| Age | Commit message (Collapse) | Author |
|---|
|
|
|
|
|
[ci skip]
|
|
|
|
|
|
[ci skip]
|
|
|
|
'15-10-stable'
Makefile: Upgrade Git to security release v2.40.1.gl2 and v2.39.3.gl1
See merge request https://gitlab.com/gitlab-org/security/gitaly/-/merge_requests/85
Merged-by: Steve Abrams <sabrams@gitlab.com>
Approved-by: Patrick Steinhardt <psteinhardt@gitlab.com>
Approved-by: Ameya Darshan <adarshan@gitlab.com>
Co-authored-by: Christian Couder <christian.couder@gmail.com>
|
|
It was decided on the git-security mailing list to release the "merge-tree:
load default git config" patch on the regular Git mailing list (which is
visible and open to everyone) as this is a security patch that most likely
affects only forges like GitLab, GitHub, etc, and not end users.
So the patch is not part of a Git security release and there is no specific
tag or branch for it, but despite this we need to handle it as an important
security fix that shouldn't be publicly disclosed before it is disclosed on
the main Git mailing list.
The date the patch will be disclosed on the Git mailing list has not yet been
decided, but it might be in the next few weeks.
Information about the patch is below.
```
merge-tree: load default git config
From 1f11b8550a22a0581b04dcd93654147af3ffe7ed Mon Sep 17 00:00:00 2001
From: Derrick Stolee <derrickstolee@github.com>
Date: Tue, 18 Apr 2023 14:30:57 -0400
Subject: [PATCH v2] merge-tree: load default git config
The 'git merge-tree' command handles creating root trees for merges
without using the worktree. This is a critical operation in many Git
hosts, as they typically store bare repositories.
This builtin does not load the default Git config, which can have
several important ramifications.
In particular, one config that is loaded by default is
core.useReplaceRefs. This is typically disabled in Git hosts due to
the ability to spoof commits in strange ways.
Since this config is not loaded specifically during merge-tree, users
were previously able to use refs/replace/ references to make pull
requests that looked valid but introduced malicious content. The
resulting merge commit would have the correct commit history, but the
malicious content would exist in the root tree of the merge.
The fix is simple: load the default Git config in cmd_merge_tree().
This may also fix other behaviors that are effected by reading default
config. The only possible downside is a little extra computation time
spent reading config. The config parsing is placed after basic argument
parsing so it does not slow down usage errors.
Helped-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Derrick Stolee <derrickstolee@github.com>
```
See the following MRs that merged that patch in our security Git repo:
- https://gitlab.com/gitlab-org/security/git/-/merge_requests/18
- https://gitlab.com/gitlab-org/security/git/-/merge_requests/19
- https://gitlab.com/gitlab-org/security/git/-/merge_requests/20
Changelog: security
|
|
|
|
[ci skip]
|
|
[ci skip]
|
|
|
|
[ci skip]
|
|
[ci skip]
|
|
[ci skip]
|
|
[ci skip]
|
|
[ci skip]
|
|
[ci skip]
|
|
[ci skip]
|
|
[ci skip]
|
|
|
|
[ci skip]
|
|
[ci skip]
|
|
[ci skip]
|
|
[ci skip]
|
|
[ci skip]
|
|
gitaly: Do not start gitaly-ruby
See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5497
Merged-by: Justin Tobler <jtobler@gitlab.com>
Approved-by: Will Chandler <wchandler@gitlab.com>
Approved-by: Justin Tobler <jtobler@gitlab.com>
Co-authored-by: Toon Claes <toon@gitlab.com>
|
|
git/stats: Fix flaky timings in HTTP push tests
See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5524
Merged-by: Justin Tobler <jtobler@gitlab.com>
Approved-by: Justin Tobler <jtobler@gitlab.com>
Co-authored-by: Patrick Steinhardt <psteinhardt@gitlab.com>
|
|
featureflag: Default `tx_restore_custom_hooks` on
See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5522
Merged-by: Patrick Steinhardt <psteinhardt@gitlab.com>
Approved-by: Patrick Steinhardt <psteinhardt@gitlab.com>
Co-authored-by: Justin Tobler <jtobler@gitlab.com>
|
|
Part of what the HTTP push statistics provide is the information at
which time we have entered specific sections. As these timings naturally
fluctuate, the test for this only asserts that we have strict ordering
of these times. This is flaky though:
=== FAIL: internal/git/stats TestPerformHTTPPush/branch_deletion (0.40s)
http_push_test.go:190:
Error Trace: /builds/gitlab-org/gitaly/internal/git/stats/http_push_test.go:190
Error: Should be true
Test: TestPerformHTTPPush/branch_deletion
Messages: expected to receive "response-body" packet before before "2023-03-16 14:00:22.746688075 +0000 UTC m=+5.430460188", but received at "2023-03-16 14:00:22.746688075 +0000 UTC m=+5.430460188"
The issue here is that it can happen that two packages are seemingly
received at the exact same time, but because we require times to be
strictly increasing the assertion fails.
