File libgit2.changes of Package libgit2.9827

Tue Dec 11 00:07:43 UTC 2018 -

- Add libgit2-boo1110949.patch: ignore path and URL if they look
  like options (boo#1110949 CVE-2018-19456)
- Add libgit2-boo1114729.patch: various string-to-integer and
  buffer handling fixes from v0.27.6 (boo#1114729).
- Fix libgit2-boo1100612-bounds-check.patch and
  libgit2-boo1100613-sign-fix.patch: tests needed to be backported.

Tue Aug 14 15:43:50 UTC 2018 -

- Add libgit2-boo1095219.patch: validate names of submodules;
  backport of the security fixes in v0.26.4 (boo#1095219
- Add libgit2-boo1100613-sign-fix.patch: fix sign extension of big
  left-shift (boo#1100613 CVE-2018-10887).
- Add libgit2-boo1100612-bounds-check.patch: fix out-of-bounds
  read of delta (boo#1100612 CVE-2018-10888).
- Add libgit2-delta-overflow-checks.patch: fix overflow when
  computing limit (boo#1100613 CVE-2018-10887).
- Add libgit2-boo1104641.patch: fix potential out-of-bounds read
  when processing a "ng" smart packet (boo#1104641 CVE-2018-15501).

Wed Mar 14 10:16:58 UTC 2018 -

- Add libgit2-read-entry-return-code.patch: Changed meaning of return
  code of read_entry() to indicate success and/or error status, which
  prevents denial of service attacks via different vectors by not
  being able to differentiate between these status codes.
  (CVE-2018-8099 bsc#1085256).

Mon Jan 30 18:36:16 UTC 2017 -

- Fix bsc#1019037 and bsc#1019036.
  Add libgit2-check-cert-validity.patch CVE-2016-10130
  Add libgit2-perform-badssl-check.patch CVE-2017-5338
  Add libgit2-verify-packet-length.patch CVE-2016-10128
  Add libgit2-empty-lines-as-errors.patch CVE-2016-10129
  Add libgit2-expected-error.patch and libgit2-dont-test-rc4.patch

Mon Nov 21 22:50:59 UTC 2016 -

- Add libgit2-init-commit-message.patch and
  libgit2-validate-name-length.patch. Fix bsc#1003810.
  CVE-2016-8568, CVE-2016-8569

Mon May  9 20:24:07 UTC 2016 -

- Add to the SDK. Fate#319349
- Update license to GPL-2.0 WITH GCC-exception-2.0

Wed Apr 20 17:24:54 UTC 2016 -

- libgit2 0.24.1:
  + various compatible backported bug fixes

Wed Mar 16 17:27:05 UTC 2016 -

- Update to version 0.24.0:
  + Custom filters can now be registered with wildcard attributes,
    for example filter=*. Consumers should examine the attributes
    parameter of the check function for details.
  + Symlinks are now followed when locking a file, which can be
    necessary when multiple worktrees share a base repository.
  + You can now set your own user-agent to be sent for HTTP
    requests by using the GIT_OPT_SET_USER_AGENT with
  + You can set custom HTTP header fields to be sent along with
    requests by passing them in the fetch and push options.
  + Tree objects are now assumed to be sorted. If a tree is not
    correctly formed, it will give bad results. This is the git
    approach and cuts a significant amount of time when reading the
  + Filter registration is now protected against concurrent
  + Filenames which are not valid on Windows in an index no longer
    cause to fail to parse it on that OS.
  + Rebases can now be performed purely in-memory, without touching
    the repository's workdir.
  + When adding objects to the index, or when creating new tree or
    commit objects, the inputs are validated to ensure that the
    dependent objects exist and are of the correct type. This
    object validation can be disabled with the
  + The WinHTTP transport's handling of bad credentials now behaves
    like the others, asking for credentials again.
  + Various API changes (additions AND removals).
- Rename libgit2-23 subpackage to libgit2-24, following upstraems
  soname bump (also in baselibs.conf).

