CVS commit: pkgsrc/devel/libgit2

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Wed Jan 25 13:44:47 UTC 2023

Modified Files:
        pkgsrc/devel/libgit2: Makefile buildlink3.mk distinfo

Log Message:
devel/libgit2: update to 1.5.1

1.5.1 (2023-01-20)

libgit2, when compiled using the optional, included libssh2 backend, fails
to verify SSH keys by default.

Description

When using an SSH remote with the optional, included libssh2 backend,
libgit2 does not perform certificate checking by default.  Prior versions of
libgit2 require the caller to set the certificate_check field of libgit2's
git_remote_callbacks structure - if a certificate check callback is not set,
libgit2 does not perform any certificate checking.  This means that by
default - without configuring a certificate check callback, clients will not
perform validation on the server SSH keys and may be subject to a
man-in-the-middle attack.

Beginning in libgit2 v1.4.5 and v1.5.1, libgit2 will now perform host key
checking by default.  Users can still override the default behavior using
the certificate_check function.

The libgit2 security team would like to thank the Julia and Rust security
teams for responsibly disclosing this vulnerability and assisting with
fixing the vulnerability.

Users are encouraged to upgrade to v1.4.5 or v1.5.1.


To generate a diff of this commit:
cvs rdiff -u -r1.59 -r1.60 pkgsrc/devel/libgit2/Makefile
cvs rdiff -u -r1.12 -r1.13 pkgsrc/devel/libgit2/buildlink3.mk
cvs rdiff -u -r1.27 -r1.28 pkgsrc/devel/libgit2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/libgit2/Makefile
diff -u pkgsrc/devel/libgit2/Makefile:1.59 pkgsrc/devel/libgit2/Makefile:1.60
--- pkgsrc/devel/libgit2/Makefile:1.59  Tue Jan 24 18:36:23 2023
+++ pkgsrc/devel/libgit2/Makefile       Wed Jan 25 13:44:47 2023
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.59 2023/01/24 18:36:23 wiz Exp $
+# $NetBSD: Makefile,v 1.60 2023/01/25 13:44:47 taca Exp $
 
-DISTNAME=      libgit2-1.5.0
-PKGREVISION=   1
+DISTNAME=      libgit2-1.5.1
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libgit2/}
 GITHUB_TAG=    v${PKGVERSION_NOREV}

Index: pkgsrc/devel/libgit2/buildlink3.mk
diff -u pkgsrc/devel/libgit2/buildlink3.mk:1.12 pkgsrc/devel/libgit2/buildlink3.mk:1.13
--- pkgsrc/devel/libgit2/buildlink3.mk:1.12     Sat Sep  3 14:53:35 2022
+++ pkgsrc/devel/libgit2/buildlink3.mk  Wed Jan 25 13:44:47 2023
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.12 2022/09/03 14:53:35 taca Exp $
+# $NetBSD: buildlink3.mk,v 1.13 2023/01/25 13:44:47 taca Exp $
 
 BUILDLINK_TREE+=       libgit2
 
@@ -6,7 +6,7 @@ BUILDLINK_TREE+=        libgit2
 LIBGIT2_BUILDLINK3_MK:=
 
 BUILDLINK_API_DEPENDS.libgit2+=        libgit2>=0.28.0
-BUILDLINK_ABI_DEPENDS.libgit2+=        libgit2>=1.5
+BUILDLINK_ABI_DEPENDS.libgit2+=        libgit2>=1.5.1
 BUILDLINK_PKGSRCDIR.libgit2?=  ../../devel/libgit2
 
 .include "../../devel/pcre2/buildlink3.mk"

Index: pkgsrc/devel/libgit2/distinfo
diff -u pkgsrc/devel/libgit2/distinfo:1.27 pkgsrc/devel/libgit2/distinfo:1.28
--- pkgsrc/devel/libgit2/distinfo:1.27  Sat Sep  3 14:53:35 2022
+++ pkgsrc/devel/libgit2/distinfo       Wed Jan 25 13:44:47 2023
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.27 2022/09/03 14:53:35 taca Exp $
+$NetBSD: distinfo,v 1.28 2023/01/25 13:44:47 taca Exp $
 
-BLAKE2s (libgit2-1.5.0.tar.gz) = be3d1ffb66b9a770545a910dc027c3a64ff4f80b7816302019497c7e42f43536
-SHA512 (libgit2-1.5.0.tar.gz) = 7a32b27cd32bd03ce7be6c127317f82a4ac6f16615c3234699676781f4858d057edb0410b2fe36fd2e634b00748a8b0be17f23809e09a7602ba48185134300f7
-Size (libgit2-1.5.0.tar.gz) = 5893437 bytes
+BLAKE2s (libgit2-1.5.1.tar.gz) = f247ec23b0b615cf904abfbfbf557b190072d5bb8195d01975d31df3f30ddfba
+SHA512 (libgit2-1.5.1.tar.gz) = 04cf389e30cd9fb787704e3c8997acaaeea5c13e1e2f9eaf9f5598d35c2e85f3cf04b47312cae9e7278236ecb089c2d33addd852e38d3c7d2daa87929b077f39
+Size (libgit2-1.5.1.tar.gz) = 5895483 bytes