stack left redzone:      f1
      Stack mid redzone:       f2
      Stack right redzone:     f3
      Stack after return:      f5
      Stack use after scope:   f8
      Global redzone:          f9
      Global init order:       f6
      Poisoned by user:        f7
      Container overflow:      fc
      Array cookie:            ac
      Intra object redzone:    bb
      ASan internal:           fe
      Left alloca redzone:     ca
      Right alloca redzone:    cb
      Shadow gap:              cc
    ==15062==ABORTING

Fix this bug by using `size_t` instead to count the number of attributes
so that this value cannot reasonably overflow without running out of
memory before already.

Reported-by: Markus Vervier <markus.vervier@x41-dsec.de>
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-05 15:14:16 +09:00
2455720950 attr: fix integer overflow when parsing huge attribute names
It is possible to trigger an integer overflow when parsing attribute
names that are longer than 2^31 bytes because we assign the result of
strlen(3P) to an `int` instead of to a `size_t`. This can lead to an
abort in vsnprintf(3P) with the following reproducer:

    blob=$(perl -e 'print "A " . "B"x2147483648 . "\n"' | git hash-object -w --stdin)
    git update-index --add --cacheinfo 100644,$blob,.gitattributes
    git check-attr --all path

    BUG: strbuf.c:400: your vsnprintf is broken (returned -1)

But furthermore, assuming that the attribute name is even longer than
that, it can cause us to silently truncate the attribute and thus lead
to wrong results.

Fix this integer overflow by using a `size_t` instead. This fixes the
silent truncation of attribute names, but it only partially fixes the
BUG we hit: even though the initial BUG is fixed, we can still hit a BUG
when parsing invalid attribute lines via `report_invalid_attr()`.

This is due to an underlying design issue in vsnprintf(3P) which only
knows to return an `int`, and thus it may always overflow with large
inputs. This issue is benign though: the worst that can happen is that
the error message is misreported to be either truncated or too long, but
due to the buffer being NUL terminated we wouldn't ever do an
out-of-bounds read here.

Reported-by: Markus Vervier <markus.vervier@x41-dsec.de>
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-05 15:14:16 +09:00
8d0d48cf21 attr: fix out-of-bounds read with huge attribute names
There is an out-of-bounds read possible when parsing gitattributes that
have an attribute that is 2^31+1 bytes long. This is caused due to an
integer overflow when we assign the result of strlen(3P) to an `int`,
where we use the wrapped-around value in a subsequent call to
memcpy(3P). The following code reproduces the issue:

    blob=$(perl -e 'print "a" x 2147483649 . " attr"' | git hash-object -w --stdin)
    git update-index --add --cacheinfo 100644,$blob,.gitattributes
    git check-attr --all file

    AddressSanitizer:DEADLYSIGNAL
    =================================================================
    ==8451==ERROR: AddressSanitizer: SEGV on unknown address 0x7f93efa00800 (pc 0x7f94f1f8f082 bp 0x7ffddb59b3a0 sp 0x7ffddb59ab28 T0)
    ==8451==The signal is caused by a READ memory access.
        #0 0x7f94f1f8f082  (/usr/lib/libc.so.6+0x176082)
        #1 0x7f94f2047d9c in __interceptor_strspn /usr/src/debug/gcc/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:752
        #2 0x560e190f7f26 in parse_attr_line attr.c:375
        #3 0x560e190f9663 in handle_attr_line attr.c:660
        #4 0x560e190f9ddd in read_attr_from_index attr.c:769
        #5 0x560e190f9f14 in read_attr attr.c:797
        #6 0x560e190fa24e in bootstrap_attr_stack attr.c:867
        #7 0x560e190fa4a5 in prepare_attr_stack attr.c:902
        #8 0x560e190fb5dc in collect_some_attrs attr.c:1097
        #9 0x560e190fb93f in git_all_attrs attr.c:1128
        #10 0x560e18e6136e in check_attr builtin/check-attr.c:67
        #11 0x560e18e61c12 in cmd_check_attr builtin/check-attr.c:183
        #12 0x560e18e15993 in run_builtin git.c:466
        #13 0x560e18e16397 in handle_builtin git.c:721
        #14 0x560e18e16b2b in run_argv git.c:788
        #15 0x560e18e17991 in cmd_main git.c:926
        #16 0x560e190ae2bd in main common-main.c:57
        #17 0x7f94f1e3c28f  (/usr/lib/libc.so.6+0x2328f)
        #18 0x7f94f1e3c349 in __libc_start_main (/usr/lib/libc.so.6+0x23349)
        #19 0x560e18e110e4 in _start ../sysdeps/x86_64/start.S:115

    AddressSanitizer can not provide additional info.
    SUMMARY: AddressSanitizer: SEGV (/usr/lib/libc.so.6+0x176082)
    ==8451==ABORTING

Fix this bug by converting the variable to a `size_t` instead.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-05 15:14:16 +09:00
eb22e7dfa2 attr: fix overflow when upserting attribute with overly long name
The function `git_attr_internal()` is called to upsert attributes into
the global map. And while all callers pass a `size_t`, the function
itself accepts an `int` as the attribute name's length. This can lead to
an integer overflow in case the attribute name is longer than `INT_MAX`.

Now this overflow seems harmless as the first thing we do is to call
`attr_name_valid()`, and that function only succeeds in case all chars
in the range of `namelen` match a certain small set of chars. We thus
can't do an out-of-bounds read as NUL is not part of that set and all
strings passed to this function are NUL-terminated. And furthermore, we
wouldn't ever read past the current attribute name anyway due to the
same reason. And if validation fails we will return early.

On the other hand it feels fragile to rely on this behaviour, even more
so given that we pass `namelen` to `FLEX_ALLOC_MEM()`. So let's instead
just do the correct thing here and accept a `size_t` as line length.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
2022-12-05 15:14:16 +09:00
986 changed files with 20714 additions and 47652 deletions

View File

@ -23,8 +23,8 @@ jobs:
base=${{ github.event.before }}
head=${{ github.event.after }}
fi
echo base=$base >>$GITHUB_OUTPUT
echo head=$head >>$GITHUB_OUTPUT
echo "::set-output name=base::$base"
echo "::set-output name=head::$head"
- name: Run partial clone
run: |
git -c init.defaultBranch=master init --bare .

View File

@ -34,17 +34,17 @@ jobs:
then
enabled=no
fi
echo "enabled=$enabled" >>$GITHUB_OUTPUT
echo "::set-output name=enabled::$enabled"
- name: skip if the commit or tree was already tested
id: skip-if-redundant
uses: actions/github-script@v6
uses: actions/github-script@v3
if: steps.check-ref.outputs.enabled == 'yes'
with:
github-token: ${{secrets.GITHUB_TOKEN}}
script: |
try {
// Figure out workflow ID, commit and tree
const { data: run } = await github.rest.actions.getWorkflowRun({
const { data: run } = await github.actions.getWorkflowRun({
owner: context.repo.owner,
repo: context.repo.repo,
run_id: context.runId,
@ -54,7 +54,7 @@ jobs:
const tree_id = run.head_commit.tree_id;
// See whether there is a successful run for that commit or tree
const { data: runs } = await github.rest.actions.listWorkflowRuns({
const { data: runs } = await github.actions.listWorkflowRuns({
owner: context.repo.owner,
repo: context.repo.repo,
per_page: 500,
@ -83,7 +83,7 @@ jobs:
if: needs.ci-config.outputs.enabled == 'yes'
runs-on: windows-latest
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v2
- uses: git-for-windows/setup-git-for-windows-sdk@v1
- name: build
shell: bash
@ -94,7 +94,7 @@ jobs:
- name: zip up tracked files
run: git archive -o artifacts/tracked.tar.gz HEAD
- name: upload tracked files and build artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v2
with:
name: windows-artifacts
path: artifacts
@ -108,7 +108,7 @@ jobs:
nr: [0, 1, 2, 3, 4, 5, 6, 7, 8, 9]
steps:
- name: download tracked files and build artifacts
uses: actions/download-artifact@v3
uses: actions/download-artifact@v2
with:
name: windows-artifacts
path: ${{github.workspace}}
@ -125,7 +125,7 @@ jobs:
run: ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v2
with:
name: failed-tests-windows
path: ${{env.FAILED_TEST_ARTIFACTS}}
@ -138,10 +138,10 @@ jobs:
GIT_CONFIG_PARAMETERS: "'user.name=CI' 'user.email=ci@git'"
runs-on: windows-latest
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v2
- uses: git-for-windows/setup-git-for-windows-sdk@v1
- name: initialize vcpkg
uses: actions/checkout@v3
uses: actions/checkout@v2
with:
repository: 'microsoft/vcpkg'
path: 'compat/vcbuild/vcpkg'
@ -177,7 +177,7 @@ jobs:
- name: zip up tracked files
run: git archive -o artifacts/tracked.tar.gz HEAD
- name: upload tracked files and build artifacts
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v2
with:
name: vs-artifacts
path: artifacts
@ -192,7 +192,7 @@ jobs:
steps:
- uses: git-for-windows/setup-git-for-windows-sdk@v1
- name: download tracked files and build artifacts
uses: actions/download-artifact@v3
uses: actions/download-artifact@v2
with:
name: vs-artifacts
path: ${{github.workspace}}
@ -210,7 +210,7 @@ jobs:
run: ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v2
with:
name: failed-tests-windows
path: ${{env.FAILED_TEST_ARTIFACTS}}
@ -227,34 +227,30 @@ jobs:
pool: ubuntu-latest
- jobname: linux-sha256
cc: clang
os: ubuntu
pool: ubuntu-latest
- jobname: linux-gcc
cc: gcc
cc_package: gcc-8
pool: ubuntu-20.04
pool: ubuntu-latest
- jobname: linux-TEST-vars
cc: gcc
os: ubuntu
cc_package: gcc-8
pool: ubuntu-20.04
pool: ubuntu-latest
- jobname: osx-clang
cc: clang
pool: macos-12
pool: macos-latest
- jobname: osx-gcc
cc: gcc
cc_package: gcc-9
pool: macos-12
pool: macos-latest
- jobname: linux-gcc-default
cc: gcc
pool: ubuntu-latest
- jobname: linux-leaks
cc: gcc
pool: ubuntu-latest
- jobname: linux-asan
cc: gcc
pool: ubuntu-latest
- jobname: linux-ubsan
cc: gcc
pool: ubuntu-latest
env:
CC: ${{matrix.vector.cc}}
CC_PACKAGE: ${{matrix.vector.cc_package}}
@ -262,14 +258,16 @@ jobs:
runs_on_pool: ${{matrix.vector.pool}}
runs-on: ${{matrix.vector.pool}}
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v2
- run: ci/install-dependencies.sh
- run: ci/run-build-and-tests.sh
- run: ci/print-test-failures.sh
- name: print test failures
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
shell: bash
run: ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v2
with:
name: failed-tests-${{matrix.vector.jobname}}
path: ${{env.FAILED_TEST_ARTIFACTS}}
@ -284,6 +282,7 @@ jobs:
- jobname: linux-musl
image: alpine
- jobname: linux32
os: ubuntu32
image: daald/ubuntu32:xenial
- jobname: pedantic
image: fedora
@ -292,22 +291,15 @@ jobs:
runs-on: ubuntu-latest
container: ${{matrix.vector.image}}
steps:
- uses: actions/checkout@v3
if: matrix.vector.jobname != 'linux32'
- uses: actions/checkout@v1
if: matrix.vector.jobname == 'linux32'
- run: ci/install-docker-dependencies.sh
- run: ci/run-build-and-tests.sh
- run: ci/print-test-failures.sh
- name: print test failures
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
shell: bash
run: ci/print-test-failures.sh
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != '' && matrix.vector.jobname != 'linux32'
uses: actions/upload-artifact@v3
with:
name: failed-tests-${{matrix.vector.jobname}}
path: ${{env.FAILED_TEST_ARTIFACTS}}
- name: Upload failed tests' directories
if: failure() && env.FAILED_TEST_ARTIFACTS != '' && matrix.vector.jobname == 'linux32'
if: failure() && env.FAILED_TEST_ARTIFACTS != ''
uses: actions/upload-artifact@v1
with:
name: failed-tests-${{matrix.vector.jobname}}
@ -319,7 +311,7 @@ jobs:
jobname: StaticAnalysis
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v2
- run: ci/install-dependencies.sh
- run: ci/run-static-analysis.sh
- run: ci/check-directional-formatting.bash
@ -339,7 +331,7 @@ jobs:
artifact: sparse-20.04
- name: Install the current `sparse` package
run: sudo dpkg -i sparse-20.04/sparse_*.deb
- uses: actions/checkout@v3
- uses: actions/checkout@v2
- name: Install other dependencies
run: ci/install-dependencies.sh
- run: make sparse
@ -351,6 +343,6 @@ jobs:
jobname: Documentation
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v2
- run: ci/install-dependencies.sh
- run: ci/test-documentation.sh

10
.gitignore vendored
View File

@ -1,5 +1,7 @@
/fuzz-commit-graph
/fuzz_corpora
/GIT-BUILD-DIR
/fuzz-pack-headers
/fuzz-pack-idx
/GIT-BUILD-OPTIONS
/GIT-CFLAGS
/GIT-LDFLAGS
@ -8,7 +10,6 @@
/GIT-PERL-HEADER
/GIT-PYTHON-VARS
/GIT-SCRIPT-DEFINES
/GIT-SPATCH-DEFINES
/GIT-USER-AGENT
/GIT-VERSION-FILE
/bin-wrappers/
@ -52,7 +53,6 @@
/git-cvsimport
/git-cvsserver
/git-daemon
/git-diagnose
/git-diff
/git-diff-files
/git-diff-index
@ -180,14 +180,11 @@
/git-verify-commit
/git-verify-pack
/git-verify-tag
/git-version
/git-web--browse
/git-whatchanged
/git-worktree
/git-write-tree
/scalar
/git-core-*/?*
/git.res
/gitweb/GITWEB-BUILD-OPTIONS
/gitweb/gitweb.cgi
/gitweb/static/gitweb.js
@ -228,6 +225,7 @@
*.hcc
*.obj
*.lib
*.res
*.sln
*.sp
*.suo

View File

@ -165,7 +165,6 @@ Mark Rada <marada@uwaterloo.ca>
Martin Langhoff <martin@laptop.org> <martin@catalyst.net.nz>
Martin von Zweigbergk <martinvonz@gmail.com> <martin.von.zweigbergk@gmail.com>
Masaya Suzuki <masayasuzuki@google.com> <draftcode@gmail.com>
Matheus Tavares <matheus.tavb@gmail.com> <matheus.bernardino@usp.br>
Matt Draisey <matt@draisey.ca> <mattdraisey@sympatico.ca>
Matt Kraai <kraai@ftbfs.org> <matt.kraai@amo.abbott.com>
Matt McCutchen <matt@mattmccutchen.net> <hashproduct@gmail.com>

View File

@ -162,6 +162,8 @@ For shell scripts specifically (not exhaustive):
- We do not use \{m,n\};
- We do not use -E;
- We do not use ? or + (which are \{0,1\} and \{1,\}
respectively in BRE) but that goes without saying as these
are ERE elements not BRE (note that \? and \+ are not even part
@ -202,19 +204,10 @@ For C programs:
by e.g. "echo DEVELOPER=1 >>config.mak".
- We try to support a wide range of C compilers to compile Git with,
including old ones. As of Git v2.35.0 Git requires C99 (we check
"__STDC_VERSION__"). You should not use features from a newer C
including old ones. You should not use features from newer C
standard, even if your compiler groks them.
New C99 features have been phased in gradually, if something's new
in C99 but not used yet don't assume that it's safe to use, some
compilers we target have only partial support for it. These are
considered safe to use:
. since around 2007 with 2b6854c863a, we have been using
initializer elements which are not computable at load time. E.g.:
const char *args[] = {"constant", variable, NULL};
There are a few exceptions to this guideline:
. since early 2012 with e1327023ea, we have been using an enum
definition whose last element is followed by a comma. This, like
@ -230,24 +223,18 @@ For C programs:
. since early 2021 with 765dc168882, we have been using variadic
macros, mostly for printf-like trace and debug macros.
. since late 2021 with 44ba10d6, we have had variables declared in
the for loop "for (int i = 0; i < 10; i++)".
New C99 features that we cannot use yet:
. %z and %zu as a printf() argument for a size_t (the %z being for
the POSIX-specific ssize_t). Instead you should use
printf("%"PRIuMAX, (uintmax_t)v). These days the MSVC version we
rely on supports %z, but the C library used by MinGW does not.
. Shorthand like ".a.b = *c" in struct initializations is known to
trip up an older IBM XLC version, use ".a = { .b = *c }" instead.
See the 33665d98 (reftable: make assignments portable to AIX xlc
v12.01, 2022-03-28).
These used to be forbidden, but we have not heard any breakage
report, and they are assumed to be safe.
- Variables have to be declared at the beginning of the block, before
the first statement (i.e. -Wdeclaration-after-statement).
- Declaring a variable in the for loop "for (int i = 0; i < 10; i++)"
is still not allowed in this codebase. We are in the process of
allowing it by waiting to see that 44ba10d6 (revision: use C99
declaration of variable in for() loop, 2021-11-14) does not get
complaints. Let's revisit this around November 2022.
- NULL pointers shall be written as NULL, not as 0.
- When declaring pointers, the star sides with the variable
@ -619,7 +606,7 @@ Writing Documentation:
avoidance of gendered pronouns.
- When it becomes awkward to stick to this style, prefer "you" when
addressing the hypothetical user, and possibly "we" when
addressing the the hypothetical user, and possibly "we" when
discussing how the program might react to the user. E.g.
You can use this option instead of --xyz, but we might remove
@ -663,8 +650,8 @@ Writing Documentation:
(One or more of <file>.)
Optional parts are enclosed in square brackets:
[<file>...]
(Zero or more of <file>.)
[<extra>]
(Zero or one <extra>.)
--exec-path[=<path>]
(Option with an optional argument. Note that the "=" is inside the
@ -678,16 +665,6 @@ Writing Documentation:
[-q | --quiet]
[--utf8 | --no-utf8]
Use spacing around "|" token(s), but not immediately after opening or
before closing a [] or () pair:
Do: [-q | --quiet]
Don't: [-q|--quiet]
Don't use spacing around "|" tokens when they're used to seperate the
alternate arguments of an option:
Do: --track[=(direct|inherit)]
Don't: --track[=(direct | inherit)]
Parentheses are used for grouping:
[(<rev> | <range>)...]
(Any number of either <rev> or <range>. Parens are needed to make