Mon Nov 30 10:46:23 UTC 2015 -

- libgit2 0.23.4:
  * various bug fixes and improvements
- drop upstreamed libgit2-fix-.pc-file.patch

Wed Oct  7 09:29:34 UTC 2015 -

- libgit2 0.23.3, containing critical fixes:
  * blame: guard xdiff calls for large files
  * diff: don't feed large files to xdiff
  * merge_file: treat large files as binary
  * xdiff: convert size variables to size_t
  * GITERR_CHECK_ALLOC_ADDn: multi-arg adders

Thu Sep 10 14:04:07 UTC 2015 -

- Add libgit2-fix-.pc-file.patch: Fix paths written in libgit2.pc.

Mon Sep  7 19:55:45 UTC 2015 -

- libgit2 0.23.2:
  * documentation fixes
  * diff: don't error out on an invalid regex
  * http: propagate the credentials callback's error code
  * Fix bug in git_smart__push: push_transfer_progress cb is never called
  * remote: don't confuse tag auto-follow rules with refspec matching
  * curl: use the most secure auth method for the proxy
  * Forcing libssh2 lib location
  * fix duplicate basenames to support older VS
- includes changes from 0.23.1:
  * Stage an unregistered submodule in _add_bypath()
  * filebuf: remove lockfile upon rename errors
  * Increase required version of cmake to 2.8
  * Handle ssh:// and git:// urls containing a '~' character.
  * documentation updates
  * submodule URL handling fixes
  * index: allow add_bypath to update submodules
  * blob: fail to create a blob from a dir with EDIRECTORY
  * submodule: lookup the submodule by path if available
  * submdule: reproduce double-reporting of a submodule in foreach
- note cmake requirement and use cmake makros
- build with system libcurl
- build with system http-parser

Tue Jul 28 12:34:52 UTC 2015 -

- Update to version 0.23.0:
  + Changes or improvements:
    - Patience and minimal diff drivers can now be used for merges.
    - Merges can now ignore whitespace changes.
    - Updated binary identification in CRLF filtering to avoid
      false positives in UTF-8 files.
    - Rename and copy detection is enabled for small files.
    - Checkout can now handle an initial checkout of a repository,
      making GIT_CHECKOUT_SAFE_CREATE unnecessary for users of
    - The signature parameter in the ref-modifying functions has
      been removed. Use git_repository_set_ident() and
      git_repository_ident() to override the signature to be used.
    - The local transport now auto-scales the number of threads to
      use when creating the packfile instead of sticking to one.
    - Reference renaming now uses the right id for the old value.
    - The annotated version of branch creation, HEAD detaching and
      reset allow for specifying the expression from the user to be
      put into the reflog.
    - git_rebase_commit now returns GIT_EUNMERGED when you attempt
      to commit with unstaged changes.
    - On Mac OS X, we now use SecureTransport to provide the
      cryptographic support for HTTPS connections insead of
    - Checkout can now accept an index for the baseline
      computations via the baseline_index member.
    - The configuration for fetching is no longer stored inside the
      git_remote struct but has been moved to a git_fetch_options.
      The remote functions now take these options or the callbacks
      instead of setting them beforehand.
    - git_submodule instances are no longer cached or shared across
      lookup. Each submodule represents the configuration at the
      time of loading.
    - The index now uses diffs for add_all() and update_all() which
      gives it a speed boost and closer semantics to git.
    - The ssh transport now reports the stderr output from the
      server as the error message, which allows you to get the
      "repository not found" messages.
    - git_index_conflict_add() will remove staged entries that
      exist for conflicted paths.
    - The flags for a git_diff_file will now have the
      GIT_DIFF_FLAG_EXISTS bit set when a file exists on that side
      of the diff. This is useful for understanding whether a side
      of the diff exists in the presence of a conflict.
    - The constructor for a write-stream into the odb now takes
      git_off_t instead of size_t for the size of the blob, which
      allows putting large files into the odb on 32-bit systems.
    - The remote's push and pull URLs now honor the
      url.$URL.insteadOf configuration. This allows modifying URL
      prefixes to a custom value via gitconfig.
    - git_diff_foreach, git_diff_blobs, git_diff_blob_to_buffer,
      and git_diff_buffers now accept a new binary callback of type
      git_diff_binary_cb that includes the binary diff information.
    - The race condition mitigations described in racy-git.txt have
      been implemented.
    - If libcurl is installed, we will use it to connect to HTTP(S)
  + Various API changes (incl. breaking changes).
- Rename libgit2-22 subpackage to libgit2-23, following upstreams
  soname bump (also in baselibs.conf).

