CVS commit: pkgsrc/devel/py-dulwich

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Fri Jul 17 06:42:32 UTC 2026

Modified Files:
        pkgsrc/devel/py-dulwich: Makefile distinfo

Log Message:
py-dulwich: updated to 1.2.11

1.2.11  2026-07-16

* Let porcelain functions that consult the environment take an ``env``
  argument overriding ``os.environ``. As a side effect ``tag_create`` now
  honours ``GIT_COMMITTER_NAME``/``GIT_COMMITTER_EMAIL`` for the tagger line
  and ``merge``/``revert`` honour ``GIT_AUTHOR_NAME``/``GIT_AUTHOR_EMAIL``,
  matching git. (Jelmer Vernooij)

* Honour the ``core.worktree`` configuration option, so the working tree can
  live somewhere other than the parent of the control directory. Relative
  paths are resolved against the control directory, and ``core.bare`` and
  ``core.worktree`` are now rejected as incompatible. (Jelmer Vernooij)

* Clear ``core.bare`` when setting up a submodule's working tree.
  ``submodule_update`` cloned the submodule bare and then set
  ``core.worktree`` on it, leaving a configuration git considers invalid.
  (Jelmer Vernooij)

* Read ``GIT_PROTOCOL`` in porcelain rather than only in the command line
  interface, so ``clone`` and ``pull`` honour it when called as a library.
  An explicit ``protocol_version`` argument still wins. (Jelmer Vernooij)

* Add a ``remote`` argument to ``porcelain.archive()``, so an archive can be
  retrieved from a remote repository without dropping down to
  ``dulwich.client``. (Jelmer Vernooij)

* Read ``GIT_SSH_COMMAND``/``GIT_SSH`` in porcelain rather than only in the
  command line interface, so ``clone``, ``fetch``, ``ls_remote``, ``pull``
  and ``push`` honour them again when called as a library. Since 1.2.1 only
  the CLI resolved these, so ``porcelain.clone()`` silently ignored them. An
  explicit ``ssh_command`` argument still wins, and ``push`` and ``pull``
  gained an ``env`` argument. (Jelmer Vernooij)

* Recurse into subtrees when merging trees, so non-overlapping changes on
  different sides of a shared directory merge cleanly instead of being
  reported as a directory-level conflict. (Jelmer Vernooij)

* HARDEN: Verify that a ``.bitmap`` index matches the pack it is loaded for.
  The bitmap header records the checksum of its pack, but ``Pack.bitmap``
  never checked it, so a stale or swapped-in bitmap (built for a different
  object set) was used against this pack's index and silently produced a
  wrong reachable-object set during fetch negotiation. ``Pack.bitmap`` now
  compares the recorded checksum and ignores a mismatched bitmap, falling
  back to graph traversal, matching git's ``load_bitmap_header``.
  (netliomax25-code)

* HARDEN: Parse commit-message trailers in linear time. ``parse_trailers``
  located the trailer block by re-slicing and re-stripping the tail of the
  message for every blank line, which is cubic on a message made mostly of
  blank lines. Trailers are scanned during subtree operations, which walk
  every reachable commit, so a crafted commit message could tie up CPU for
  minutes to hours (a 3 KB all-blank message took roughly 36s before the fix
  and is now immediate). (netliomax25-code)

* SECURITY: Apply ``core.protectHFS`` and ``core.protectNTFS`` together when
  selecting the checkout path-element validator. ``get_path_element_validator``
  returned only the NTFS validator whenever ``protectNTFS`` was on (the default
  everywhere), so on macOS the HFS check never ran and an HFS+ spelling of
  ``.git`` using ignorable code points (e.g. ``.gi<U+200C>t``) passed
  validation and could poison ``.git`` on checkout. Both protections now apply
  when both are enabled, matching git's ``verify_path``.
  (netliomax25-code)

* HARDEN: Canonicalize the file mode of regular files written into a
  ``git archive`` tarball. ``tar_stream`` copied the tree-supplied mode
  verbatim, so a crafted tree entry (e.g. mode ``0o104755``) carried
  setuid/setgid/sticky bits into the archive and an extracted file could
  land setuid. Modes are now run through ``cleanup_mode`` like checkout,
  matching git's archive writer. (netliomax25-code)

* HARDEN: Collapse embedded whitespace in reflog messages when writing a
  reflog line. ``format_reflog_line`` wrote the message verbatim, and
  ``do_commit`` logs ``commit: <full message>``, so any commit whose message
  spans multiple lines produced a multi-line reflog that ``read_reflog``
  could not parse; a crafted message (e.g. from a rebased or cherry-picked
  untrusted commit) could inject additional, forged reflog entries with
  attacker-chosen SHAs. Newlines are now collapsed to spaces, matching git's
  ``copy_reflog_msg``.