View File

@ -21,25 +21,13 @@ MAN1_TXT += $(filter-out \
MAN1_TXT += git.txt
MAN1_TXT += gitk.txt
MAN1_TXT += gitweb.txt
MAN1_TXT += scalar.txt
# man5 / man7 guides (note: new guides should also be added to command-list.txt)
MAN5_TXT += gitattributes.txt
MAN5_TXT += gitformat-bundle.txt
MAN5_TXT += gitformat-chunk.txt
MAN5_TXT += gitformat-commit-graph.txt
MAN5_TXT += gitformat-index.txt
MAN5_TXT += gitformat-pack.txt
MAN5_TXT += gitformat-signature.txt
MAN5_TXT += githooks.txt
MAN5_TXT += gitignore.txt
MAN5_TXT += gitmailmap.txt
MAN5_TXT += gitmodules.txt
MAN5_TXT += gitprotocol-capabilities.txt
MAN5_TXT += gitprotocol-common.txt
MAN5_TXT += gitprotocol-http.txt
MAN5_TXT += gitprotocol-pack.txt
MAN5_TXT += gitprotocol-v2.txt
MAN5_TXT += gitrepository-layout.txt
MAN5_TXT += gitweb.conf.txt
@ -63,7 +51,6 @@ HOWTO_TXT += $(wildcard howto/*.txt)
DOC_DEP_TXT += $(wildcard *.txt)
DOC_DEP_TXT += $(wildcard config/*.txt)
DOC_DEP_TXT += $(wildcard includes/*.txt)
ifdef MAN_FILTER
MAN_TXT = $(filter $(MAN_FILTER),$(MAN1_TXT) $(MAN5_TXT) $(MAN7_TXT))
@ -103,24 +90,31 @@ SP_ARTICLES += howto/coordinate-embargoed-releases
API_DOCS = $(patsubst %.txt,%,$(filter-out technical/api-index-skel.txt technical/api-index.txt, $(wildcard technical/api-*.txt)))
SP_ARTICLES += $(API_DOCS)
TECH_DOCS += ReviewingGuidelines
TECH_DOCS += MyFirstContribution
TECH_DOCS += MyFirstObjectWalk
TECH_DOCS += SubmittingPatches
TECH_DOCS += ToolsForGit
TECH_DOCS += technical/bitmap-format
TECH_DOCS += technical/bundle-uri
TECH_DOCS += technical/bundle-format
TECH_DOCS += technical/cruft-packs
TECH_DOCS += technical/hash-function-transition
TECH_DOCS += technical/http-protocol
TECH_DOCS += technical/index-format
TECH_DOCS += technical/long-running-process-protocol
TECH_DOCS += technical/multi-pack-index
TECH_DOCS += technical/pack-format
TECH_DOCS += technical/pack-heuristics
TECH_DOCS += technical/pack-protocol
TECH_DOCS += technical/parallel-checkout
TECH_DOCS += technical/partial-clone
TECH_DOCS += technical/protocol-capabilities
TECH_DOCS += technical/protocol-common
TECH_DOCS += technical/protocol-v2
TECH_DOCS += technical/racy-git
TECH_DOCS += technical/reftable
TECH_DOCS += technical/scalar
TECH_DOCS += technical/send-pack-pipeline
TECH_DOCS += technical/shallow
TECH_DOCS += technical/signature-format
TECH_DOCS += technical/trivial-merge
SP_ARTICLES += $(TECH_DOCS)
SP_ARTICLES += technical/api-index
@ -296,8 +290,6 @@ cmds_txt = cmds-ancillaryinterrogators.txt \
cmds-synchingrepositories.txt \
cmds-synchelpers.txt \
cmds-guide.txt \
cmds-developerinterfaces.txt \
cmds-userinterfaces.txt \
cmds-purehelpers.txt \
cmds-foreignscminterface.txt
@ -351,16 +343,8 @@ $(OBSOLETE_HTML): %.html : %.txto $(ASCIIDOC_DEPS)
manpage-base-url.xsl: manpage-base-url.xsl.in
$(QUIET_GEN)sed "s|@@MAN_BASE_URL@@|$(MAN_BASE_URL)|" $< > $@
manpage-prereqs := manpage-base-url.xsl $(wildcard manpage*.xsl)
manpage-cmd = $(QUIET_XMLTO)$(XMLTO) -m $(MANPAGE_XSL) $(XMLTO_EXTRA) man $<
%.1 : %.xml $(manpage-prereqs)
$(manpage-cmd)
%.5 : %.xml $(manpage-prereqs)
$(manpage-cmd)
%.7 : %.xml $(manpage-prereqs)
$(manpage-cmd)
%.1 %.5 %.7 : %.xml manpage-base-url.xsl $(wildcard manpage*.xsl)
$(QUIET_XMLTO)$(XMLTO) -m $(MANPAGE_XSL) $(XMLTO_EXTRA) man $<
%.xml : %.txt $(ASCIIDOC_DEPS)
$(QUIET_ASCIIDOC)$(TXT_TO_XML) -d manpage -o $@ $<
@ -484,19 +468,8 @@ $(LINT_DOCS_MAN_SECTION_ORDER): .build/lint-docs/man-section-order/%.ok: %.txt
.PHONY: lint-docs-man-section-order
lint-docs-man-section-order: $(LINT_DOCS_MAN_SECTION_ORDER)
.PHONY: lint-docs-fsck-msgids
LINT_DOCS_FSCK_MSGIDS = .build/lint-docs/fsck-msgids.ok
$(LINT_DOCS_FSCK_MSGIDS): lint-fsck-msgids.perl
$(LINT_DOCS_FSCK_MSGIDS): ../fsck.h fsck-msgids.txt
$(call mkdir_p_parent_template)
$(QUIET_GEN)$(PERL_PATH) lint-fsck-msgids.perl \
../fsck.h fsck-msgids.txt $@
lint-docs-fsck-msgids: $(LINT_DOCS_FSCK_MSGIDS)
## Lint: list of targets above
.PHONY: lint-docs
lint-docs: lint-docs-fsck-msgids
lint-docs: lint-docs-gitlink
lint-docs: lint-docs-man-end-blurb
lint-docs: lint-docs-man-section-order

View File

@ -736,7 +736,7 @@ the {lore}[Git mailing list archive]:
2022-02-21 1:43 ` John Cai
2022-02-21 1:50 ` Taylor Blau
2022-02-23 19:50 ` John Cai
2022-02-18 20:00 ` // other replies elided
2022-02-18 20:00 ` // other replies ellided
2022-02-18 18:40 ` [PATCH 2/3] reflog: call reflog_delete from reflog.c John Cai via GitGitGadget
2022-02-18 19:15 ` Ævar Arnfjörð Bjarmason
2022-02-18 20:26 ` Junio C Hamano
@ -1160,7 +1160,7 @@ all named like `v2-000n-my-commit-subject.patch`. `-v2` will also format
your patches by prefixing them with "[PATCH v2]" instead of "[PATCH]",
and your range-diff will be prefaced with "Range-diff against v1".
After you run this command, `format-patch` will output the patches to the `psuh/`
Afer you run this command, `format-patch` will output the patches to the `psuh/`
directory, alongside the v1 patches. Using a single directory makes it easy to
refer to the old v1 patches while proofreading the v2 patches, but you will need
to be careful to send out only the v2 patches. We will use a pattern like

View File

@ -534,7 +534,7 @@ the arguments to `traverse_commit_list()`.
- `void *show_data`: A context buffer which is passed in turn to `show_commit`
and `show_object`.
In addition, `traverse_commit_list_filtered()` has an additional parameter:
In addition, `traverse_commit_list_filtered()` has an additional paramter:
- `struct oidset *omitted`: A linked-list of object IDs which the provided
filter caused to be omitted.

View File

@ -0,0 +1,86 @@
Git v2.30.7 Release Notes
=========================
This release addresses the security issues CVE-2022-41903 and
CVE-2022-23521.
Fixes since v2.30.6
-------------------
* CVE-2022-41903:
git log has the ability to display commits using an arbitrary
format with its --format specifiers. This functionality is also
exposed to git archive via the export-subst gitattribute.
When processing the padding operators (e.g., %<(, %<|(, %>(,
%>>(, or %><( ), an integer overflow can occur in
pretty.c::format_and_pad_commit() where a size_t is improperly
stored as an int, and then added as an offset to a subsequent
memcpy() call.
This overflow can be triggered directly by a user running a
command which invokes the commit formatting machinery (e.g., git
log --format=...). It may also be triggered indirectly through
git archive via the export-subst mechanism, which expands format
specifiers inside of files within the repository during a git
archive.
This integer overflow can result in arbitrary heap writes, which
may result in remote code execution.
* CVE-2022-23521:
gitattributes are a mechanism to allow defining attributes for
paths. These attributes can be defined by adding a `.gitattributes`
file to the repository, which contains a set of file patterns and
the attributes that should be set for paths matching this pattern.
When parsing gitattributes, multiple integer overflows can occur
when there is a huge number of path patterns, a huge number of
attributes for a single pattern, or when the declared attribute
names are huge.
These overflows can be triggered via a crafted `.gitattributes` file
that may be part of the commit history. Git silently splits lines
longer than 2KB when parsing gitattributes from a file, but not when
parsing them from the index. Consequentially, the failure mode
depends on whether the file exists in the working tree, the index or
both.
This integer overflow can result in arbitrary heap reads and writes,
which may result in remote code execution.
Credit for finding CVE-2022-41903 goes to Joern Schneeweisz of GitLab.
An initial fix was authored by Markus Vervier of X41 D-Sec. Credit for
finding CVE-2022-23521 goes to Markus Vervier and Eric Sesterhenn of X41
D-Sec. This work was sponsored by OSTIF.
The proposed fixes have been polished and extended to cover additional
findings by Patrick Steinhardt of GitLab, with help from others on the
Git security mailing list.
Patrick Steinhardt (21):
attr: fix overflow when upserting attribute with overly long name
attr: fix out-of-bounds read with huge attribute names
attr: fix integer overflow when parsing huge attribute names
attr: fix out-of-bounds write when parsing huge number of attributes
attr: fix out-of-bounds read with unreasonable amount of patterns
attr: fix integer overflow with more than INT_MAX macros
attr: harden allocation against integer overflows
attr: fix silently splitting up lines longer than 2048 bytes
attr: ignore attribute lines exceeding 2048 bytes
attr: ignore overly large gitattributes files
pretty: fix out-of-bounds write caused by integer overflow
pretty: fix out-of-bounds read when left-flushing with stealing
pretty: fix out-of-bounds read when parsing invalid padding format
pretty: fix adding linefeed when placeholder is not expanded
pretty: fix integer overflow in wrapping format
utf8: fix truncated string lengths in `utf8_strnwidth()`
utf8: fix returning negative string width
utf8: fix overflow when returning string width
utf8: fix checking for glyph width in `strbuf_utf8_replace()`
utf8: refactor `strbuf_utf8_replace` to not rely on preallocated buffer
pretty: restrict input lengths for padding and wrapping formats

View File

@ -0,0 +1,52 @@
Git v2.30.8 Release Notes
=========================
This release addresses the security issues CVE-2023-22490 and
CVE-2023-23946.
Fixes since v2.30.7
-------------------
* CVE-2023-22490:
Using a specially-crafted repository, Git can be tricked into using
its local clone optimization even when using a non-local transport.
Though Git will abort local clones whose source $GIT_DIR/objects
directory contains symbolic links (c.f., CVE-2022-39253), the objects
directory itself may still be a symbolic link.
These two may be combined to include arbitrary files based on known
paths on the victim's filesystem within the malicious repository's
working copy, allowing for data exfiltration in a similar manner as
CVE-2022-39253.
* CVE-2023-23946:
By feeding a crafted input to "git apply", a path outside the
working tree can be overwritten as the user who is running "git
apply".
* A mismatched type in `attr.c::read_attr_from_index()` which could
cause Git to errantly reject attributes on Windows and 32-bit Linux
has been corrected.
Credit for finding CVE-2023-22490 goes to yvvdwf, and the fix was
developed by Taylor Blau, with additional help from others on the
Git security mailing list.
Credit for finding CVE-2023-23946 goes to Joern Schneeweisz, and the
fix was developed by Patrick Steinhardt.
Johannes Schindelin (1):
attr: adjust a mismatched data type
Patrick Steinhardt (1):
apply: fix writing behind newly created symbolic links
Taylor Blau (3):
t5619: demonstrate clone_local() with ambiguous transport
clone: delay picking a transport until after get_repo_path()
dir-iterator: prevent top-level symlinks without FOLLOW_SYMLINKS

View File

@ -0,0 +1,5 @@
Git v2.31.6 Release Notes
=========================
This release merges the security fix that appears in v2.30.7; see
the release notes for that version for details.

View File

@ -0,0 +1,6 @@
Git v2.31.7 Release Notes
=========================
This release merges up the fixes that appear in v2.30.8 to
address the security issues CVE-2023-22490 and CVE-2023-23946;
see the release notes for that version for details.

View File

@ -0,0 +1,8 @@
Git v2.32.5 Release Notes
=========================
This release merges the security fix that appears in v2.30.7; see
the release notes for that version for details.
In addition, included are additional code for "git fsck" to check
for questionable .gitattributes files.

View File

@ -0,0 +1,6 @@
Git v2.32.6 Release Notes
=========================
This release merges up the fixes that appear in v2.30.8 and v2.31.7
to address the security issues CVE-2023-22490 and CVE-2023-23946;
see the release notes for these versions for details.

View File

@ -0,0 +1,5 @@
Git v2.33.6 Release Notes
=========================
This release merges the security fix that appears in v2.30.7; see
the release notes for that version for details.

View File

@ -0,0 +1,7 @@
Git v2.33.7 Release Notes
=========================
This release merges up the fixes that appear in v2.30.8, v2.31.7
and v2.32.6 to address the security issues CVE-2023-22490 and
CVE-2023-23946; see the release notes for these versions for
details.

View File

@ -0,0 +1,5 @@
Git v2.34.6 Release Notes
=========================
This release merges the security fix that appears in v2.30.7; see
the release notes for that version for details.

View File

@ -0,0 +1,7 @@
Git v2.34.7 Release Notes
=========================
This release merges up the fixes that appear in v2.30.8, v2.31.7,
v2.32.6 and v2.33.7 to address the security issues CVE-2023-22490
and CVE-2023-23946; see the release notes for these versions
for details.

View File

@ -0,0 +1,5 @@
Git v2.35.6 Release Notes
=========================
This release merges the security fix that appears in v2.30.7; see
the release notes for that version for details.

View File

@ -0,0 +1,7 @@
Git v2.35.7 Release Notes
=========================
This release merges up the fixes that appear in v2.30.8, v2.31.7,
v2.32.6, v2.33.7 and v2.34.7 to address the security issues
CVE-2023-22490 and CVE-2023-23946; see the release notes for
these versions for details.

View File

@ -0,0 +1,5 @@
Git v2.36.4 Release Notes
=========================
This release merges the security fix that appears in v2.30.7; see
the release notes for that version for details.

View File

@ -0,0 +1,7 @@
Git v2.36.5 Release Notes
=========================
This release merges up the fixes that appear in v2.30.8, v2.31.7,
v2.32.6, v2.33.7, v2.34.7 and v2.35.7 to address the security
issues CVE-2023-22490 and CVE-2023-23946; see the release notes
for these versions for details.

View File

@ -0,0 +1,5 @@
Git v2.37.5 Release Notes
=========================
This release merges the security fix that appears in v2.30.7; see
the release notes for that version for details.

View File

@ -0,0 +1,7 @@
Git v2.37.6 Release Notes
=========================
This release merges up the fixes that appear in v2.30.8, v2.31.7,
v2.32.6, v2.33.7, v2.34.7, v2.35.7 and v2.36.5 to address the
security issues CVE-2023-22490 and CVE-2023-23946; see the release
notes for these versions for details.