Tue Jan 27 20:40:51 UTC 2015 -

- Update to version 0.22.1:
  + The following (critical) fixes have been backported to this
    maintenance release:
    - checkout: introduce git_checkout_perfdata.
    - git_path_join_unrooted: return base len.
    - checkout: don't recreate previous directory.
    - checkout tests: nasty symlinks.
    - checkout: drop newline in error message.
    - checkout: remove files before writing new ones.
    - checkout tests: emulate p_realpath poorly on Win32.
    - checkout tests: cleanup realpath impl on Win32.
- Changes from version 0.22.0:
  + git_signature_new() now requires a non-empty email address.
  + Use CommonCrypto libraries for SHA-1 calculation on Mac OS X.
  + Disable SSL compression and SSLv2 and SSLv3 ciphers in favor of
    TLSv1 in OpenSSL.
  + The fetch behavior of remotes with autotag set to
    GIT_REMOTE_DOWNLOAD_TAGS_ALL has been changed to match git
    1.9.0 and later. In this mode, libgit2 now fetches all tags in
    addition to whatever else needs to be fetched.
  + git_checkout() now handles case-changing renames correctly on
    case-insensitive filesystems; for example renaming "readme" to
  + The search for libssh2 is now done via pkg-config instead of a
    custom search of a few directories.
  + Add support for core.protectHFS and core.protectNTFS. Add more
    validation for filenames which we write such as references.
  + The local transport now generates textual progress output like
    git-upload-pack does ("counting objects").
  + git_checkout_index() can now check out an in-memory index that
    is not necessarily the repository's index, so you may check out
    an index that was produced by git_merge and friends while
    retaining the cached information.
  + Remove the default timeout for receiving / sending data over
    HTTP using the WinHTTP transport layer.
  + Add SPNEGO (Kerberos) authentication using GSSAPI on Unix
  + Provide built-in objects for the empty blob (e69de29) and empty
    tree (4b825dc) objects.
  + The index' tree cache is now filled upon read-tree and
    write-tree and the cache is written to disk.
  + LF -> CRLF filter refuses to handle mixed-EOL files.
  + LF -> CRLF filter now runs when * text = auto (with Git for
    Windows 1.9.4).
  + File unlocks are atomic again via rename. Read-only files on
    Windows are made read-write if necessary.
  + Share open packfiles across repositories to share descriptors
    and mmaps.
  + Use a map for the treebuilder, making insertion O(1).
  + The build system now accepts an option EMBED_SSH_PATH which
    when set tells it to include a copy of libssh2 at the given
    location. This is enabled for MSVC.
  + Add support for refspecs with the asterisk in the middle of a
  + Fetching now performs opportunistic updates. To achieve this,
    we introduce a difference between active and passive refspecs,
    which make git_remote_download() and git_remote_fetch() to take
    a list of resfpecs to be the active list, similarly to how git
    fetch accepts a list on the command-line.
  + The THREADSAFE option to build libgit2 with threading support
    has been flipped to be on by default.
  + The remote object has learnt to prune remote-tracking branches.
    If the remote is configured to do so, this will happen via
    git_remote_fetch(). You can also call git_remote_prune() after
    connecting or fetching to perform the prune.
- Rename libgit2-21 subpackage to libgit2-22, following upstreams
  soname bump (also in baselibs.conf).