To generate a diff of this commit:
cvs rdiff -u -r1.85 -r1.86 pkgsrc/devel/py-dulwich/Makefile
cvs rdiff -u -r1.80 -r1.81 pkgsrc/devel/py-dulwich/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/devel/py-dulwich/Makefile
diff -u pkgsrc/devel/py-dulwich/Makefile:1.85 pkgsrc/devel/py-dulwich/Makefile:1.86
--- pkgsrc/devel/py-dulwich/Makefile:1.85       Tue Jul  7 14:24:31 2026
+++ pkgsrc/devel/py-dulwich/Makefile    Fri Jul 17 06:42:31 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.85 2026/07/07 14:24:31 adam Exp $
+# $NetBSD: Makefile,v 1.86 2026/07/17 06:42:31 adam Exp $
 
-DISTNAME=      dulwich-1.2.10
+DISTNAME=      dulwich-1.2.11
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    devel python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=d/dulwich/}

Index: pkgsrc/devel/py-dulwich/distinfo
diff -u pkgsrc/devel/py-dulwich/distinfo:1.80 pkgsrc/devel/py-dulwich/distinfo:1.81
--- pkgsrc/devel/py-dulwich/distinfo:1.80       Tue Jul  7 14:24:31 2026
+++ pkgsrc/devel/py-dulwich/distinfo    Fri Jul 17 06:42:31 2026
@@ -1,11 +1,11 @@
-$NetBSD: distinfo,v 1.80 2026/07/07 14:24:31 adam Exp $
+$NetBSD: distinfo,v 1.81 2026/07/17 06:42:31 adam Exp $
 
 BLAKE2s (bstr-1.12.3.crate) = 147f1dc0e32ca9e25fc4eb8638b10a6a4683f890145057a982bf4ac718f30376
 SHA512 (bstr-1.12.3.crate) = 5093e7fc678c31684468d7b779a6f129db6b3d87fe7e05b86950ff1ee1afdf1bf6ae2586144667c8ee798de37f5fd089be0f7318401565484fbd7de07f7c0330
 Size (bstr-1.12.3.crate) = 355150 bytes
-BLAKE2s (dulwich-1.2.10.tar.gz) = 57f7e2eebc60b9a1c07573aa1d4d35b2b872bcdc07a33f98dbc1b53383bd196f
-SHA512 (dulwich-1.2.10.tar.gz) = cad8667471c2a97eb224c130a57cb6c6c2d8e5c77a290d4dcd3e0cb60d190e6932ffba848ee8945940b0a84c482aea87dd0c363bb7e83042e9e2364b169c3dc2
-Size (dulwich-1.2.10.tar.gz) = 1310282 bytes
+BLAKE2s (dulwich-1.2.11.tar.gz) = 8318cf3167b8db9320ce01ca83eb66723dcd5f8aeeaed78cb097940546905d3e
+SHA512 (dulwich-1.2.11.tar.gz) = a2e87b4ac5dd5917a151051e2aedcefbbf12d6be0e3d1a7faf3966137870aa41abffb82359a61825a3c55d64328c923fa8c1fc7d1b30e45581f10b4ada40bd5c
+Size (dulwich-1.2.11.tar.gz) = 1320432 bytes
 BLAKE2s (heck-0.5.0.crate) = 0bc71a5746c9d1e7c913d096fb68f1d422464744e18adc592540b291882f5660
 SHA512 (heck-0.5.0.crate) = f044fc9c3d22466629fd8f772ec0555350fd611c0cfadca51d99a3d2f10e155f77c1091916c8a95a6b9b499f366c2e99a5fbf45b010f988bfb9b2501bf9f6a76
 Size (heck-0.5.0.crate) = 11517 bytes