View File

@ -1,404 +0,0 @@
Git v2.38 Release Notes
=======================
UI, Workflows & Features
* "git remote show [-n] frotz" now pays attention to negative
pathspec.
* "git push" sometimes performs poorly when reachability bitmaps are
used, even in a repository where other operations are helped by
bitmaps. The push.useBitmaps configuration variable is introduced
to allow disabling use of reachability bitmaps only for "git push".
* "git grep -m<max-hits>" is a way to limit the hits shown per file.
* "git merge-tree" learned a new mode where it takes two commits and
computes a tree that would result in the merge commit, if the
histories leading to these two commits were to be merged.
* "git mv A B" in a sparsely populated working tree can be asked to
move a path between directories that are "in cone" (i.e. expected
to be materialized in the working tree) and "out of cone"
(i.e. expected to be hidden). The handling of such cases has been
improved.
* Earlier, HTTP transport clients learned to tell the server side
what locale they are in by sending Accept-Language HTTP header, but
this was done only for some requests but not others.
* Introduce a safe.barerepository configuration variable that
allows users to forbid discovery of bare repositories.
* Various messages that come from the pack-bitmap codepaths have been
tweaked.
* "git rebase -i" learns to update branches whose tip appear in the
rebased range with "--update-refs" option.
* "git ls-files" learns the "--format" option to tweak its output.
* "git cat-file" learned an option to use the mailmap when showing
commit and tag objects.
* When "git merge" finds that it cannot perform a merge, it should
restore the working tree to the state before the command was
initiated, but in some corner cases it didn't.
* Operating modes like "--batch" of "git cat-file" command learned to
take NUL-terminated input, instead of one-item-per-line.
* "git rm" has become more aware of the sparse-index feature.
* "git rev-list --disk-usage" learned to take an optional value
"human" to show the reported value in human-readable format, like
"3.40MiB".
* The "diagnose" feature to create a zip archive for diagnostic
material has been lifted from "scalar" and made into a feature of
"git bugreport".
* The namespaces used by "log --decorate" from "refs/" hierarchy by
default has been tightened.
* "git rev-list --ancestry-path=C A..B" is a natural extension of
"git rev-list A..B"; instead of choosing a subset of A..B to those
that have ancestry relationship with A, it lets a subset with
ancestry relationship with C.
* "scalar" now enables built-in fsmonitor on enlisted repositories,
when able.
* The bash prompt (in contrib/) learned to optionally indicate when
the index is unmerged.
* "git clone" command learned the "--bundle-uri" option to coordinate
with hosting sites the use of pre-prepared bundle files.
* "git range-diff" learned to honor pathspec argument if given.
* "git format-patch --from=<ident>" can be told to add an in-body
"From:" line even for commits that are authored by the given
<ident> with "--force-in-body-from" option.
* The built-in fsmonitor refuses to work on a network mounted
repositories; a configuration knob for users to override this has
been introduced.
* The "scalar" addition from Microsoft is now part of the core Git
installation.
Performance, Internal Implementation, Development Support etc.
* Collection of what is referenced by objects in promisor packs have
been optimized to inspect these objects in the in-pack order.
* Introduce a helper to see if a branch is already being worked on
(hence should not be newly checked out in a working tree), which
performs much better than the existing find_shared_symref() to
replace many uses of the latter.
* Teach "git archive" to (optionally and then by default) avoid
spawning an external "gzip" process when creating ".tar.gz" (and
".tgz") archives.
* Allow large objects read from a packstream to be streamed into a
loose object file straight, without having to keep it in-core as a
whole.
* Further preparation to turn git-submodule.sh into a builtin
continues.
* Apply Coccinelle rule to turn raw memmove() into MOVE_ARRAY() cpp
macro, which would improve maintainability and readability.
* Teach "make all" to build gitweb as well.
* Tweak tests so that they still work when the "git init" template
did not create .git/info directory.
* Add Coccinelle rules to detect the pattern of initializing and then
finalizing a structure without using it in between at all, which
happens after code restructuring and the compilers fail to
recognize as an unused variable.
* The code to convert between GPG trust level strings and internal
constants we use to represent them have been cleaned up.
* Support for libnettle as SHA256 implementation has been added.
* The way "git multi-pack" uses parse-options API has been improved.
* A Coccinelle rule (in contrib/) to encourage use of COPY_ARRAY
macro has been improved.
* API tweak to make it easier to run fuzz testing on commit-graph parser.
* Omit fsync-related trace2 entries when their values are all zero.
* The codepath to write multi-pack index has been taught to release a
large chunk of memory that holds an array of objects in the packs,
as soon as it is done with the array, to reduce memory consumption.
* Add a level of redirection to array allocation API in xdiff part,
to make it easier to share with the libgit2 project.
* "git fetch" client logs the partial clone filter used in the trace2
output.
* The "bundle URI" design gets documented.
* The common ancestor negotiation exchange during a "git fetch"
session now leaves trace log.
* Test portability improvements.
(merge 4d1d843be7 mt/rot13-in-c later to maint).
* The "subcommand" mode is introduced to parse-options API and update
the command line parser of Git commands with subcommands.
* The pack bitmap file gained a bitmap-lookup table to speed up
locating the necessary bitmap for a given commit.
* The assembly version of SHA-1 implementation for PPC has been
removed.
* The server side that responds to "git fetch" and "git clone"
request has been optimized by allowing it to send objects in its
object store without recomputing and validating the object names.
* Annotate function parameters that are not used (but cannot be
removed for structural reasons), to prepare us to later compile
with -Wunused warning turned on.
* Share the text used to explain configuration variables used by "git
<subcmd>" in "git help <subcmd>" with the text from "git help config".
* "git mv A B" in a sparsely populated working tree can be asked to
move a path from a directory that is "in cone" to another directory
that is "out of cone". Handling of such a case has been improved.
* The chainlint script for our tests has been revamped.
Fixes since v2.37
-----------------
* Rewrite of "git add -i" in C that appeared in Git 2.25 didn't
correctly record a removed file to the index, which was fixed.
* Certain diff options are currently ignored when combined-diff is
shown; mark them as incompatible with the feature.
* Adjust technical/bitmap-format to be formatted by AsciiDoc, and
add some missing information to the documentation.
* Fixes for tests when the source directory has unusual characters in
its path, e.g. whitespaces, double-quotes, etc.
* "git mktree --missing" lazily fetched objects that are missing from
the local object store, which was totally unnecessary for the purpose
of creating the tree object(s) from its input.
* Give _() markings to fatal/warning/usage: labels that are shown in
front of these messages.
* References to commands-to-be-typed-literally in "git rebase"
documentation mark-up have been corrected.
* In a non-bare repository, the behavior of Git when the
core.worktree configuration variable points at a directory that has
a repository as its subdirectory, regressed in Git 2.27 days.
* Recent update to vimdiff layout code has been made more robust
against different end-user vim settings.
* Plug various memory leaks, both in the main code and in test-tool
commands.
* Fixes a long-standing corner case bug around directory renames in
the merge-ort strategy.
* The resolve-undo information in the index was not protected against
GC, which has been corrected.
* A corner case bug where lazily fetching objects from a promisor
remote resulted in infinite recursion has been corrected.
* "git clone" from a repository with some ref whose HEAD is unborn
did not set the HEAD in the resulting repository correctly, which
has been corrected.
* An earlier attempt to plug leaks placed a clean-up label to jump to
at a bogus place, which as been corrected.
* Variable quoting fix in the vimdiff driver of "git mergetool"
* "git shortlog -n" relied on the underlying qsort() to be stable,
which shouldn't have. Fixed.
* A fix for a regression in test framework.
* mkstemp() emulation on Windows has been improved.
* Add missing documentation for "include" and "includeIf" features in
"git config" file format, which incidentally teaches the command
line completion to include them in its offerings.
* Avoid "white/black-list" in documentation and code comments.
* Workaround for a compiler warning against use of die() in
osx-keychain (in contrib/).
* Workaround for a false positive compiler warning.
* "git p4" working on UTF-16 files on Windows did not implement
CRLF-to-LF conversion correctly, which has been corrected.
* "git p4" did not handle non-ASCII client name well, which has been
corrected.
* "rerere-train" script (in contrib/) used to honor commit.gpgSign
while recreating the throw-away merges.
* "git checkout" miscounted the paths it updated, which has been
corrected.
* Fix for a bug that makes write-tree to fail to write out a
non-existent index as a tree, introduced in 2.37.
* There was a bug in the codepath to upgrade generation information
in commit-graph from v1 to v2 format, which has been corrected.
* Gitweb had legacy URL shortener that is specific to the way
projects hosted on kernel.org used to (but no longer) work, which
has been removed.
* Fix build procedure for Windows that uses CMake so that it can pick
up the shell interpreter from local installation location.
* Conditionally allow building Python interpreter on Windows
* Fix to lstat() emulation on Windows.
* Older gcc with -Wall complains about the universal zero initializer
"struct s = { 0 };" idiom, which makes developers' lives
inconvenient (as -Werror is enabled by DEVELOPER=YesPlease). The
build procedure has been tweaked to help these compilers.
* Plug memory leaks in the failure code path in the "merge-ort" merge
strategy backend.
* "git symbolic-ref symref non..sen..se" is now diagnosed as an error.
* A follow-up fix to a fix for a regression in 2.36 around hooks.
* Avoid repeatedly running getconf to ask libc version in the test
suite, and instead just as it once per script.
* Platform-specific code that determines if a directory is OK to use
as a repository has been taught to report more details, especially
on Windows.
* "vimdiff3" regression fix.
* "git fsck" reads mode from tree objects but canonicalizes the mode
before passing it to the logic to check object sanity, which has
hid broken tree objects from the checking logic. This has been
corrected, but to help existing projects with broken tree objects
that they cannot fix retroactively, the severity of anomalies this
code detects has been demoted to "info" for now.
* Fixes to sparse index compatibility work for "reset" and "checkout"
commands.
* An earlier optimization discarded a tree-object buffer that is
still in use, which has been corrected.
* Fix deadlocks between main Git process and subprocess spawned via
the pipe_command() API, that can kill "git add -p" that was
reimplemented in C recently.
* The sequencer machinery translated messages left in the reflog by
mistake, which has been corrected.
* xcalloc(), imitating calloc(), takes "number of elements of the
array", and "size of a single element", in this order. A call that
does not follow this ordering has been corrected.
* The preload-index codepath made copies of pathspec to give to
multiple threads, which were left leaked.
* Update the version of Ubuntu used for GitHub Actions CI from 18.04
to 22.04.
* The auto-stashed local changes created by "git merge --autostash"
was mixed into a conflicted state left in the working tree, which
has been corrected.
* Multi-pack index got corrupted when preferred pack changed from one
pack to another in a certain way, which has been corrected.
(merge 99e4d084ff tb/midx-with-changing-preferred-pack-fix later to maint).
* The clean-up of temporary files created via mks_tempfile_dt() was
racy and attempted to unlink() the leading directory when signals
are involved, which has been corrected.
(merge babe2e0559 rs/tempfile-cleanup-race-fix later to maint).
* FreeBSD portability fix for "git maintenance" that spawns "crontab"
to schedule tasks.
(merge ee69e7884e bc/gc-crontab-fix later to maint).
* Those who use diff-so-fancy as the diff-filter noticed a regression
or two in the code that parses the diff output in the built-in
version of "add -p", which has been corrected.
(merge 0a101676e5 js/add-p-diff-parsing-fix later to maint).
* Segfault fix-up to an earlier fix to the topic to teach "git reset"
and "git checkout" work better in a sparse checkout.
(merge 037f8ea6d9 vd/sparse-reset-checkout-fixes later to maint).
* "git diff --no-index A B" managed its the pathnames of its two
input files rather haphazardly, sometimes leaking them. The
command line argument processing has been straightened out to clean
it up.
(merge 2b43dd0eb5 rs/diff-no-index-cleanup later to maint).
* "git rev-list --verify-objects" ought to inspect the contents of
objects and notice corrupted ones, but it didn't when the commit
graph is in use, which has been corrected.
(merge b27ccae34b jk/rev-list-verify-objects-fix later to maint).
* More fixes to "add -p"
(merge 64ec8efb83 js/builtin-add-p-portability-fix later to maint).
* The parser in the script interface to parse-options in "git
rev-parse" has been updated to diagnose a bogus input correctly.
(merge f20b9c36d0 ow/rev-parse-parseopt-fix later to maint).
* The code that manages list-object-filter structure, used in partial
clones, leaked the instances, which has been plugged.
(merge 66eede4a37 jk/plug-list-object-filter-leaks later to maint).
* Fix another UI regression in the reimplemented "add -p".
(merge f6f0ee247f rs/add-p-worktree-mode-prompt-fix later to maint).
* "git fetch" over protocol v2 sent an incorrect ref prefix request
to the server and made "git pull" with configured fetch refspec
that does not cover the remote branch to merge with fail, which has
been corrected.
(merge 49ca2fba39 jk/proto-v2-ref-prefix-fix later to maint).
* A result from opendir() was leaking in the commit-graph expiration
codepath, which has been plugged.
(merge 12f1ae5324 ml/commit-graph-expire-dir-leak-fix later to maint).
* Just like we have coding guidelines, we now have guidelines for
reviewers.
(merge e01b851923 vd/doc-reviewing-guidelines later to maint).
* Other code cleanup, docfix, build fix, etc.
(merge 77b9e85c0f vd/fix-perf-tests later to maint).
(merge 0682bc43f5 jk/test-crontab-fixes later to maint).
(merge b46dd1726c cc/doc-trailer-whitespace-rules later to maint).

View File

@ -1,5 +0,0 @@
Git v2.38.1 Release Notes
=========================
This release merges the security fix that appears in v2.30.6; see
the release notes for that version for details.

View File

@ -1,67 +0,0 @@
Git 2.38.2 Release Notes
========================
This is to backport various fixes accumulated during the development
towards Git 2.39, the next feature release.
Fixes since v2.38.1
-------------------
* Update CodingGuidelines to clarify what features to use and avoid
in C99.
* The codepath that reads from the index v4 had unaligned memory
accesses, which has been corrected.
* "git remote rename" failed to rename a remote without fetch
refspec, which has been corrected.
* "git clone" did not like to see the "--bare" and the "--origin"
options used together without a good reason.
* Fix messages incorrectly marked for translation.
* "git fsck" failed to release contents of tree objects already used
from the memory, which has been fixed.
* "git rebase -i" can mistakenly attempt to apply a fixup to a commit
itself, which has been corrected.
* In read-only repositories, "git merge-tree" tried to come up with a
merge result tree object, which it failed (which is not wrong) and
led to a segfault (which is bad), which has been corrected.
* Force C locale while running tests around httpd to make sure we can
find expected error messages in the log.
* Fix a logic in "mailinfo -b" that miscomputed the length of a
substring, which lead to an out-of-bounds access.
* The codepath to sign learned to report errors when it fails to read
from "ssh-keygen".
* "GIT_EDITOR=: git branch --edit-description" resulted in failure,
which has been corrected.
* Documentation on various Boolean GIT_* environment variables have
been clarified.
* "git multi-pack-index repack/expire" used to repack unreachable
cruft into a new pack, which have been corrected.
* The code to clean temporary object directories (used for
quarantine) tried to remove them inside its signal handler, which
was a no-no.
* "git branch --edit-description" on an unborh branch misleadingly
said that no such branch exists, which has been corrected.
* GitHub CI settings have been adjusted to recent reality, merging
and cherry-picking necessary topics that have been prepared for Git
2.39.
* `git rebase --update-refs` would delete references when all `update-ref`
commands in the sequencer were removed, which has been corrected.
Also contains various documentation updates and code clean-ups.