Thu Oct 16 19:21:01 UTC 2014 -

- Add baselibs.conf

Thu Jul 10 21:37:25 UTC 2014 -

- Update to version 0.21.1:
  + Added a new config snapshotting API to fix race issues when
    different applications (e.g. Git and a libgit2 client) access
    the same repository simultaneously.
  + Added reflog support to all APIs that could alter a reference.
  + Avoided race conditions when updating references.
  + Converted all APIs that output string data to use git_buf
    objects for the return value.
  + Added standard git_<object>_init_options functions to
    initialize options structures when static initialization is not
    possible, and renamed options structures to standard
    git_<object>_options (replacing _opts suffix used in some
  + Improved use of const on pointers in many APIs (which may
    affect some bindings).
  + Replaced use of oid with simply id for references to
    git_oid value.s
  + Previously, when a callback function returned an error value
    (i.e. non-zero), libgit2 converted it to GIT_EUSER for the
    parent function's return value. Now, libgit2 tries to pass
    through the callback's return value all the way back to the
  + All inline functions were eliminated from the public libgit2
  + Removed all Apache licensed code from library.
  + For more changes, please see detailed ChangeLog in package.
- Rename libgit2-0 subpackage to libgit2-21, following upstreams
  soname change (another project believing the soname should match
  the version).
- Enable SSH Support:
  + Add pkgconfig(libssh2) BuildRequires.
  + Pass -DUSE_SSH:BOOL=ON to cmake call in order to enable SSH

Mon Jan  6 22:36:54 UTC 2014 -

- Build libgit2 threadsafe:
  + Pass -DTHREADSAFE:BOOL=ON to cmake call.

Mon Nov 25 21:00:42 UTC 2013 -

- Update to version 0.20.0:
  + Blame APIs.
  + Filter APIs.
  + Public git_buffer APIs.
  + Merge conflict support in Checkout.
  + Simplified Clone options and git_clone_into.
  + Config iterator APIs and updated Config multivar API.
  + Diff API reorganization and renaming, with Patch API split off.
  + Indexer API renaming and improvements.
  + ODB backend API cleanup.
  + Improves progress callbacks for Packbuilder, Push, Fetch (and
    any other Remote operation).
  + Public Pathspec matching APIs.
  + Reflog API and RefDB Backend API cleanup.
  + Remote API extensions.
  + SSH Transport configuration cleanup.
  + Submodule status improvements.
  + Pluggable Transport APIs.
  + Lots of other small features (e.g. decomposed unicode support on
    MacOS, revwalk simplifying by first parent),
  + Bug fixes (e.g. junction support on Win32, redirect handling
    in HTTP transport) and performance improvements.
  + Lots of new examples (init, status, log, blame, etc.) and
    relicensing of example code under CC0 license.

Mon Jul  8 19:40:57 UTC 2013 -

- Update to version 0.19.0:
  + New (threadsafe) cache for objects.
  + Iterator for Status.
  + New Merge APIs.
  + SSH support on *NIX.
  + Function context on diff.
  + Namespaces support.
  + Index add/update/remove with wildcard support.
  + Iterator for References.
  + Fetch and push refspecs for Remotes.
  + Rename support in Status.
  + New 'sys/` namespace for external headers with low-level APIs.

Sun Jun 23 20:58:21 UTC 2013 -

- Update to version 0.18:
  + Almost one year worth of bug fixing... yet, upstream does not
    publish a statement / announcement of what is actually new...

Fri Aug 31 13:27:15 UTC 2012 -

- Update to 0.17
        - Added function macros to check attribute values instead of having
        to manually compare them
        - Added support for choosing the attribute loading order (workdir files
        vs index) and to skip the systems' default `.gitattributes`
        - Fixed issues when fetching attribute data on bare repositories

