[pkgsrc/trunk]: pkgsrc/devel Git: update to 2.19.1

[maya <maya%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/b0eda84057b3
branches:  trunk
changeset: 313650:b0eda84057b3
user:      maya <maya%pkgsrc.org@localhost>
date:      Fri Oct 05 17:48:20 2018 +0000

description:
Git: update to 2.19.1

These releases fix a security flaw (CVE-2018-17456), which allowed an
attacker to execute arbitrary code by crafting a malicious .gitmodules
file in a project cloned with --recurse-submodules.

When running "git clone --recurse-submodules", Git parses the supplied
.gitmodules file for a URL field and blindly passes it as an argument
to a "git clone" subprocess.  If the URL field is set to a string that
begins with a dash, this "git clone" subprocess interprets the URL as
an option.  This can lead to executing an arbitrary script shipped in
the superproject as the user who ran "git clone".

In addition to fixing the security issue for the user running "clone",
the 2.17.2, 2.18.1 and 2.19.1 releases have an "fsck" check which can
be used to detect such malicious repository content when fetching or
accepting a push. See "transfer.fsckObjects" in git-config(1).

Credit for finding and fixing this vulnerability goes to joernchen
and Jeff King, respectively.

diffstat:

 devel/git-base/distinfo    |  10 +++++-----
 devel/git/Makefile.version |   4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diffs (31 lines):

diff -r 0f12ed400766 -r b0eda84057b3 devel/git-base/distinfo
--- a/devel/git-base/distinfo   Fri Oct 05 14:23:44 2018 +0000
+++ b/devel/git-base/distinfo   Fri Oct 05 17:48:20 2018 +0000
@@ -1,9 +1,9 @@
-$NetBSD: distinfo,v 1.83 2018/09/13 10:56:42 adam Exp $
+$NetBSD: distinfo,v 1.84 2018/10/05 17:48:20 maya Exp $
 
-SHA1 (git-2.19.0.tar.xz) = 17f92df56588c58d2ebaacc5a47f677c8d8e7c61
-RMD160 (git-2.19.0.tar.xz) = 7beb63b801939650f5b8b08b6efd6d3c3235dc81
-SHA512 (git-2.19.0.tar.xz) = 305e51f8e22d96847fcdf4169340795aacaf5f4c5b8052cda860a668059d9ef35bb2840c278b7207f3b9f0e1c32915719649edc20bd3cd33b53e97a06159ceac
-Size (git-2.19.0.tar.xz) = 5227124 bytes
+SHA1 (git-2.19.1.tar.xz) = b61b1bdaf0e695a9c76e9a7994bff0c6026ca540
+RMD160 (git-2.19.1.tar.xz) = f03b87ab8ad24e9c7ceb346f25da1ea6621f59e4
+SHA512 (git-2.19.1.tar.xz) = a1bc1032b1de9eb9ea8b7c385cd009f64247e13066e0a91e9682e35400ded05f88c23b523cca4782f57544060d6ba0f9d3bec944399cda5771a4945c38bb9b98
+Size (git-2.19.1.tar.xz) = 5227908 bytes
 SHA1 (patch-Makefile) = 41955729837095abc055850751cce19023e7a2d1
 SHA1 (patch-ac) = e5d2112d158fe493a89b244a10d2e4b998a23d98
 SHA1 (patch-af) = 06460f220b4703a1ff98809006ec1aed5017bb23
diff -r 0f12ed400766 -r b0eda84057b3 devel/git/Makefile.version
--- a/devel/git/Makefile.version        Fri Oct 05 14:23:44 2018 +0000
+++ b/devel/git/Makefile.version        Fri Oct 05 17:48:20 2018 +0000
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile.version,v 1.73 2018/09/13 10:56:42 adam Exp $
+# $NetBSD: Makefile.version,v 1.74 2018/10/05 17:48:20 maya Exp $
 #
 # used by devel/git/Makefile.common
 # used by devel/git-cvs/Makefile
 # used by devel/git-svn/Makefile
 
-GIT_VERSION=   2.19.0
+GIT_VERSION=   2.19.1