View File

@ -1,346 +0,0 @@
Git v2.39 Release Notes
=======================
UI, Workflows & Features
------------------------
* "git grep" learned to expand the sparse-index more lazily and on
demand in a sparse checkout.
* By default, use of fsmonitor on a repository on networked
filesystem is disabled. Add knobs to make it workable on macOS.
* After checking out a "branch" that is a symbolic-ref that points at
another branch, "git symbolic-ref HEAD" reports the underlying
branch, not the symbolic-ref the user gave checkout as argument.
The command learned the "--no-recurse" option to stop after
dereferencing a symbolic-ref only once.
* "git branch --edit-description @{-1}" is now a way to edit branch
description of the branch you were on before switching to the
current branch.
* "git merge-tree --stdin" is a new way to request a series of merges
and report the merge results.
* "git shortlog" learned to group by the "format" string.
* A new "--include-whitespace" option is added to "git patch-id", and
existing bugs in the internal patch-id logic that did not match
what "git patch-id" produces have been corrected.
* Enable gc.cruftpacks by default for those who opt into
feature.experimental setting.
* "git repack" learns to send cruft objects out of the way into
packfiles outside the repository.
* 'scalar reconfigure -a' is taught to automatically remove
scalar.repo entires which no longer exist.
* Redact headers from cURL's h2h3 module in GIT_CURL_VERBOSE and
others.
* 'git maintenance register' is taught to write configuration to an
arbitrary path, and 'git for-each-repo' is taught to expand tilde
characters in paths.
* When creating new notes, the template used to get a stray empty
newline, which has been removed.
* "git receive-pack" used to use all the local refs as the boundary for
checking connectivity of the data "git push" sent, but now it uses
only the refs that it advertised to the pusher. In a repository with
the .hideRefs configuration, this reduces the resources needed to
perform the check.
* With '--recurse-submodules=on-demand', all submodules are
recursively pushed.
Performance, Internal Implementation, Development Support etc.
--------------------------------------------------------------
* With a bit of header twiddling, use the native regexp library on
macOS instead of the compat/ one.
* Prepare for GNU [ef]grep that throw warning of their uses.
* Sources related to fuzz testing have been moved down to their own
directory.
* Most credential helpers ignored unknown entries in a credential
description, but a few died upon seeing them. The latter were
taught to ignore them, too
* "scalar unregister" in a repository that is already been
unregistered reported an error.
* Remove error detection from a function that fetches from promisor
remotes, and make it die when such a fetch fails to bring all the
requested objects, to give an early failure to various operations.
* Update CodingGuidelines to clarify what features to use and avoid
in C99.
* Avoid false-positive from LSan whose assumption may be broken with
higher optimization levels.
* Enable address and undefined sanitizer tasks at GitHub Actions CI.
* More UNUSED annotation to help using -Wunused option with the
compiler.
(merge 4b992f0a24 jk/unused-anno-more later to maint).
* Rewrite a deep recursion in the skipping negotiator to use a loop
with on-heap prio queue to avoid stack wastage.
* Add documentation for message IDs in fsck error messages.
* Define the logical elements of a "bundle list", data structure to
store them in-core, format to transfer them, and code to parse
them.
* The role the security mailing list plays in an embargoed release
has been documented.
* Two new facilities, "timer" and "counter", are introduced to the
trace2 API.
* Code simplification by using strvec_pushf() instead of building an
argument in a separate strbuf.
* Make sure generated dependency file is stably sorted to help
developers debugging their build issues.
* The glossary entries for "commit-graph file" and "reachability
bitmap" have been added.
* Various tests exercising the transfer.credentialsInUrl
configuration are taught to avoid making requests which require
resolving localhost to reduce CI-flakiness.
* A redundant diagnostic message is dropped from test_path_is_missing().
* Simplify the run-command API.
* Update the actions/github-script dependency in CI to avoid a
deprecation warning.
* Progress on being able to initialize a rev_info struct with a
macro.
* Add trace2 counters to the region to clear skip worktree bits in a
sparse checkout.
* Modernize test script to avoid "test -f" and friends.
* Avoid calling 'cache_tree_update()' when doing so would be
redundant.
* Update the credential-cache documentation to provide a more
realistic example.
* Makefile comments updates and reordering to clarify knobs used to
choose SHA implementations.
* A design document for sparse-checkout's future directions has been
added.
* Teach chainlint.pl to annotate the original test definition instead
of the token stream.
* "make coccicheck" is time consuming. It has been made to run more
incrementally.
* `parse_object()` has been hardened to check for the existence of a
suspected blob object.
* The build procedure has been adjusted to GNUmake version 4.4, which
made some changes to how pattern rule with multiple targets are
handled.
Fixes since v2.38
-----------------
* The codepath that reads from the index v4 had unaligned memory
accesses, which has been corrected.
* Fix messages incorrectly marked for translation.
* "git fsck" failed to release contents of tree objects already used
from the memory, which has been fixed.
* "git clone" did not like to see the "--bare" and the "--origin"
options used together without a good reason.
* "git remote rename" failed to rename a remote without fetch
refspec, which has been corrected.
* Documentation on various Boolean GIT_* environment variables have
been clarified.
* "git rebase -i" can mistakenly attempt to apply a fixup to a commit
itself, which has been corrected.
* "git multi-pack-index repack/expire" used to repack unreachable
cruft into a new pack, which have been corrected.
* In read-only repositories, "git merge-tree" tried to come up with a
merge result tree object, which it failed (which is not wrong) and
led to a segfault (which is bad), which has been corrected.
* Force C locale while running tests around httpd to make sure we can
find expected error messages in the log.
* Fix a logic in "mailinfo -b" that miscomputed the length of a
substring, which lead to an out-of-bounds access.
* The codepath to sign learned to report errors when it fails to read
from "ssh-keygen".
* Code clean-up that results in plugging a leak.
* "GIT_EDITOR=: git branch --edit-description" resulted in failure,
which has been corrected.
* The code to clean temporary object directories (used for
quarantine) tried to remove them inside its signal handler, which
was a no-no.
* Update comment in the Makefile about the RUNTIME_PREFIX config knob.
* Clarify that "the sentence after <area>: prefix does not begin with
a capital letter" rule applies only to the commit title.
* "git branch --edit-description" on an unborn branch misleadingly
said that no such branch exists, which has been corrected.
* Work around older clang that warns against C99 zero initialization
syntax for struct.
* Giving "--invert-grep" and "--all-match" without "--grep" to the
"git log" command resulted in an attempt to access grep pattern
expression structure that has not been allocated, which has been
corrected.
(merge db84376f98 ab/grep-simplify-extended-expression later to maint).
* "git diff rev^!" did not show combined diff to go to the rev from
its parents.
(merge a79c6b6081 rs/diff-caret-bang-with-parents later to maint).
* Allow configuration files in "protected" scopes to include other
configuration files.
(merge ecec57b3c9 gc/bare-repo-discovery later to maint).
* Give a bit more diversity to macOS CI by using sha1dc in one of the
jobs (the other one tests Apple Common Crypto).
(merge 1ad5c3df35 jc/ci-osx-with-sha1dc later to maint).
* A bugfix with tracing support in midx codepath
(merge e9c3839944 tb/midx-bitmap-selection-fix later to maint).
* When geometric repacking feature is in use together with the
--pack-kept-objects option, we lost packs marked with .keep files.
(merge 197443e80a tb/save-keep-pack-during-geometric-repack later to maint).
* Move a global variable added as a hack during regression fixes to
its proper place in the API.
(merge 0b0ab95f17 ab/run-hook-api-cleanup later to maint).
* Update to build procedure with VS using CMake/CTest.
(merge c858750b41 js/cmake-updates later to maint).
* The short-help text shown by "git cmd -h" and the synopsis text
shown at the beginning of "git help cmd" have been made more
consistent.
* When creating a multi-pack bitmap, remove per-pack bitmap files
unconditionally as they will never be consulted.
(merge 55d902cd61 tb/remove-unused-pack-bitmap later to maint).
* Fix a longstanding syntax error in Git.pm error codepath.
* "git diff --stat" etc. were invented back when everything was ASCII
and strlen() was a way to measure the display width of a string;
adjust them to compute the display width assuming UTF-8 pathnames.
(merge ce8529b2bb tb/diffstat-with-utf8-strwidth later to maint).
* "git branch --edit-description" can exit with status -1 which is
not a good practice; it learned to use 1 as everybody else instead.
* "git apply" limits its input to a bit less than 1 GiB.
* Merging a branch with directory renames into a branch that changes
the directory to a symlink was mishandled by the ort merge
strategy, which has been corrected.
* A bugfix to "git subtree" in its split and merge features.
* Fix some bugs in the reflog messages when rebasing and changes the
reflog messages of "rebase --apply" to match "rebase --merge" with
the aim of making the reflog easier to parse.
* "git rebase --keep-base" used to discard the commits that are
already cherry-picked to the upstream, even when "keep-base" meant
that the base, on top of which the history is being rebuilt, does
not yet include these cherry-picked commits. The --keep-base
option now implies --reapply-cherry-picks and --no-fork-point
options.
* The way "git repack" created temporary files when it received a
signal was prone to deadlocking, which has been corrected.
* Various tests exercising the transfer.credentialsInUrl
configuration are taught to avoid making requests which require
resolving localhost to reduce CI-flakiness.
* The adjust_shared_perm() helper function learned to refrain from
setting the "g+s" bit on directories when it is not necessary.
* "git archive" mistakenly complained twice about a missing
executable, which has been corrected.
* Fix a bug where `git branch -d` did not work on an orphaned HEAD.
* `git rebase --update-refs` would delete references when all
`update-ref` commands in the sequencer were removed, which has been
corrected.
* Fix a regression in the bisect-helper which mistakenly treats
arguments to the command given to 'git bisect run' as arguments to
the helper.
* Correct an error where `git rebase` would mistakenly use a branch or
tag named "refs/rewritten/xyz" when missing a rebase label.
* Assorted fixes of parsing end-user input as integers.
(merge 14770cf0de pw/config-int-parse-fixes later to maint).
* "git prune" may try to iterate over .git/objects/pack for trash
files to remove in it, and loudly fail when the directory is
missing, which is not necessary. The command has been taught to
ignore such a failure.
(merge 6974765352 ew/prune-with-missing-objects-pack later to maint).
* Add one more candidate directory that may house httpd modules while
running tests.
(merge 1c7dc23d41 es/locate-httpd-module-location-in-test later to maint).
* A handful of leaks in the line-log machinery have been plugged.
* The format of a line in /proc/cpuinfo that describes a CPU on s390x
looked different from everybody else, and the code in chainlint.pl
failed to parse it.
(merge 1f51b77f4f ah/chainlint-cpuinfo-parse-fix later to maint).
* Adjust the GitHub CI to newer ubuntu release.
(merge 0d3507f3e7 jx/ci-ubuntu-fix later to maint).
* Other code cleanup, docfix, build fix, etc.
(merge 413bc6d20a ds/cmd-main-reorder later to maint).
(merge 8d2863e4ed nw/t1002-cleanup later to maint).
(merge 7c2dc122f9 rs/list-objects-filter-leakfix later to maint).
(merge 288fcb1c94 zk/push-use-bitmaps later to maint).
(merge 42db324c0f km/merge-recursive-typofix later to maint).

View File

@ -1,162 +0,0 @@
Reviewing Patches in the Git Project
====================================
Introduction
------------
The Git development community is a widely distributed, diverse, ever-changing
group of individuals. Asynchronous communication via the Git mailing list poses
unique challenges when reviewing or discussing patches. This document contains
some guiding principles and helpful tools you can use to make your reviews both
more efficient for yourself and more effective for other contributors.
Note that none of the recommendations here are binding or in any way a
requirement of participation in the Git community. They are provided as a
resource to supplement your skills as a contributor.
Principles
----------
Selecting patch(es) to review
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
If you are looking for a patch series in need of review, start by checking
latest "What's cooking in git.git" email
(https://lore.kernel.org/git/xmqqilm1yp3m.fsf@gitster.g/[example]). The "What's
cooking" emails & replies can be found using the query `s:"What's cooking"` on
the https://lore.kernel.org/git/[`lore.kernel.org` mailing list archive];
alternatively, you can find the contents of the "What's cooking" email tracked
in `whats-cooking.txt` on the `todo` branch of Git. Topics tagged with "Needs
review" and those in the "[New Topics]" section are typically those that would
benefit the most from additional review.
Patches can also be searched manually in the mailing list archive using a query
like `s:"PATCH" -s:"Re:"`. You can browse these results for topics relevant to
your expertise or interest.
If you've already contributed to Git, you may also be CC'd in another
contributor's patch series. These are topics where the author feels that your
attention is warranted. This may be because their patch changes something you
wrote previously (making you a good judge of whether the new approach does or
doesn't work), or because you have the expertise to provide an exceptionally
helpful review. There is no requirement to review these patches but, in the
spirit of open source collaboration, you should strongly consider doing so.
Reviewing patches
~~~~~~~~~~~~~~~~~
While every contributor takes their own approach to reviewing patches, here are
some general pieces of advice to make your reviews as clear and helpful as
possible. The advice is broken into two rough categories: high-level reviewing
guidance, and concrete tips for interacting with patches on the mailing list.
==== High-level guidance
- Remember to review the content of commit messages for correctness and clarity,
in addition to the code change in the patch's diff. The commit message of a
patch should accurately and fully explain the code change being made in the
diff.
- Reviewing test coverage is an important - but easy to overlook - component of
reviews. A patch's changes may be covered by existing tests, or new tests may
be introduced to exercise new behavior. Checking out a patch or series locally
allows you to manually mutate lines of new & existing tests to verify expected
pass/fail behavior. You can use this information to verify proper coverage or
to suggest additional tests the author could add.
- When providing a recommendation, be as clear as possible about whether you
consider it "blocking" (the code would be broken or otherwise made worse if an
issue isn't fixed) or "non-blocking" (the patch could be made better by taking
the recommendation, but acceptance of the series does not require it).
Non-blocking recommendations can be particularly ambiguous when they are
related to - but outside the scope of - a series ("nice-to-have"s), or when
they represent only stylistic differences between the author and reviewer.
- When commenting on an issue, try to include suggestions for how the author
could fix it. This not only helps the author to understand and fix the issue,
it also deepens and improves your understanding of the topic.
- Reviews do not need to exclusively point out problems. Feel free to "think out
loud" in your review: describe how you read & understood a complex section of
a patch, ask a question about something that confused you, point out something
you found exceptionally well-written, etc. In particular, uplifting feedback
goes a long way towards encouraging contributors to participate more actively
in the Git community.
==== Performing your review
- Provide your review comments per-patch in a plaintext "Reply-All" email to the
relevant patch. Comments should be made inline, immediately below the relevant
section(s).
- You may find that the limited context provided in the patch diff is sometimes
insufficient for a thorough review. In such cases, you can review patches in
your local tree by either applying patches with linkgit:git-am[1] or checking
out the associated branch from https://github.com/gitster/git once the series
is tracked there.
- Large, complicated patch diffs are sometimes unavoidable, such as when they
refactor existing code. If you find such a patch difficult to parse, try
reviewing the diff produced with the `--color-moved` and/or
`--ignore-space-change` options.
- If a patch is long, you are encouraged to delete parts of it that are
unrelated to your review from the email reply. Make sure to leave enough
context for readers to understand your comments!
- If you cannot complete a full review of a series all at once, consider letting
the author know (on- or off-list) if/when you plan to review the rest of the
series.
Completing a review
~~~~~~~~~~~~~~~~~~~
Once each patch of a series is reviewed, the author (and/or other contributors)
may discuss the review(s). This may result in no changes being applied, or the
author will send a new version of their patch(es).
After a series is rerolled in response to your or others' review, make sure to
re-review the updates. If you are happy with the state of the patch series,
explicitly indicate your approval (typically with a reply to the latest
version's cover letter). Optionally, you can let the author know that they can
add a "Reviewed-by: <you>" trailer if they resubmit the reviewed patch verbatim
in a later iteration of the series.
Finally, subsequent "What's cooking" emails may explicitly ask whether a
reviewed topic is ready for merging to the `next` branch (typically phrased
"Will merge to \'next\'?"). You can help the maintainer and author by responding
with a short description of the state of your (and others', if applicable)
review, including the links to the relevant thread(s).
Terminology
-----------
nit: ::
Denotes a small issue that should be fixed, such as a typographical error
or mis-alignment of conditions in an `if()` statement.
aside: ::
optional: ::
non-blocking: ::
Indicates to the reader that the following comment should not block the
acceptance of the patch or series. These are typically recommendations
related to code organization & style, or musings about topics related to
the patch in question, but beyond its scope.
s/<before>/<after>/::
Shorthand for "you wrote <before>, but I think you meant <after>," usually
for misspellings or other typographical errors. The syntax is a reference
to "substitute" command commonly found in Unix tools such as `ed`, `sed`,
`vim`, and `perl`.
cover letter::
The "Patch 0" of a multi-patch series. This email describes the
high-level intent and structure of the patch series to readers on the
Git mailing list. It is also where the changelog notes and range-diff of
subsequent versions are provided by the author.
+
On single-patch submissions, cover letter content is typically not sent as a
separate email. Instead, it is inserted between the end of the patch's commit
message (after the `---`) and the beginning of the diff.
#leftoverbits::
Used by either an author or a reviewer to describe features or suggested
changes that are out-of-scope of a given patch or series, but are relevant
to the topic for the sake of discussion.
See Also
--------
link:MyFirstContribution.html[MyFirstContribution]

View File

@ -153,9 +153,7 @@ files you are modifying to see the current conventions.
[[summary-section]]
The title sentence after the "area:" prefix omits the full stop at the
end, and its first word is not capitalized (the omission
of capitalization applies only to the word after the "area:"
prefix of the title) unless there is a reason to
end, and its first word is not capitalized unless there is a reason to
capitalize it other than because it is the first word in the sentence.
E.g. "doc: clarify...", not "doc: Clarify...", or "githooks.txt:
improve...", not "githooks.txt: Improve...". But "refs: HEAD is also

View File

@ -38,10 +38,9 @@ while ($changed) {
}
}
foreach my $text (sort keys %include) {
my $included = $include{$text};
while (my ($text, $included) = each %include) {
if (! exists $included{$text} &&
(my $base = $text) =~ s/\.txt$//) {
print "$base.html $base.xml : ", join(" ", sort keys %$included), "\n";
print "$base.html $base.xml : ", join(" ", keys %$included), "\n";
}
}

View File

@ -10,7 +10,7 @@ sub format_one {
$state = 0;
open I, '<', "$name.txt" or die "No such file $name.txt";
while (<I>) {
if (/^(?:git|scalar)[a-z0-9-]*\(([0-9])\)$/) {
if (/^git[a-z0-9-]*\(([0-9])\)$/) {
$mansection = $1;
next;
}

View File

@ -387,8 +387,6 @@ include::config/branch.txt[]
include::config/browser.txt[]
include::config/bundle.txt[]
include::config/checkout.txt[]
include::config/clean.txt[]
@ -425,8 +423,6 @@ include::config/filter.txt[]
include::config/fsck.txt[]
include::config/fsmonitor--daemon.txt[]
include::config/gc.txt[]
include::config/gitcvs.txt[]

View File

@ -1,24 +0,0 @@
bundle.*::
The `bundle.*` keys may appear in a bundle list file found via the
`git clone --bundle-uri` option. These keys currently have no effect
if placed in a repository config file, though this will change in the
future. See link:technical/bundle-uri.html[the bundle URI design
document] for more details.
bundle.version::
This integer value advertises the version of the bundle list format
used by the bundle list. Currently, the only accepted value is `1`.
bundle.mode::
This string value should be either `all` or `any`. This value describes
whether all of the advertised bundles are required to unbundle a
complete understanding of the bundled information (`all`) or if any one
of the listed bundle URIs is sufficient (`any`).
bundle.<id>.*::
The `bundle.<id>.*` keys are used to describe a single item in the
bundle list, grouped under `<id>` for identification purposes.
bundle.<id>.uri::
This string value defines the URI by which Git can reach the contents
of this `<id>`. This URI may be a bundle file or another bundle list.

View File

@ -444,32 +444,17 @@ You probably do not need to adjust this value.
Common unit suffixes of 'k', 'm', or 'g' are supported.
core.bigFileThreshold::
The size of files considered "big", which as discussed below
changes the behavior of numerous git commands, as well as how
such files are stored within the repository. The default is
512 MiB. Common unit suffixes of 'k', 'm', or 'g' are
supported.
Files larger than this size are stored deflated, without
attempting delta compression. Storing large files without
delta compression avoids excessive memory usage, at the
slight expense of increased disk usage. Additionally files
larger than this size are always treated as binary.
+
Files above the configured limit will be:
Default is 512 MiB on all platforms. This should be reasonable
for most projects as source code and other text files can still
be delta compressed, but larger binary media files won't be.
+
* Stored deflated in packfiles, without attempting delta compression.
+
The default limit is primarily set with this use-case in mind. With it,
most projects will have their source code and other text files delta
compressed, but not larger binary media files.
+
Storing large files without delta compression avoids excessive memory
usage, at the slight expense of increased disk usage.
+
* Will be treated as if they were labeled "binary" (see
linkgit:gitattributes[5]). e.g. linkgit:git-log[1] and
linkgit:git-diff[1] will not compute diffs for files above this limit.
+
* Will generally be streamed when written, which avoids excessive
memory usage, at the cost of some fixed overhead. Commands that make
use of this include linkgit:git-archive[1],
linkgit:git-fast-import[1], linkgit:git-index-pack[1],
linkgit:git-unpack-objects[1] and linkgit:git-fsck[1].
Common unit suffixes of 'k', 'm', or 'g' are supported.
core.excludesFile::
Specifies the pathname to the file that contains patterns to
@ -618,7 +603,7 @@ but risks losing recent work in the event of an unclean system shutdown.
* `loose-object` hardens objects added to the repo in loose-object form.
* `pack` hardens objects added to the repo in packfile form.
* `pack-metadata` hardens packfile bitmaps and indexes.
* `commit-graph` hardens the commit-graph file.
* `commit-graph` hardens the commit graph file.
* `index` hardens the index when it is modified.
* `objects` is an aggregate option that is equivalent to
`loose-object,pack`.