        - Added support for creating blobs from any file on disk (not
        restricted to the repository's working directory)
        - Aded support for smudge filters when writing blobs to the ODB
                - So far only CRLF normalization is available
        - Added a high-level branch API:
                - git_branch_create
                - git_branch_delete
                - git_branch_list
                - git_branch_move
        - Commit messages are now filtered to match Git rules (stripping
        comments and adding proper whitespacing rules)
        - Added support for setting and getting multivars
        - Added `git_config_get_mapped` to map the value of a config
        variable based on its defaults
        - Added full diff API:
                - tree to tree
                - index to tree
                - workdir to index
                - workdir to tree
                - blob to blob
        - Added helper functions to print the diffs as valid patchfiles
    Error handling:
        - New design for the error handling API, taking into consideration
        the requirements of dynamic languages
        - Added streaming packfile indexer
        - Added support for finding the merge base between two commits
        - Full git-notes support:
                - git_note_read
                - git_note_message/git_note_oid
                - git_note_create
                - git_note_remove
                - git_note_free
                - git_note_foreach
        - Added `git_reference_name_to_oid` helper to resolve
        a reference to its final OID
        - Added `git_reference_cmp` to compare two references with
        a stable order
        - Added support for writing and saving remotes
                - `git_remote_add`
                - `git_remote_save`
                - Setters for all the attributes of a remote
        - Switched remote download to the new streaming packfile indexer
        - Fixed fetch on HTTP and Git under Windows
        - Added `git_remote_supported_url` helper to check if a protocol
        can be accessed by the library
        - Added `git_remote_list`
        - Made `git_repository_open` smarter when finding the `.git` folder.
        - Added `git_repository_open_ext` with extra options when
        opening a repository
        - Added support for pushing/hiding several references through a glob
        - Added helper to push/hide the current HEAD to the walker
        - Added helper to push/hide a single reference to the walker
        - Greatly improved Status implementation using the new `diff` code
        as a backend
        - Added a partial submodules API to get information about a
        submodule and list all the submodules in a repository
                - git_submodule_foreach
                - git_submodule_lookup
        - Added `git_tag_peel` helper to peel a tag to its pointed object
        - Tag messages are now filtered to match Git rules (stripping comments
        and adding proper whitespacing rules)
        - Killed the old `git_tree_diff` API, which is replaced by the
        new diff code.

Mon May  7 10:15:10 UTC 2012 -

- Fix license to be GPL-2.0-with-GCC-exception 

Mon Apr 16 10:22:50 UTC 2012 -

- Update to 0.16.0
  - Git Attributes support (see git2/attr.h)
      There is now support to efficiently parse and retrieve information
      from `.gitattribute` files in a repository. Note that this
      information is not yet used e.g. when checking out files.

  - .gitignore support
      Likewise, all the operations that are affected by `.gitignore` files
      now take into account the global, user and local ignores when
      skipping the relevant files.

  - Cleanup of the object ownership semantics
      The ownership semantics for all repository subparts (index, odb,
      config files, etc) has been redesigned. All these objects are now
      reference counted, and can be hot-swapped in the middle of
      execution, allowing for instance to add a working directory and an
      index to a repository that was previously opened as bare, or to
      change the source of the ODB objects after initialization.

      Consequently, the repository API has been simplified to remove all
      the `_openX` calls that allowed setting these subparts *before*

  - git_index_read_tree()
      Git trees can now be read into the index.

  - More reflog functionality
      The reference log has been optimized, and new API calls to rename
      and delete the logs for a reference have been added.

  - Rewrite of the References code with explicit ownership semantics
      The references code has been mostly rewritten to take into account
      the cases where another Git application was modifying a repository's
      references while the Library was running.

      References are now explicitly loaded and free'd by the user, and
      they may be reloaded in the middle of execution if the user suspects
      that their values may have changed on disk. Despite the new
      ownership semantics, the references API stays the same.

  - Simplified the Remotes API
      Some of the more complex Remote calls have been refactored into
      higher level ones, to facilitate the usual `fetch` workflow of a

  - Greatly improved thread-safety
      The library no longer has race conditions when loading objects from
      the same ODB and different threads at the same time. There's now
      full TLS support, even for error codes. When the library is built
      with `THREADSAFE=1`, the threading support must be globally
      initialized before it can be used (see `git_threads_init()`)

  - Tree walking API
      A new API can recursively traverse trees and subtrees issuing callbacks for
      every single entry.

  - Tree diff API
      There is basic support for diff'ing an index against two trees.

Tue Jan 31 17:12:58 UTC 2012 -

- Provide pkgconfig symbols

Thu Oct 27 19:58:14 UTC 2011 -

- Change license to 'GPL-2.0 with linking', fixes bnc#726789

Wed Oct 26 22:14:56 UTC 2011 -

- Update to version 0.15.0:
  * Upstream doesn't provide changes
- Removed outdated %clean section

Tue Jan 18 20:53:29 UTC 2011 -

- Proper Requires for devel package

Tue Jan 18 20:32:36 UTC 2011 -

- Set BuildRequires to "openssl-devel" also for RHEL and CentOS

Tue Jan 18 20:25:33 UTC 2011 -

- Initial commit (0.0.1)
- Added patch to fix shared library soname
openSUSE Build Service is sponsored by