View File

@ -178,6 +178,21 @@ diff.<driver>.cachetextconv::
Set this option to true to make the diff driver cache the text
conversion outputs. See linkgit:gitattributes[5] for details.
diff.tool::
Controls which diff tool is used by linkgit:git-difftool[1].
This variable overrides the value configured in `merge.tool`.
The list below shows the valid built-in values.
Any other value is treated as a custom diff tool and requires
that a corresponding difftool.<tool>.cmd variable is defined.
diff.guitool::
Controls which diff tool is used by linkgit:git-difftool[1] when
the -g/--gui flag is specified. This variable overrides the value
configured in `merge.guitool`. The list below shows the valid
built-in values. Any other value is treated as a custom diff tool
and requires that a corresponding difftool.<guitool>.cmd variable
is defined.
include::../mergetools-diff.txt[]
diff.indentHeuristic::

View File

@ -1,17 +1,6 @@
diff.tool::
Controls which diff tool is used by linkgit:git-difftool[1].
This variable overrides the value configured in `merge.tool`.
The list below shows the valid built-in values.
Any other value is treated as a custom diff tool and requires
that a corresponding difftool.<tool>.cmd variable is defined.
diff.guitool::
Controls which diff tool is used by linkgit:git-difftool[1] when
the -g/--gui flag is specified. This variable overrides the value
configured in `merge.guitool`. The list below shows the valid
built-in values. Any other value is treated as a custom diff tool
and requires that a corresponding difftool.<guitool>.cmd variable
is defined.
difftool.<tool>.path::
Override the path for the given tool. This is useful in case
your tool is not in the PATH.
difftool.<tool>.cmd::
Specify the command to invoke the specified diff tool.
@ -20,17 +9,6 @@ difftool.<tool>.cmd::
file containing the contents of the diff pre-image and 'REMOTE'
is set to the name of the temporary file containing the contents
of the diff post-image.
+
See the `--tool=<tool>` option in linkgit:git-difftool[1] for more details.
difftool.<tool>.path::
Override the path for the given tool. This is useful in case
your tool is not in the PATH.
difftool.trustExitCode::
Exit difftool if the invoked diff tool returns a non-zero exit status.
+
See the `--trust-exit-code` option in linkgit:git-difftool[1] for more details.
difftool.prompt::
Prompt before each invocation of the diff tool.

View File

@ -14,9 +14,6 @@ feature.experimental::
+
* `fetch.negotiationAlgorithm=skipping` may improve fetch negotiation times by
skipping more commits at a time, reducing the number of round trips.
+
* `gc.cruftPacks=true` reduces disk space used by unreachable objects during
garbage collection, preventing loose object explosions.
feature.manyFiles::
Enable config options that optimize for repos with many files in the

View File

@ -15,10 +15,6 @@ format.from::
different. If set to a non-boolean value, format-patch uses that
value instead of your committer identity. Defaults to false.
format.forceInBodyFrom::
Provides the default value for the `--[no-]force-in-body-from`
option to format-patch. Defaults to false.
format.numbered::
A boolean which can enable or disable sequence numbers in patch
subjects. It defaults to "auto" which enables it only if there

View File

@ -35,10 +35,6 @@ allow new instances of the same breakages go unnoticed.
Setting an unknown `fsck.<msg-id>` value will cause fsck to die, but
doing the same for `receive.fsck.<msg-id>` and `fetch.fsck.<msg-id>`
will only cause git to warn.
+
See `Fsck Messages` section of linkgit:git-fsck[1] for supported
values of `<msg-id>`.
fsck.skipList::
The path to a list of object names (i.e. one unabbreviated SHA-1 per

View File

@ -1,11 +0,0 @@
fsmonitor.allowRemote::
By default, the fsmonitor daemon refuses to work against network-mounted
repositories. Setting `fsmonitor.allowRemote` to `true` overrides this
behavior. Only respected when `core.fsmonitor` is set to `true`.
fsmonitor.socketDir::
This Mac OS-specific option, if set, specifies the directory in
which to create the Unix domain socket used for communication
between the fsmonitor daemon and various Git commands. The directory must
reside on a native Mac OS filesystem. Only respected when `core.fsmonitor`
is set to `true`.

View File

@ -17,11 +17,8 @@ grep.extendedRegexp::
other than 'default'.
grep.threads::
Number of grep worker threads to use. If unset (or set to 0), Git will
use as many threads as the number of logical cores available.
grep.fullName::
If set to true, enable `--full-name` option by default.
Number of grep worker threads to use.
See `grep.threads` in linkgit:git-grep[1] for more information.
grep.fallbackToNoIndex::
If set to true, fall back to git grep --no-index if git grep

View File

@ -7,10 +7,6 @@ log.date::
Set the default date-time mode for the 'log' command.
Setting a value for log.date is similar to using 'git log''s
`--date` option. See linkgit:git-log[1] for details.
+
If the format is set to "auto:foo" and the pager is in use, format
"foo" will be the used for the date format. Otherwise "default" will
be used.
log.decorate::
Print out the ref names of any commits that are shown by the log
@ -22,11 +18,6 @@ log.decorate::
names are shown. This is the same as the `--decorate` option
of the `git log`.
log.initialDecorationSet::
By default, `git log` only shows decorations for certain known ref
namespaces. If 'all' is specified, then show all refs as
decorations.
log.excludeDecoration::
Exclude the specified patterns from the log decorations. This is
similar to the `--decorate-refs-exclude` command-line option, but
@ -34,9 +25,9 @@ log.excludeDecoration::
option.
log.diffMerges::
Set diff format to be used when `--diff-merges=on` is
specified, see `--diff-merges` in linkgit:git-log[1] for
details. Defaults to `separate`.
Set default diff format to be used for merge commits. See
`--diff-merges` in linkgit:git-log[1] for details.
Defaults to `separate`.
log.follow::
If `true`, `git log` will act as if the `--follow` option was used when

View File

@ -1,7 +1,7 @@
lsrefs.unborn::
May be "advertise" (the default), "allow", or "ignore". If "advertise",
the server will respond to the client sending "unborn" (as described in
linkgit:gitprotocol-v2[5]) and will advertise support for this feature during the
protocol-v2.txt) and will advertise support for this feature during the
protocol v2 capability advertisement. "allow" is the same as
"advertise" except that the server will not advertise support for this
feature; this is useful for load-balanced servers that cannot be

View File

@ -59,7 +59,7 @@ mergetool.hideResolved::
possible and write the 'MERGED' file containing conflict markers around
any conflicts that it cannot resolve; 'LOCAL' and 'REMOTE' normally
represent the versions of the file from before Git's conflict
resolution. This flag causes 'LOCAL' and 'REMOTE' to be overwritten so
resolution. This flag causes 'LOCAL' and 'REMOTE' to be overwriten so
that only the unresolved conflicts are presented to the merge tool. Can
be configured per-tool via the `mergetool.<tool>.hideResolved`
configuration variable. Defaults to `false`.

View File

@ -3,9 +3,6 @@ notes.mergeStrategy::
conflicts. Must be one of `manual`, `ours`, `theirs`, `union`, or
`cat_sort_uniq`. Defaults to `manual`. See "NOTES MERGE STRATEGIES"
section of linkgit:git-notes[1] for more information on each strategy.
+
This setting can be overridden by passing the `--strategy` option to
linkgit:git-notes[1].
notes.<name>.mergeStrategy::
Which merge strategy to choose when doing a notes merge into
@ -14,35 +11,28 @@ notes.<name>.mergeStrategy::
linkgit:git-notes[1] for more information on the available strategies.
notes.displayRef::
Which ref (or refs, if a glob or specified more than once), in
addition to the default set by `core.notesRef` or
`GIT_NOTES_REF`, to read notes from when showing commit
messages with the 'git log' family of commands.
The (fully qualified) refname from which to show notes when
showing commit messages. The value of this variable can be set
to a glob, in which case notes from all matching refs will be
shown. You may also specify this configuration variable
several times. A warning will be issued for refs that do not
exist, but a glob that does not match any refs is silently
ignored.
+
This setting can be overridden with the `GIT_NOTES_DISPLAY_REF`
environment variable, which must be a colon separated list of refs or
globs.
+
A warning will be issued for refs that do not exist,
but a glob that does not match any refs is silently ignored.
+
This setting can be disabled by the `--no-notes` option to the 'git
log' family of commands, or by the `--notes=<ref>` option accepted by
those commands.
+
The effective value of "core.notesRef" (possibly overridden by
GIT_NOTES_REF) is also implicitly added to the list of refs to be
displayed.
notes.rewrite.<command>::
When rewriting commits with <command> (currently `amend` or
`rebase`), if this variable is `false`, git will not copy
notes from the original to the rewritten commit. Defaults to
`true`. See also "`notes.rewriteRef`" below.
+
This setting can be overridden with the `GIT_NOTES_REWRITE_REF`
environment variable, which must be a colon separated list of refs or
globs.
`rebase`) and this variable is set to `true`, Git
automatically copies your notes from the original to the
rewritten commit. Defaults to `true`, but see
"notes.rewriteRef" below.
notes.rewriteMode::
When copying notes during a rewrite (see the
@ -56,13 +46,14 @@ environment variable.
notes.rewriteRef::
When copying notes during a rewrite, specifies the (fully
qualified) ref whose notes should be copied. May be a glob,
in which case notes in all matching refs will be copied. You
may also specify this configuration several times.
qualified) ref whose notes should be copied. The ref may be a
glob, in which case notes in all matching refs will be copied.
You may also specify this configuration several times.
+
Does not have a default value; you must configure this variable to
enable note rewriting. Set it to `refs/notes/commits` to enable
rewriting for the default commit notes.
+
Can be overridden with the `GIT_NOTES_REWRITE_REF` environment variable.
See `notes.rewrite.<command>` above for a further description of its format.
This setting can be overridden with the `GIT_NOTES_REWRITE_REF`
environment variable, which must be a colon separated list of refs or
globs.

View File

@ -164,16 +164,9 @@ When writing a multi-pack reachability bitmap, no new namehashes are
computed; instead, any namehashes stored in an existing bitmap are
permuted into their appropriate location when writing a new bitmap.
pack.writeBitmapLookupTable::
When true, Git will include a "lookup table" section in the
bitmap index (if one is written). This table is used to defer
loading individual bitmaps as late as possible. This can be
beneficial in repositories that have relatively large bitmap
indexes. Defaults to false.
pack.writeReverseIndex::
When true, git will write a corresponding .rev file (see:
linkgit:gitformat-pack[5])
link:../technical/pack-format.html[Documentation/technical/pack-format.txt])
for each new packfile that it writes in all places except for
linkgit:git-fast-import[1] and in the bulk checkin mechanism.
Defaults to false.

View File

@ -58,6 +58,6 @@ protocol.version::
* `1` - the original wire protocol with the addition of a version string
in the initial response from the server.
* `2` - Wire protocol version 2, see linkgit:gitprotocol-v2[5].
* `2` - link:technical/protocol-v2.html[wire protocol version 2].
--

View File

@ -110,8 +110,18 @@ This will result in only b (a and c are cleared).
----
push.recurseSubmodules::
May be "check", "on-demand", "only", or "no", with the same behavior
as that of "push --recurse-submodules".
Make sure all submodule commits used by the revisions to be pushed
are available on a remote-tracking branch. If the value is 'check'
then Git will verify that all submodule commits that changed in the
revisions to be pushed are available on at least one remote of the
submodule. If any commits are missing, the push will be aborted and
exit with non-zero status. If the value is 'on-demand' then all
submodules that changed in the revisions to be pushed will be
pushed. If on-demand was not able to push all necessary revisions
it will also be aborted and exit with non-zero status. If the value
is 'no' then default behavior of ignoring submodules when pushing
is retained. You may override this configuration at time of push by
specifying '--recurse-submodules=check|on-demand|no'.
If not set, 'no' is used by default, unless 'submodule.recurse' is
set (in which case a 'true' value means 'on-demand').
@ -127,8 +137,3 @@ push.negotiate::
server attempt to find commits in common. If "false", Git will
rely solely on the server's ref advertisement to find commits
in common.
push.useBitmaps::
If set to "false", disable use of bitmaps for "git push" even if
`pack.useBitmaps` is "true", without preventing other git operations
from using bitmaps. Default is true.

View File

@ -21,9 +21,6 @@ rebase.autoStash::
`--autostash` options of linkgit:git-rebase[1].
Defaults to false.
rebase.updateRefs::
If set to true enable `--update-refs` option by default.
rebase.missingCommitsCheck::
If set to "warn", git rebase -i will print a warning if some
commits are removed (e.g. a line was deleted), however the

View File

@ -1,22 +1,3 @@
safe.bareRepository::
Specifies which bare repositories Git will work with. The currently
supported values are:
+
* `all`: Git works with all bare repositories. This is the default.
* `explicit`: Git only works with bare repositories specified via
the top-level `--git-dir` command-line option, or the `GIT_DIR`
environment variable (see linkgit:git[1]).
+
If you do not use bare repositories in your workflow, then it may be
beneficial to set `safe.bareRepository` to `explicit` in your global
config. This will protect you from attacks that involve cloning a
repository that contains a bare repository and running a Git command
within that directory.
+
This config setting is only respected in protected configuration (see
<<SCOPES>>). This prevents the untrusted repository from tampering with
this value.
safe.directory::
These config entries specify Git-tracked directories that are
considered safe even if they are owned by someone other than the
@ -31,9 +12,9 @@ via `git config --add`. To reset the list of safe directories (e.g. to
override any such directories specified in the system config), add a
`safe.directory` entry with an empty value.
+
This config setting is only respected in protected configuration (see
<<SCOPES>>). This prevents the untrusted repository from tampering with this
value.
This config setting is only respected when specified in a system or global
config, not when it is specified in a repository config, via the command
line option `-c safe.directory=<path>`, or in environment variables.
+
The value of this setting is interpolated, i.e. `~/<path>` expands to a
path relative to the home directory and `%(prefix)/<path>` expands to a

View File

@ -18,49 +18,17 @@ sendemail.<identity>.*::
identity is selected, through either the command-line or
`sendemail.identity`.
sendemail.multiEdit::
If true (default), a single editor instance will be spawned to edit
files you have to edit (patches when `--annotate` is used, and the
summary when `--compose` is used). If false, files will be edited one
after the other, spawning a new editor each time.
sendemail.confirm::
Sets the default for whether to confirm before sending. Must be
one of 'always', 'never', 'cc', 'compose', or 'auto'. See `--confirm`
in the linkgit:git-send-email[1] documentation for the meaning of these
values.
sendemail.aliasesFile::
To avoid typing long email addresses, point this to one or more
email aliases files. You must also supply `sendemail.aliasFileType`.
sendemail.aliasFileType::
Format of the file(s) specified in sendemail.aliasesFile. Must be
one of 'mutt', 'mailrc', 'pine', 'elm', or 'gnus', or 'sendmail'.
+
What an alias file in each format looks like can be found in
the documentation of the email program of the same name. The
differences and limitations from the standard formats are
described below:
+
--
sendmail;;
* Quoted aliases and quoted addresses are not supported: lines that
contain a `"` symbol are ignored.
* Redirection to a file (`/path/name`) or pipe (`|command`) is not
supported.
* File inclusion (`:include: /path/name`) is not supported.
* Warnings are printed on the standard error output for any
explicitly unsupported constructs, and any other lines that are not
recognized by the parser.
--
sendemail.annotate::
sendemail.bcc::
sendemail.cc::
sendemail.ccCmd::
sendemail.chainReplyTo::
sendemail.confirm::
sendemail.envelopeSender::
sendemail.from::
sendemail.multiEdit::
sendemail.signedoffbycc::
sendemail.smtpPass::
sendemail.suppresscc::
@ -76,9 +44,7 @@ sendemail.thread::
sendemail.transferEncoding::
sendemail.validate::
sendemail.xmailer::
These configuration variables all provide a default for
linkgit:git-send-email[1] command-line options. See its
documentation for details.
See linkgit:git-send-email[1] for description.
sendemail.signedoffcc (deprecated)::
Deprecated alias for `sendemail.signedoffbycc`.

View File

@ -13,7 +13,7 @@ Note that this is currently limited to detecting credentials in
You might want to enable this to prevent inadvertent credentials
exposure, e.g. because:
+
* The OS or system where you're running git may not provide a way or
* The OS or system where you're running git may not provide way way or
otherwise allow you to configure the permissions of the
configuration file where the username and/or password are stored.
* Even if it does, having such data stored "at rest" might expose you

View File

@ -49,9 +49,9 @@ uploadpack.packObjectsHook::
`pack-objects` to the hook, and expects a completed packfile on
stdout.
+
Note that this configuration variable is only respected when it is specified
in protected configuration (see <<SCOPES>>). This is a safety measure
against fetching from untrusted repositories.
Note that this configuration variable is ignored if it is seen in the
repository-level config (this is a safety measure against fetching from
untrusted repositories).
uploadpack.allowFilter::
If this option is set, `upload-pack` will support partial

View File

@ -1,161 +0,0 @@
`badDate`::
(ERROR) Invalid date format in an author/committer line.
`badDateOverflow`::
(ERROR) Invalid date value in an author/committer line.
`badEmail`::
(ERROR) Invalid email format in an author/committer line.
`badFilemode`::
(INFO) A tree contains a bad filemode entry.
`badName`::
(ERROR) An author/committer name is empty.
`badObjectSha1`::
(ERROR) An object has a bad sha1.
`badParentSha1`::
(ERROR) A commit object has a bad parent sha1.
`badTagName`::
(INFO) A tag has an invalid format.
`badTimezone`::
(ERROR) Found an invalid time zone in an author/committer line.
`badTree`::
(ERROR) A tree cannot be parsed.
`badTreeSha1`::
(ERROR) A tree has an invalid format.
`badType`::
(ERROR) Found an invalid object type.
`duplicateEntries`::
(ERROR) A tree contains duplicate file entries.
`emptyName`::
(WARN) A path contains an empty name.
`extraHeaderEntry`::
(IGNORE) Extra headers found after `tagger`.
`fullPathname`::
(WARN) A path contains the full path starting with "/".
`gitattributesSymlink`::
(INFO) `.gitattributes` is a symlink.
`gitignoreSymlink`::
(INFO) `.gitignore` is a symlink.
`gitmodulesBlob`::
(ERROR) A non-blob found at `.gitmodules`.
`gitmodulesLarge`::
(ERROR) The `.gitmodules` file is too large to parse.
`gitmodulesMissing`::
(ERROR) Unable to read `.gitmodules` blob.
`gitmodulesName`::
(ERROR) A submodule name is invalid.
`gitmodulesParse`::
(INFO) Could not parse `.gitmodules` blob.
`gitmodulesLarge`;
(ERROR) `.gitmodules` blob is too large to parse.
`gitmodulesPath`::
(ERROR) `.gitmodules` path is invalid.
`gitmodulesSymlink`::
(ERROR) `.gitmodules` is a symlink.
`gitmodulesUpdate`::
(ERROR) Found an invalid submodule update setting.
`gitmodulesUrl`::
(ERROR) Found an invalid submodule url.
`hasDot`::
(WARN) A tree contains an entry named `.`.
`hasDotdot`::
(WARN) A tree contains an entry named `..`.
`hasDotgit`::
(WARN) A tree contains an entry named `.git`.
`mailmapSymlink`::
(INFO) `.mailmap` is a symlink.
`missingAuthor`::
(ERROR) Author is missing.
`missingCommitter`::
(ERROR) Committer is missing.
`missingEmail`::
(ERROR) Email is missing in an author/committer line.
`missingNameBeforeEmail`::
(ERROR) Missing name before an email in an author/committer line.
`missingObject`::
(ERROR) Missing `object` line in tag object.
`missingSpaceBeforeDate`::
(ERROR) Missing space before date in an author/committer line.
`missingSpaceBeforeEmail`::
(ERROR) Missing space before the email in author/committer line.
`missingTag`::
(ERROR) Unexpected end after `type` line in a tag object.
`missingTagEntry`::
(ERROR) Missing `tag` line in a tag object.
`missingTaggerEntry`::
(INFO) Missing `tagger` line in a tag object.
`missingTree`::
(ERROR) Missing `tree` line in a commit object.
`missingType`::
(ERROR) Invalid type value on the `type` line in a tag object.
`missingTypeEntry`::
(ERROR) Missing `type` line in a tag object.
`multipleAuthors`::
(ERROR) Multiple author lines found in a commit.
`nulInCommit`::
(WARN) Found a NUL byte in the commit object body.
`nulInHeader`::
(FATAL) NUL byte exists in the object header.
`nullSha1`::
(WARN) Tree contains entries pointing to a null sha1.
`treeNotSorted`::
(ERROR) A tree is not properly sorted.
`unknownType`::
(ERROR) Found an unknown object type.
`unterminatedHeader`::
(FATAL) Missing end-of-line in the object header.
`zeroPaddedDate`::
(ERROR) Found a zero padded date in an author/commiter line.
`zeroPaddedFilemode`::
(WARN) Found a zero padded filemode in a tree.

View File

@ -433,13 +433,6 @@ they will make the patch impossible to apply:
* deleting context or removal lines
* modifying the contents of context or removal lines
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/add.txt[]
SEE ALSO
--------
linkgit:git-status[1]

View File

@ -112,7 +112,10 @@ default. You can use `--no-utf8` to override this.
am.threeWay configuration variable. For more information,
see am.threeWay in linkgit:git-config[1].
include::rerere-options.txt[]
--rerere-autoupdate::
--no-rerere-autoupdate::
Allow the rerere mechanism to update the index with the
result of auto-conflict resolution if possible.
--ignore-space-change::
--ignore-whitespace::
@ -258,13 +261,6 @@ This command can run `applypatch-msg`, `pre-applypatch`,
and `post-applypatch` hooks. See linkgit:githooks[5] for more
information.
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/am.txt[]
SEE ALSO
--------
linkgit:git-apply[1].

View File

@ -8,7 +8,7 @@ git-annotate - Annotate file lines with commit information
SYNOPSIS
--------
[verse]
'git annotate' [<options>] [<rev-opts>] [<rev>] [--] <file>
'git annotate' [<options>] <file> [<revision>]
DESCRIPTION
-----------

View File

@ -263,9 +263,13 @@ has no effect when `--index` or `--cached` is in use.
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/apply.txt[]
apply.ignoreWhitespace::
Set to 'change' if you want changes in whitespace to be ignored by default.
Set to one of: no, none, never, false if you want changes in
whitespace to be significant.
apply.whitespace::
When no `--whitespace` flag is given from the command
line, this configuration item is used as the default.
SUBMODULES
----------

View File

@ -34,12 +34,10 @@ OPTIONS
-------
--format=<fmt>::
Format of the resulting archive. Possible values are `tar`,
`zip`, `tar.gz`, `tgz`, and any format defined using the
configuration option `tar.<format>.command`. If `--format`
Format of the resulting archive: 'tar' or 'zip'. If this option
is not given, and the output file is specified, the format is
inferred from the filename if possible (e.g. writing to `foo.zip`
makes the output to be in the `zip` format). Otherwise the output
inferred from the filename if possible (e.g. writing to "foo.zip"
makes the output to be in the zip format). Otherwise the output
format is `tar`.
-l::
@ -145,16 +143,17 @@ tar.<format>.command::
is executed using the shell with the generated tar file on its
standard input, and should produce the final output on its
standard output. Any compression-level options will be passed
to the command (e.g., `-9`).
to the command (e.g., "-9"). An output file with the same
extension as `<format>` will be use this format if no other
format is given.
+
The `tar.gz` and `tgz` formats are defined automatically and use the
magic command `git archive gzip` by default, which invokes an internal
implementation of gzip.
The "tar.gz" and "tgz" formats are defined automatically and default to
`gzip -cn`. You may override them with custom commands.
tar.<format>.remote::
If true, enable the format for use by remote clients via
If true, enable `<format>` for use by remote clients via
linkgit:git-upload-archive[1]. Defaults to false for
user-defined formats, but true for the `tar.gz` and `tgz`
user-defined formats, but true for the "tar.gz" and "tgz"
formats.
[[ATTRIBUTES]]

View File

@ -241,12 +241,6 @@ MAPPING AUTHORS
See linkgit:gitmailmap[5].
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/blame.txt[]
SEE ALSO
--------

View File

@ -336,10 +336,6 @@ CONFIGURATION
`--list` is used or implied. The default is to use a pager.
See linkgit:git-config[1].
include::includes/cmd-config-section-rest.txt[]
include::config/branch.txt[]
EXAMPLES
--------

View File

@ -9,7 +9,6 @@ SYNOPSIS
--------
[verse]
'git bugreport' [(-o | --output-directory) <path>] [(-s | --suffix) <format>]
[--diagnose[=<mode>]]
DESCRIPTION
-----------
@ -32,10 +31,6 @@ The following information is captured automatically:
- A list of enabled hooks
- $SHELL
Additional information may be gathered into a separate zip archive using the
`--diagnose` option, and can be attached alongside the bugreport document to
provide additional context to readers.
This tool is invoked via the typical Git setup process, which means that in some
cases, it might not be able to launch - for example, if a relevant config file
is unreadable. In this kind of scenario, it may be helpful to manually gather
@ -54,19 +49,6 @@ OPTIONS
named 'git-bugreport-<formatted suffix>'. This should take the form of a
strftime(3) format string; the current local time will be used.
--no-diagnose::
--diagnose[=<mode>]::
Create a zip archive of supplemental information about the user's
machine, Git client, and repository state. The archive is written to the
same output directory as the bug report and is named
'git-diagnostics-<formatted suffix>'.
+
Without `mode` specified, the diagnostic archive will contain the default set of
statistics reported by `git diagnose`. An optional `mode` value may be specified
to change which information is included in the archive. See
linkgit:git-diagnose[1] for the list of valid values for `mode` and details
about their usage.
GIT
---
Part of the linkgit:git[1] suite

View File

@ -42,7 +42,7 @@ BUNDLE FORMAT
Bundles are `.pack` files (see linkgit:git-pack-objects[1]) with a
header indicating what references are contained within the bundle.
Like the packed archive format itself bundles can either be
Like the the packed archive format itself bundles can either be
self-contained, or be created using exclusions.
See the "OBJECT PREREQUISITES" section below.
@ -56,8 +56,10 @@ using "thin packs", bundles created using exclusions are smaller in
size. That they're "thin" under the hood is merely noted here as a
curiosity, and as a reference to other documentation.
See linkgit:gitformat-bundle[5] for more details and the discussion of
"thin pack" in linkgit:gitformat-pack[5] for further details.
See link:technical/bundle-format.html[the `bundle-format`
documentation] for more details and the discussion of "thin pack" in
link:technical/pack-format.html[the pack format documentation] for
further details.
OPTIONS
-------
@ -75,7 +77,7 @@ verify <file>::
commits exist and are fully linked in the current repository.
Then, 'git bundle' prints a list of missing commits, if any.
Finally, information about additional capabilities, such as "object
filter", is printed. See "Capabilities" in linkgit:gitformat-bundle[5]
filter", is printed. See "Capabilities" in link:technical/bundle-format.html
for more information. The exit code is zero for success, but will
be nonzero if the bundle file is invalid.
@ -335,11 +337,6 @@ You can also see what references it offers:
$ git ls-remote mybundle
----------------
FILE FORMAT
-----------
See linkgit:gitformat-bundle[5].
GIT
---
Part of the linkgit:git[1] suite

View File

@ -14,7 +14,7 @@ SYNOPSIS
'git cat-file' (-t | -s) [--allow-unknown-type] <object>
'git cat-file' (--batch | --batch-check | --batch-command) [--batch-all-objects]
[--buffer] [--follow-symlinks] [--unordered]
[--textconv | --filters] [-z]
[--textconv | --filters]
'git cat-file' (--textconv | --filters)
[<rev>:<path|tree-ish> | --path=<path|tree-ish> <rev>]
@ -63,12 +63,6 @@ OPTIONS
or to ask for a "blob" with `<object>` being a tag object that
points at it.
--[no-]mailmap::
--[no-]use-mailmap::
Use mailmap file to map author, committer and tagger names
and email addresses to canonical real names and email addresses.
See linkgit:git-shortlog[1].
--textconv::
Show the content as transformed by a textconv filter. In this case,
`<object>` has to be of the form `<tree-ish>:<path>`, or `:<path>` in
@ -213,11 +207,6 @@ respectively print:
/etc/passwd
--
-z::
Only meaningful with `--batch`, `--batch-check`, or
`--batch-command`; input is NUL-delimited instead of
newline-delimited.
OUTPUT
------

View File

@ -600,13 +600,6 @@ $ edit frotz
$ git add frotz
------------
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/checkout.txt[]
SEE ALSO
--------
linkgit:git-switch[1],

View File

@ -156,7 +156,10 @@ effect to your index in a row.
Pass the merge strategy-specific option through to the
merge strategy. See linkgit:git-merge[1] for details.
include::rerere-options.txt[]
--rerere-autoupdate::
--no-rerere-autoupdate::
Allow the rerere mechanism to update the index with the
result of auto-conflict resolution if possible.
SEQUENCER SUBCOMMANDS
---------------------

View File

@ -8,7 +8,7 @@ git-clean - Remove untracked files from the working tree
SYNOPSIS
--------
[verse]
'git clean' [-d] [-f] [-i] [-n] [-q] [-e <pattern>] [-x | -X] [--] [<pathspec>...]
'git clean' [-d] [-f] [-i] [-n] [-q] [-e <pattern>] [-x | -X] [--] <path>...
DESCRIPTION
-----------
@ -20,16 +20,16 @@ Normally, only files unknown to Git are removed, but if the `-x`
option is specified, ignored files are also removed. This can, for
example, be useful to remove all build products.
If any optional `<pathspec>...` arguments are given, only those paths
that match the pathspec are affected.
If any optional `<path>...` arguments are given, only those paths
are affected.
OPTIONS
-------
-d::
Normally, when no <pathspec> is specified, git clean will not
Normally, when no <path> is specified, git clean will not
recurse into untracked directories to avoid removing too much.
Specify -d to have it recurse into such directories as well.
If a <pathspec> is specified, -d is irrelevant; all untracked
If any paths are specified, -d is irrelevant; all untracked
files matching the specified paths (with exceptions for nested
git directories mentioned under `--force`) will be removed.
@ -133,13 +133,6 @@ help::
Show brief usage of interactive git-clean.
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/clean.txt[]
SEE ALSO
--------
linkgit:gitignore[5]

View File

@ -323,13 +323,6 @@ or `--mirror` is given)
for `host.xz:foo/.git`). Cloning into an existing directory
is only allowed if the directory is empty.
--bundle-uri=<uri>::
Before fetching from the remote, fetch a bundle from the given
`<uri>` and unbundle the data into the local repository. The refs
in the bundle will be stored under the hidden `refs/bundle/*`
namespace. This option is incompatible with `--depth`,
`--shallow-since`, and `--shallow-exclude`.
:git-clone: 1
include::urls.txt[]
@ -370,15 +363,6 @@ $ cd my-linux
$ git clone --bare -l /home/proj/.git /pub/scm/proj.git
------------
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/init.txt[]
include::config/clone.txt[]
GIT
---

View File

@ -74,13 +74,6 @@ v2.4.3 v2.4.4 v2.4.5 v2.4.6 v2.4.7
v2.4.8 v2.4.9
------------
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/column.txt[]
GIT
---
Part of the linkgit:git[1] suite

View File

@ -10,10 +10,7 @@ SYNOPSIS
--------
[verse]
'git commit-graph verify' [--object-dir <dir>] [--shallow] [--[no-]progress]
'git commit-graph write' [--object-dir <dir>] [--append]
[--split[=<strategy>]] [--reachable | --stdin-packs | --stdin-commits]
[--changed-paths] [--[no-]max-new-filters <n>] [--[no-]progress]
<split options>
'git commit-graph write' <options> [--object-dir <dir>] [--[no-]progress]
DESCRIPTION
@ -145,18 +142,6 @@ $ git show-ref -s | git commit-graph write --stdin-commits
$ git rev-parse HEAD | git commit-graph write --stdin-commits --append
------------------------------------------------
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/commitgraph.txt[]
FILE FORMAT
-----------
see linkgit:gitformat-commit-graph[5].
GIT
---

View File

@ -557,10 +557,6 @@ The editor used to edit the commit log message will be chosen from the
`VISUAL` environment variable, or the `EDITOR` environment variable (in that
order). See linkgit:git-var[1] for details.
include::includes/cmd-config-section-rest.txt[]
include::config/commit.txt[]
HOOKS
-----
This command can run `commit-msg`, `prepare-commit-msg`, `pre-commit`,

View File

@ -297,20 +297,23 @@ The default is to use a pager.
FILES
-----
By default, 'git config' will read configuration options from multiple
files:
If not set explicitly with `--file`, there are four files where
'git config' will search for configuration options:
$(prefix)/etc/gitconfig::
System-wide configuration file.
$XDG_CONFIG_HOME/git/config::
Second user-specific configuration file. If $XDG_CONFIG_HOME is not set
or empty, `$HOME/.config/git/config` will be used. Any single-valued
variable set in this file will be overwritten by whatever is in
`~/.gitconfig`. It is a good idea not to create this file if
you sometimes use older versions of Git, as support for this
file was added fairly recently.
~/.gitconfig::
User-specific configuration files. When the XDG_CONFIG_HOME environment
variable is not set or empty, $HOME/.config/ is used as
$XDG_CONFIG_HOME.
+
These are also called "global" configuration files. If both files exist, both
files are read in the order given above.
User-specific configuration file. Also called "global"
configuration file.
$GIT_DIR/config::
Repository specific configuration file.
@ -319,80 +322,28 @@ $GIT_DIR/config.worktree::
This is optional and is only searched when
`extensions.worktreeConfig` is present in $GIT_DIR/config.
You may also provide additional configuration parameters when running any
git command by using the `-c` option. See linkgit:git[1] for details.
Options will be read from all of these files that are available. If the
global or the system-wide configuration files are missing or unreadable they
will be ignored. If the repository configuration file is missing or unreadable,
'git config' will exit with a non-zero error code. An error message is produced
if the file is unreadable, but not if it is missing.
If no further options are given, all reading options will read all of these
files that are available. If the global or the system-wide configuration
file are not available they will be ignored. If the repository configuration
file is not available or readable, 'git config' will exit with a non-zero
error code. However, in neither case will an error message be issued.
The files are read in the order given above, with last value found taking
precedence over values read earlier. When multiple values are taken then all
values of a key from all files will be used.
By default, options are only written to the repository specific
You may override individual configuration parameters when running any git
command by using the `-c` option. See linkgit:git[1] for details.
All writing options will per default write to the repository specific
configuration file. Note that this also affects options like `--replace-all`
and `--unset`. *'git config' will only ever change one file at a time*.
You can limit which configuration sources are read from or written to by
specifying the path of a file with the `--file` option, or by specifying a
configuration scope with `--system`, `--global`, `--local`, or `--worktree`.
For more, see <<OPTIONS>> above.
You can override these rules using the `--global`, `--system`,
`--local`, `--worktree`, and `--file` command-line options; see
<<OPTIONS>> above.
[[SCOPES]]
SCOPES
------
Each configuration source falls within a configuration scope. The scopes
are:
system::
$(prefix)/etc/gitconfig
global::
$XDG_CONFIG_HOME/git/config
+
~/.gitconfig
local::
$GIT_DIR/config
worktree::
$GIT_DIR/config.worktree
command::
GIT_CONFIG_{COUNT,KEY,VALUE} environment variables (see <<ENVIRONMENT>>
below)
+
the `-c` option
With the exception of 'command', each scope corresponds to a command line
option: `--system`, `--global`, `--local`, `--worktree`.
When reading options, specifying a scope will only read options from the
files within that scope. When writing options, specifying a scope will write
to the files within that scope (instead of the repository specific
configuration file). See <<OPTIONS>> above for a complete description.
Most configuration options are respected regardless of the scope it is
defined in, but some options are only respected in certain scopes. See the
respective option's documentation for the full details.
Protected configuration
~~~~~~~~~~~~~~~~~~~~~~~
Protected configuration refers to the 'system', 'global', and 'command' scopes.
For security reasons, certain options are only respected when they are
specified in protected configuration, and ignored otherwise.
Git treats these scopes as if they are controlled by the user or a trusted
administrator. This is because an attacker who controls these scopes can do
substantial harm without using Git, so it is assumed that the user's environment
protects these scopes against attackers.
[[ENVIRONMENT]]
ENVIRONMENT
-----------

View File

@ -8,7 +8,7 @@ git-credential-cache--daemon - Temporarily store user credentials in memory
SYNOPSIS
--------
[verse]
'git credential-cache{litdd}daemon' [--debug] <socket-path>
'git credential-cache{litdd}daemon' [--debug] <socket>
DESCRIPTION
-----------
@ -16,7 +16,7 @@ DESCRIPTION
NOTE: You probably don't want to invoke this command yourself; it is
started automatically when you use linkgit:git-credential-cache[1].
This command listens on the Unix domain socket specified by `<socket-path>`
This command listens on the Unix domain socket specified by `<socket>`
for `git-credential-cache` clients. Clients may store and retrieve
credentials. Each credential is held for a timeout specified by the
client; once no credentials are held, the daemon exits.

View File

@ -69,10 +69,10 @@ $ git push http://example.com/repo.git
------------------------------------
You can provide options via the credential.helper configuration
variable (this example increases the cache time to 1 hour):
variable (this example drops the cache time to 5 minutes):
-------------------------------------------------------
$ git config credential.helper 'cache --timeout=3600'
$ git config credential.helper 'cache --timeout=300'
-------------------------------------------------------
GIT

View File

@ -160,8 +160,6 @@ empty string.
Components which are missing from the URL (e.g., there is no
username in the example above) will be left unset.
Unrecognised attributes are silently discarded.
GIT
---
Part of the linkgit:git[1] suite

View File

@ -1,65 +0,0 @@
git-diagnose(1)
================
NAME
----
git-diagnose - Generate a zip archive of diagnostic information
SYNOPSIS
--------
[verse]
'git diagnose' [(-o | --output-directory) <path>] [(-s | --suffix) <format>]
[--mode=<mode>]
DESCRIPTION
-----------
Collects detailed information about the user's machine, Git client, and
repository state and packages that information into a zip archive. The
generated archive can then, for example, be shared with the Git mailing list to
help debug an issue or serve as a reference for independent debugging.
By default, the following information is captured in the archive:
* 'git version --build-options'
* The path to the repository root
* The available disk space on the filesystem
* The name and size of each packfile, including those in alternate object
stores
* The total count of loose objects, as well as counts broken down by
`.git/objects` subdirectory
Additional information can be collected by selecting a different diagnostic mode
using the `--mode` option.
This tool differs from linkgit:git-bugreport[1] in that it collects much more
detailed information with a greater focus on reporting the size and data shape
of repository contents.
OPTIONS
-------
-o <path>::
--output-directory <path>::
Place the resulting diagnostics archive in `<path>` instead of the
current directory.
-s <format>::
--suffix <format>::
Specify an alternate suffix for the diagnostics archive name, to create
a file named 'git-diagnostics-<formatted suffix>'. This should take the
form of a strftime(3) format string; the current local time will be
used.
--mode=(stats|all)::
Specify the type of diagnostics that should be collected. The default behavior
of 'git diagnose' is equivalent to `--mode=stats`.
+
The `--mode=all` option collects everything included in `--mode=stats`, as well
as copies of `.git`, `.git/hooks`, `.git/info`, `.git/logs`, and
`.git/objects/info` directories. This additional information may be sensitive,
as it can be used to reconstruct the full contents of the diagnosed repository.
Users should exercise caution when sharing an archive generated with
`--mode=all`.
GIT
---
Part of the linkgit:git[1] suite

View File

@ -9,7 +9,7 @@ git-diff-files - Compares files in the working tree and the index
SYNOPSIS
--------
[verse]
'git diff-files' [-q] [-0 | -1 | -2 | -3 | -c | --cc] [<common-diff-options>] [<path>...]
'git diff-files' [-q] [-0|-1|-2|-3|-c|--cc] [<common-diff-options>] [<path>...]
DESCRIPTION
-----------

View File

@ -79,10 +79,10 @@ If --merge-base is given, use the merge base of the two commits for the
This form is to view the results of a merge commit. The first
listed <commit> must be the merge itself; the remaining two or
more commits should be its parents. Convenient ways to produce
the desired set of revisions are to use the suffixes `^@` and
`^!`. If A is a merge commit, then `git diff A A^@`,
`git diff A^!` and `git show A` all give the same combined diff.
more commits should be its parents. A convenient way to produce
the desired set of revisions is to use the `^@` suffix.
For instance, if `master` names a merge commit, `git diff master
master^@` gives the same combined diff as `git show master`.
'git diff' [<options>] <commit>..<commit> [--] [<path>...]::
@ -213,13 +213,6 @@ $ git diff -R <2>
rewrites (very expensive).
<2> Output diff in reverse.
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/diff.txt[]
SEE ALSO
--------
diff(1),

View File

@ -113,14 +113,33 @@ instead. `--no-symlinks` is the default on Windows.
See linkgit:git-diff[1] for the full list of supported options.
CONFIGURATION
-------------
CONFIG VARIABLES
----------------
'git difftool' falls back to 'git mergetool' config variables when the
difftool equivalents have not been defined.
include::includes/cmd-config-section-rest.txt[]
diff.tool::
The default diff tool to use.
include::config/difftool.txt[]
diff.guitool::
The default diff tool to use when `--gui` is specified.
difftool.<tool>.path::
Override the path for the given tool. This is useful in case
your tool is not in the PATH.
difftool.<tool>.cmd::
Specify the command to invoke the specified diff tool.
+
See the `--tool=<tool>` option above for more details.
difftool.prompt::
Prompt before each invocation of the diff tool.
difftool.trustExitCode::
Exit difftool if the invoked diff tool returns a non-zero exit status.
+
See the `--trust-exit-code` option above for more details.
SEE ALSO
--------

View File

@ -9,7 +9,7 @@ git-fast-export - Git data exporter
SYNOPSIS
--------
[verse]
'git fast-export' [<options>] | 'git fast-import'
'git fast-export [<options>]' | 'git fast-import'
DESCRIPTION
-----------

View File

@ -1564,13 +1564,6 @@ operator can use this facility to peek at the objects and refs from an
import in progress, at the cost of some added running time and worse
compression.
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/fastimport.txt[]
SEE ALSO
--------
linkgit:git-fast-export[1]

View File

@ -285,13 +285,6 @@ linkgit:git-gc[1]).
include::transfer-data-leaks.txt[]
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/fetch.txt[]
BUGS
----
Using --recurse-submodules can only fetch new commits in submodules that are

View File

@ -275,17 +275,6 @@ header). Note also that `git send-email` already handles this
transformation for you, and this option should not be used if you are
feeding the result to `git send-email`.
--[no-]force-in-body-from::
With the e-mail sender specified via the `--from` option, by
default, an in-body "From:" to identify the real author of
the commit is added at the top of the commit log message if
the sender is different from the author. With this option,
the in-body "From:" is added even when the sender and the
author have the same name and address, which may help if the
mailing list software mangles the sender's identity.
Defaults to the value of the `format.forceInBodyFrom`
configuration variable.
--add-header=<header>::
Add an arbitrary header to the email headers. This is in addition
to any configured headers, and may be used multiple times.

View File

@ -107,8 +107,6 @@ care about this output and want to speed it up further.
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/fsck.txt[]
DISCUSSION
@ -152,18 +150,6 @@ hash mismatch <object>::
object database value.
This indicates a serious data integrity problem.
FSCK MESSAGES
-------------
The following lists the types of errors `git fsck` detects and what
each error means, with their default severity. The severity of the
error, other than those that are marked as "(FATAL)", can be tweaked
by setting the corresponding `fsck.<msg-id>` configuration variable.
include::fsck-msgids.txt[]
Environment Variables
---------------------

View File

@ -3,7 +3,7 @@ git-fsmonitor{litdd}daemon(1)
NAME
----
git-fsmonitor--daemon - A Built-in Filesystem Monitor
git-fsmonitor--daemon - A Built-in File System Monitor
SYNOPSIS
--------
@ -17,7 +17,7 @@ DESCRIPTION
-----------
A daemon to watch the working directory for file and directory
changes using platform-specific filesystem notification facilities.
changes using platform-specific file system notification facilities.
This daemon communicates directly with commands like `git status`
using the link:technical/api-simple-ipc.html[simple IPC] interface
@ -63,44 +63,13 @@ CAVEATS
-------
The fsmonitor daemon does not currently know about submodules and does
not know to filter out filesystem events that happen within a
not know to filter out file system events that happen within a
submodule. If fsmonitor daemon is watching a super repo and a file is
modified within the working directory of a submodule, it will report
the change (as happening against the super repo). However, the client
will properly ignore these extra events, so performance may be affected
but it will not cause an incorrect result.
By default, the fsmonitor daemon refuses to work against network-mounted
repositories; this may be overridden by setting `fsmonitor.allowRemote` to
`true`. Note, however, that the fsmonitor daemon is not guaranteed to work
correctly with all network-mounted repositories and such use is considered
experimental.
On Mac OS, the inter-process communication (IPC) between various Git
commands and the fsmonitor daemon is done via a Unix domain socket (UDS) -- a
special type of file -- which is supported by native Mac OS filesystems,
but not on network-mounted filesystems, NTFS, or FAT32. Other filesystems
may or may not have the needed support; the fsmonitor daemon is not guaranteed
to work with these filesystems and such use is considered experimental.
By default, the socket is created in the `.git` directory, however, if the
`.git` directory is on a network-mounted filesystem, it will be instead be
created at `$HOME/.git-fsmonitor-*` unless `$HOME` itself is on a
network-mounted filesystem in which case you must set the configuration
variable `fsmonitor.socketDir` to the path of a directory on a Mac OS native
filesystem in which to create the socket file.
If none of the above directories (`.git`, `$HOME`, or `fsmonitor.socketDir`)
is on a native Mac OS file filesystem the fsmonitor daemon will report an
error that will cause the daemon and the currently running command to exit.
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/fsmonitor--daemon.txt[]
GIT
---
Part of the linkgit:git[1] suite

View File

@ -110,7 +110,8 @@ users and their repositories.
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
The below documentation is the same as what's found in
linkgit:git-config[1]:
include::config/gc.txt[]

View File

@ -23,7 +23,6 @@ SYNOPSIS
[--break] [--heading] [-p | --show-function]
[-A <post-context>] [-B <pre-context>] [-C <context>]
[-W | --function-context]
[(-m | --max-count) <num>]
[--threads <num>]
[-f <file>] [-e] <pattern>
[--and|--or|--not|(|)|-e <pattern>...]
@ -239,14 +238,6 @@ providing this option will cause it to die.
`git diff` works out patch hunk headers (see 'Defining a
custom hunk-header' in linkgit:gitattributes[5]).
-m <num>::
--max-count <num>::
Limit the amount of matches per file. When using the `-v` or
`--invert-match` option, the search stops after the specified
number of non-matches. A value of -1 will return unlimited
results (the default). A value of 0 will exit immediately with
a non-zero status.
--threads <num>::
Number of grep worker threads to use.
See `grep.threads` in 'CONFIGURATION' for more information.
@ -343,9 +334,34 @@ performance in this case, it might be desirable to use `--threads=1`.
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
grep.lineNumber::
If set to true, enable `-n` option by default.
grep.column::
If set to true, enable the `--column` option by default.
grep.patternType::
Set the default matching behavior. Using a value of 'basic', 'extended',
'fixed', or 'perl' will enable the `--basic-regexp`, `--extended-regexp`,
`--fixed-strings`, or `--perl-regexp` option accordingly, while the
value 'default' will return to the default matching behavior.
grep.extendedRegexp::
If set to true, enable `--extended-regexp` option by default. This
option is ignored when the `grep.patternType` option is set to a value
other than 'default'.
grep.threads::
Number of grep worker threads to use. If unset (or set to 0), Git will
use as many threads as the number of logical cores available.
grep.fullName::
If set to true, enable `--full-name` option by default.
grep.fallbackToNoIndex::
If set to true, fall back to git grep --no-index if git grep
is executed outside of a git repository. Defaults to false.
include::config/grep.txt[]
GIT
---

View File

@ -9,8 +9,7 @@ git-hash-object - Compute object ID and optionally creates a blob from a file
SYNOPSIS
--------
[verse]
'git hash-object' [-t <type>] [-w] [--path=<file> | --no-filters]
[--stdin [--literally]] [--] <file>...
'git hash-object' [-t <type>] [-w] [--path=<file>|--no-filters] [--stdin [--literally]] [--] <file>...
'git hash-object' [-t <type>] [-w] --stdin-paths [--no-filters]
DESCRIPTION

View File

@ -9,16 +9,14 @@ SYNOPSIS
--------
[verse]
'git help' [-a|--all] [--[no-]verbose] [--[no-]external-commands] [--[no-]aliases]
'git help' [[-i|--info] [-m|--man] [-w|--web]] [<command>|<doc>]
'git help' [[-i|--info] [-m|--man] [-w|--web]] [<command>|<guide>]
'git help' [-g|--guides]
'git help' [-c|--config]
'git help' [--user-interfaces]
'git help' [--developer-interfaces]
DESCRIPTION
-----------
With no options and no '<command>' or '<doc>' given, the synopsis of the 'git'
With no options and no '<command>' or '<guide>' given, the synopsis of the 'git'
command and a list of the most commonly used Git commands are printed
on the standard output.
@ -28,8 +26,8 @@ printed on the standard output.
If the option `--guides` or `-g` is given, a list of the
Git concept guides is also printed on the standard output.
If a command or other documentation is given, the relevant manual page
will be brought up. The 'man' program is used by default for this
If a command, or a guide, is given, a manual page for that command or
guide is brought up. The 'man' program is used by default for this
purpose, but this can be overridden by other options or configuration
variables.
@ -71,23 +69,6 @@ OPTIONS
--guides::
Prints a list of the Git concept guides on the standard output.
--user-interfaces::
Prints a list of the repository, command and file interfaces
documentation on the standard output.
+
In-repository file interfaces such as `.git/info/exclude` are
documented here (see linkgit:gitrepository-layout[5]), as well as
in-tree configuration such as `.mailmap` (see linkgit:gitmailmap[5]).
+
This section of the documentation also covers general or widespread
user-interface conventions (e.g. linkgit:gitcli[7]), and
pseudo-configuration such as the file-based `.git/hooks/*` interface
described in linkgit:githooks[5].
--developer-interfaces::
Print list of file formats, protocols and other developer
interfaces documentation on the standard output.
-i::
--info::
Display manual page for the command in the 'info' format. The

View File

@ -54,8 +54,6 @@ CONFIGURATION
To use the tool, `imap.folder` and either `imap.tunnel` or `imap.host` must be set
to appropriate values.
include::includes/cmd-config-section-rest.txt[]
include::config/imap.txt[]
EXAMPLES

View File

@ -169,13 +169,6 @@ $ git commit <3>
<2> Add all existing files to the index.
<3> Record the pristine state as the first commit in the history.
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/init.txt[]
GIT
---
Part of the linkgit:git[1] suite

View File

@ -8,9 +8,8 @@ git-interpret-trailers - Add or parse structured information in commit messages
SYNOPSIS
--------
[verse]
'git interpret-trailers' [--in-place] [--trim-empty]
[(--trailer <token>[(=|:)<value>])...]
[--parse] [<file>...]
'git interpret-trailers' [<options>] [(--trailer <token>[(=|:)<value>])...] [<file>...]
'git interpret-trailers' [<options>] [--parse] [<file>...]
DESCRIPTION
-----------
@ -61,12 +60,10 @@ non-whitespace lines before a line that starts with '---' (followed by a
space or the end of the line). Such three minus signs start the patch
part of the message. See also `--no-divider` below.
When reading trailers, there can be no whitespace before or inside the
token, but any number of regular space and tab characters are allowed
between the token and the separator. There can be whitespaces before,
inside or after the value. The value may be split over multiple lines
with each subsequent line starting with at least one whitespace, like
the "folding" in RFC 822.
When reading trailers, there can be whitespaces after the
token, the separator and the value. There can also be whitespaces
inside the token and the value. The value may be split over multiple lines with
each subsequent line starting with whitespace, like the "folding" in RFC 822.
Note that 'trailers' do not follow and are not intended to follow many
rules for RFC 822 headers. For example they do not follow

View File

@ -45,23 +45,13 @@ OPTIONS
--decorate-refs=<pattern>::
--decorate-refs-exclude=<pattern>::
For each candidate reference, do not use it for decoration if it
If no `--decorate-refs` is given, pretend as if all refs were
included. For each candidate, do not use it for decoration if it
matches any patterns given to `--decorate-refs-exclude` or if it
doesn't match any of the patterns given to `--decorate-refs`. The
`log.excludeDecoration` config option allows excluding refs from
the decorations, but an explicit `--decorate-refs` pattern will
override a match in `log.excludeDecoration`.
+
If none of these options or config settings are given, then references are
used as decoration if they match `HEAD`, `refs/heads/`, `refs/remotes/`,
`refs/stash/`, or `refs/tags/`.
--clear-decorations::
When specified, this option clears all previous `--decorate-refs`
or `--decorate-refs-exclude` options and relaxes the default
decoration filter to include all references. This option is
assumed if the config value `log.initialDecorationSet` is set to
`all`.
--source::
Print out the ref name given on the command line by which each
@ -209,11 +199,47 @@ i18n.logOutputEncoding::
Defaults to the value of `i18n.commitEncoding` if set, and UTF-8
otherwise.
include::includes/cmd-config-section-rest.txt[]
log.date::
Default format for human-readable dates. (Compare the
`--date` option.) Defaults to "default", which means to write
dates like `Sat May 8 19:35:34 2010 -0500`.
+
If the format is set to "auto:foo" and the pager is in use, format
"foo" will be the used for the date format. Otherwise "default" will
be used.
include::config/log.txt[]
log.follow::
If `true`, `git log` will act as if the `--follow` option was used when
a single <path> is given. This has the same limitations as `--follow`,
i.e. it cannot be used to follow multiple files and does not work well
on non-linear history.
include::config/notes.txt[]
log.showRoot::
If `false`, `git log` and related commands will not treat the
initial commit as a big creation event. Any root commits in
`git log -p` output would be shown without a diff attached.
The default is `true`.
log.showSignature::
If `true`, `git log` and related commands will act as if the
`--show-signature` option was passed to them.
mailmap.*::
See linkgit:git-shortlog[1].
notes.displayRef::
Which refs, in addition to the default set by `core.notesRef`
or `GIT_NOTES_REF`, to read notes from when showing commit
messages with the `log` family of commands. See
linkgit:git-notes[1].
+
May be an unabbreviated ref name or a glob and may be specified
multiple times. A warning will be issued for refs that do not exist,
but a glob that does not match any refs is silently ignored.
+
This setting can be disabled by the `--no-notes` option,
overridden by the `GIT_NOTES_DISPLAY_REF` environment variable,
and overridden by the `--notes=<ref>` option.
GIT
---

View File

@ -10,8 +10,8 @@ SYNOPSIS
--------
[verse]
'git ls-files' [-z] [-t] [-v] [-f]
[-c|--cached] [-d|--deleted] [-o|--others] [-i|--ignored]
[-s|--stage] [-u|--unmerged] [-k|--killed] [-m|--modified]
[-c|--cached] [-d|--deleted] [-o|--others] [-i|--|ignored]
[-s|--stage] [-u|--unmerged] [-k|--|killed] [-m|--modified]
[--directory [--no-empty-directory]] [--eol]
[--deduplicate]
[-x <pattern>|--exclude=<pattern>]
@ -20,7 +20,7 @@ SYNOPSIS
[--exclude-standard]
[--error-unmatch] [--with-tree=<tree-ish>]
[--full-name] [--recurse-submodules]
[--abbrev[=<n>]] [--format=<format>] [--] [<file>...]
[--abbrev[=<n>]] [--] [<file>...]
DESCRIPTION
-----------
@ -192,13 +192,6 @@ followed by the ("attr/<eolattr>").
to the contained files. Sparse directories will be shown with a
trailing slash, such as "x/" for a sparse directory "x".
--format=<format>::
A string that interpolates `%(fieldname)` from the result being shown.
It also interpolates `%%` to `%`, and `%xx` where `xx` are hex digits
interpolates to character with hex code `xx`; for example `%00`
interpolates to `\0` (NUL), `%09` to `\t` (TAB) and %0a to `\n` (LF).
--format cannot be combined with `-s`, `-o`, `-k`, `-t`, `--resolve-undo`
and `--eol`.
\--::
Do not interpret any more arguments as options.
@ -230,36 +223,6 @@ quoted as explained for the configuration variable `core.quotePath`
(see linkgit:git-config[1]). Using `-z` the filename is output
verbatim and the line is terminated by a NUL byte.
It is possible to print in a custom format by using the `--format`
option, which is able to interpolate different fields using
a `%(fieldname)` notation. For example, if you only care about the
"objectname" and "path" fields, you can execute with a specific
"--format" like
git ls-files --format='%(objectname) %(path)'
FIELD NAMES
-----------
The way each path is shown can be customized by using the
`--format=<format>` option, where the %(fieldname) in the
<format> string for various aspects of the index entry are
interpolated. The following "fieldname" are understood:
objectmode::
The mode of the file which is recorded in the index.
objectname::
The name of the file which is recorded in the index.
stage::
The stage of the file which is recorded in the index.
eolinfo:index::
eolinfo:worktree::
The <eolinfo> (see the description of the `--eol` option) of
the contents in the index or in the worktree for the path.
eolattr::
The <eolattr> (see the description of the `--eol` option)
that applies to the path.
path::
The pathname of the file which is recorded in the index.
EXCLUDE PATTERNS
----------------

View File

@ -115,13 +115,6 @@ If no such configuration option has been set, `warn` will be used.
<patch>::
The patch extracted from e-mail.
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/mailinfo.txt[]
GIT
---
Part of the linkgit:git[1] suite

View File

@ -11,7 +11,7 @@ SYNOPSIS
[verse]
'git maintenance' run [<options>]
'git maintenance' start [--scheduler=<scheduler>]
'git maintenance' (stop|register|unregister) [<options>]
'git maintenance' (stop|register|unregister)
DESCRIPTION
@ -50,13 +50,13 @@ stop::
the background maintenance is restarted later.
register::
Initialize Git config values so any scheduled maintenance will start
running on this repository. This adds the repository to the
`maintenance.repo` config variable in the current user's global config,
or the config specified by --config-file option, and enables some
recommended configuration values for `maintenance.<task>.schedule`. The
tasks that are enabled are safe for running in the background without
disrupting foreground processes.
Initialize Git config values so any scheduled maintenance will
start running on this repository. This adds the repository to the
`maintenance.repo` config variable in the current user's global
config and enables some recommended configuration values for
`maintenance.<task>.schedule`. The tasks that are enabled are safe
for running in the background without disrupting foreground
processes.
+
The `register` subcommand will also set the `maintenance.strategy` config
value to `incremental`, if this value is not previously set. The
@ -79,10 +79,6 @@ unregister::
Remove the current repository from background maintenance. This
only removes the repository from the configured list. It does not
stop the background maintenance processes from running.
+
The `unregister` subcommand will report an error if the current repository
is not already registered. Use the `--force` option to return success even
when the current repository is not registered.
TASKS
-----
@ -401,13 +397,6 @@ If you want to customize the background tasks, please rename the tasks
so future calls to `git maintenance (start|stop)` do not overwrite your
custom tasks.
CONFIGURATION
-------------
include::includes/cmd-config-section-all.txt[]
include::config/maintenance.txt[]
GIT
---

View File

@ -9,8 +9,8 @@ git-merge-base - Find as good common ancestors as possible for a merge
SYNOPSIS
--------
[verse]
'git merge-base' [-a | --all] <commit> <commit>...
'git merge-base' [-a | --all] --octopus <commit>...
'git merge-base' [-a|--all] <commit> <commit>...
'git merge-base' [-a|--all] --octopus <commit>...
'git merge-base' --is-ancestor <commit> <commit>
'git merge-base' --independent <commit>...
'git merge-base' --fork-point <ref> [<commit>]

View File

@ -3,297 +3,26 @@ git-merge-tree(1)
NAME
----
git-merge-tree - Perform merge without touching index or working tree
git-merge-tree - Show three-way merge without touching index
SYNOPSIS
--------
[verse]
'git merge-tree' [--write-tree] [<options>] <branch1> <branch2>
'git merge-tree' [--trivial-merge] <base-tree> <branch1> <branch2> (deprecated)
'git merge-tree' <base-tree> <branch1> <branch2>
[[NEWMERGE]]
DESCRIPTION
-----------
Reads three tree-ish, and output trivial merge results and
conflicting stages to the standard output. This is similar to
what three-way 'git read-tree -m' does, but instead of storing the
results in the index, the command outputs the entries to the
standard output.
This command has a modern `--write-tree` mode and a deprecated
`--trivial-merge` mode. With the exception of the
<<DEPMERGE,DEPRECATED DESCRIPTION>> section at the end, the rest of
this documentation describes modern `--write-tree` mode.
Performs a merge, but does not make any new commits and does not read
from or write to either the working tree or index.
The performed merge will use the same feature as the "real"
linkgit:git-merge[1], including:
* three way content merges of individual files
* rename detection
* proper directory/file conflict handling
* recursive ancestor consolidation (i.e. when there is more than one
merge base, creating a virtual merge base by merging the merge bases)
* etc.
After the merge completes, a new toplevel tree object is created. See
`OUTPUT` below for details.
OPTIONS
-------
-z::
Do not quote filenames in the <Conflicted file info> section,
and end each filename with a NUL character rather than
newline. Also begin the messages section with a NUL character
instead of a newline. See <<OUTPUT>> below for more information.
--name-only::
In the Conflicted file info section, instead of writing a list
of (mode, oid, stage, path) tuples to output for conflicted
files, just provide a list of filenames with conflicts (and
do not list filenames multiple times if they have multiple
conflicting stages).
--[no-]messages::
Write any informational messages such as "Auto-merging <path>"
or CONFLICT notices to the end of stdout. If unspecified, the
default is to include these messages if there are merge
conflicts, and to omit them otherwise.
--allow-unrelated-histories::
merge-tree will by default error out if the two branches specified
share no common history. This flag can be given to override that
check and make the merge proceed anyway.
[[OUTPUT]]
OUTPUT
------
For a successful merge, the output from git-merge-tree is simply one
line:
<OID of toplevel tree>
Whereas for a conflicted merge, the output is by default of the form:
<OID of toplevel tree>
<Conflicted file info>
<Informational messages>
These are discussed individually below.
However, there is an exception. If `--stdin` is passed, then there is
an extra section at the beginning, a NUL character at the end, and then
all the sections repeat for each line of input. Thus, if the first merge
is conflicted and the second is clean, the output would be of the form:
<Merge status>
<OID of toplevel tree>
<Conflicted file info>
<Informational messages>
NUL
<Merge status>
<OID of toplevel tree>
NUL
[[MS]]
Merge status
~~~~~~~~~~~~
This is an integer status followed by a NUL character. The integer status is:
0: merge had conflicts
1: merge was clean
&lt;0: something prevented the merge from running (e.g. access to repository
objects denied by filesystem)
[[OIDTLT]]
OID of toplevel tree
~~~~~~~~~~~~~~~~~~~~
This is a tree object that represents what would be checked out in the
working tree at the end of `git merge`. If there were conflicts, then
files within this tree may have embedded conflict markers. This section
is always followed by a newline (or NUL if `-z` is passed).
[[CFI]]
Conflicted file info
~~~~~~~~~~~~~~~~~~~~
This is a sequence of lines with the format
<mode> <object> <stage> <filename>
The filename will be quoted as explained for the configuration
variable `core.quotePath` (see linkgit:git-config[1]). However, if
the `--name-only` option is passed, the mode, object, and stage will
be omitted. If `-z` is passed, the "lines" are terminated by a NUL
character instead of a newline character.
[[IM]]
Informational messages
~~~~~~~~~~~~~~~~~~~~~~
This section provides informational messages, typically about
conflicts. The format of the section varies significantly depending
on whether `-z` is passed.
If `-z` is passed:
The output format is zero or more conflict informational records, each
of the form:
<list-of-paths><conflict-type>NUL<conflict-message>NUL
where <list-of-paths> is of the form
<number-of-paths>NUL<path1>NUL<path2>NUL...<pathN>NUL
and includes paths (or branch names) affected by the conflict or
informational message in <conflict-message>. Also, <conflict-type> is a
stable string explaining the type of conflict, such as
* "Auto-merging"
* "CONFLICT (rename/delete)"
* "CONFLICT (submodule lacks merge base)"
* "CONFLICT (binary)"
and <conflict-message> is a more detailed message about the conflict which often
(but not always) embeds the <stable-short-type-description> within it. These
strings may change in future Git versions. Some examples:
* "Auto-merging <file>"
* "CONFLICT (rename/delete): <oldfile> renamed...but deleted in..."
* "Failed to merge submodule <submodule> (no merge base)"
* "Warning: cannot merge binary files: <filename>"
If `-z` is NOT passed:
This section starts with a blank line to separate it from the previous
sections, and then only contains the <conflict-message> information
from the previous section (separated by newlines). These are
non-stable strings that should not be parsed by scripts, and are just
meant for human consumption. Also, note that while <conflict-message>
strings usually do not contain embedded newlines, they sometimes do.
(However, the free-form messages will never have an embedded NUL
character). So, the entire block of information is meant for human
readers as an agglomeration of all conflict messages.
EXIT STATUS
-----------
For a successful, non-conflicted merge, the exit status is 0. When the
merge has conflicts, the exit status is 1. If the merge is not able to
complete (or start) due to some kind of error, the exit status is
something other than 0 or 1 (and the output is unspecified). When
--stdin is passed, the return status is 0 for both successful and
conflicted merges, and something other than 0 or 1 if it cannot complete
all the requested merges.
USAGE NOTES
-----------
This command is intended as low-level plumbing, similar to
linkgit:git-hash-object[1], linkgit:git-mktree[1],
linkgit:git-commit-tree[1], linkgit:git-write-tree[1],
linkgit:git-update-ref[1], and linkgit:git-mktag[1]. Thus, it can be
used as a part of a series of steps such as:
NEWTREE=$(git merge-tree --write-tree $BRANCH1 $BRANCH2)
test $? -eq 0 || die "There were conflicts..."
NEWCOMMIT=$(git commit-tree $NEWTREE -p $BRANCH1 -p $BRANCH2)
git update-ref $BRANCH1 $NEWCOMMIT
Note that when the exit status is non-zero, `NEWTREE` in this sequence
will contain a lot more output than just a tree.
For conflicts, the output includes the same information that you'd get
with linkgit:git-merge[1]:
* what would be written to the working tree (the
<<OIDTLT,OID of toplevel tree>>)
* the higher order stages that would be written to the index (the
<<CFI,Conflicted file info>>)
* any messages that would have been printed to stdout (the
<<IM,Informational messages>>)
MISTAKES TO AVOID
-----------------
Do NOT look through the resulting toplevel tree to try to find which
files conflict; parse the <<CFI,Conflicted file info>> section instead.
Not only would parsing an entire tree be horrendously slow in large
repositories, there are numerous types of conflicts not representable by
conflict markers (modify/delete, mode conflict, binary file changed on
both sides, file/directory conflicts, various rename conflict
permutations, etc.)
Do NOT interpret an empty <<CFI,Conflicted file info>> list as a clean
merge; check the exit status. A merge can have conflicts without having
individual files conflict (there are a few types of directory rename
conflicts that fall into this category, and others might also be added
in the future).
Do NOT attempt to guess or make the user guess the conflict types from
the <<CFI,Conflicted file info>> list. The information there is
insufficient to do so. For example: Rename/rename(1to2) conflicts (both
sides renamed the same file differently) will result in three different
file having higher order stages (but each only has one higher order
stage), with no way (short of the <<IM,Informational messages>> section)
to determine which three files are related. File/directory conflicts
also result in a file with exactly one higher order stage.
Possibly-involved-in-directory-rename conflicts (when
"merge.directoryRenames" is unset or set to "conflicts") also result in
a file with exactly one higher order stage. In all cases, the
<<IM,Informational messages>> section has the necessary info, though it
is not designed to be machine parseable.
Do NOT assume that each paths from <<CFI,Conflicted file info>>, and
the logical conflicts in the <<IM,Informational messages>> have a
one-to-one mapping, nor that there is a one-to-many mapping, nor a
many-to-one mapping. Many-to-many mappings exist, meaning that each
path can have many logical conflict types in a single merge, and each
logical conflict type can affect many paths.
Do NOT assume all filenames listed in the <<IM,Informational messages>>
section had conflicts. Messages can be included for files that have no
conflicts, such as "Auto-merging <file>".
AVOID taking the OIDS from the <<CFI,Conflicted file info>> and
re-merging them to present the conflicts to the user. This will lose
information. Instead, look up the version of the file found within the
<<OIDTLT,OID of toplevel tree>> and show that instead. In particular,
the latter will have conflict markers annotated with the original
branch/commit being merged and, if renames were involved, the original
filename. While you could include the original branch/commit in the
conflict marker annotations when re-merging, the original filename is
not available from the <<CFI,Conflicted file info>> and thus you would
be losing information that might help the user resolve the conflict.
[[DEPMERGE]]
DEPRECATED DESCRIPTION
----------------------
Per the <<NEWMERGE,DESCRIPTION>> and unlike the rest of this
documentation, this section describes the deprecated `--trivial-merge`
mode.
Other than the optional `--trivial-merge`, this mode accepts no
options.
This mode reads three tree-ish, and outputs trivial merge results and
conflicting stages to the standard output in a semi-diff format.
Since this was designed for higher level scripts to consume and merge
the results back into the index, it omits entries that match
<branch1>. The result of this second form is similar to what
three-way 'git read-tree -m' does, but instead of storing the results
in the index, the command outputs the entries to the standard output.
This form not only has limited applicability (a trivial merge cannot
handle content merges of individual files, rename detection, proper
directory/file conflict handling, etc.), the output format is also
difficult to work with, and it will generally be less performant than
the first form even on successful merges (especially if working in
large repositories).
This is meant to be used by higher level scripts to compute
merge results outside of the index, and stuff the results back into the
index. For this reason, the output from the command omits
entries that match the <branch1> tree.
GIT
---

View File

@ -90,7 +90,10 @@ invocations. The automated message can include the branch description.
If `--log` is specified, a shortlog of the commits being merged
will be appended to the specified message.
include::rerere-options.txt[]
--rerere-autoupdate::
--no-rerere-autoupdate::
Allow the rerere mechanism to update the index with the
result of auto-conflict resolution if possible.
--overwrite-ignore::
--no-overwrite-ignore::
@ -383,16 +386,13 @@ include::merge-strategies.txt[]
CONFIGURATION
-------------
include::config/merge.txt[]
branch.<name>.mergeOptions::
Sets default options for merging into branch <name>. The syntax and
supported options are the same as those of 'git merge', but option
values containing whitespace characters are currently not supported.
include::includes/cmd-config-section-rest.txt[]
include::config/merge.txt[]
SEE ALSO
--------
linkgit:git-fmt-merge-msg[1], linkgit:git-pull[1],

Some files were not shown because too many files have changed in this diff Show More