Fix this flake by using `require.GreaterOrEqual()` instead.
|
|
catfile: Add encoding information to GitCommit
Closes #836
See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5506
Merged-by: Will Chandler <wchandler@gitlab.com>
Approved-by: Will Chandler <wchandler@gitlab.com>
Reviewed-by: Patrick Steinhardt <psteinhardt@gitlab.com>
Co-authored-by: arkn98 <2424696-arkn98@users.noreply.gitlab.com>
|
|
docs: Document Gitaly major module version
See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5493
Merged-by: John Cai <jcai@gitlab.com>
Approved-by: Evan Read <eread@gitlab.com>
Reviewed-by: Evan Read <eread@gitlab.com>
|
|
We don't need gitaly-ruby no more, so no longer start it when Gitaly is
launched.
Epic: https://gitlab.com/groups/gitlab-org/-/epics/7874
|
|
tools/goimports: Update module golang.org/x/tools to v0.6.0
See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5377
Merged-by: John Cai <jcai@gitlab.com>
Approved-by: Sami Hiltunen <shiltunen@gitlab.com>
Approved-by: John Cai <jcai@gitlab.com>
Co-authored-by: GitLab Renovate Bot <gitlab-bot@gitlab.com>
|
|
tools/golangci-lint: Update module golang.org/x/tools to v0.7.0
See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5504
Merged-by: John Cai <jcai@gitlab.com>
Approved-by: Justin Tobler <jtobler@gitlab.com>
Approved-by: John Cai <jcai@gitlab.com>
Co-authored-by: GitLab Renovate Bot <gitlab-bot@gitlab.com>
|
|
Transactionality is being added to the `SetCustomHooks` RPC via the
`tx_restore_custom_hooks` feature flag. This RPC will be invoked with a
CLI client by GitLab administrators to set custom hooks for a
repository. Since this CLI originates the RPC invocations, feature flag
values are not propagated through the RPC context. This change default
enables the feature flag so tranactions can be enabled for the
`set-hooks` CLI.
|
|
Enable Gitaly custom linters
See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5500
Merged-by: Quang-Minh Nguyen <qmnguyen@gitlab.com>
Approved-by: karthik nayak <knayak@gitlab.com>
|
|
Makefile: Treat `PROTO_DEST_DIR` as 'new' in diff
See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5515
Merged-by: karthik nayak <knayak@gitlab.com>
Approved-by: karthik nayak <knayak@gitlab.com>
Co-authored-by: Will Chandler <wchandler@gitlab.com>
|
|
featureflag: Remove unused FetchSourceBranchQuarantined flag
See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5518
Merged-by: karthik nayak <knayak@gitlab.com>
Approved-by: karthik nayak <knayak@gitlab.com>
Co-authored-by: Patrick Steinhardt <psteinhardt@gitlab.com>
|
|
Even though usage of the FetchSourceBranchQuarantined flag was removed
in 5992d3b5c (featureflag: Remove `FetchSourceBranchQuarantined`,
2023-01-16), the feature flag itself was seemingly forgotten. Remove it.
|
|
Currently, Gitaly doesn't return the `encoding` header, which is
populated by `git cat-file` when the commit message was encoded using a
non-UTF-8 encoding and the `i18n.commitEncoding` was set to that
encoding when the commit was made. This can cause clients to show
corrupted commit messages, as seen in [1]. This commit adds the
`encoding` field to the `GitCommit` proto.
1. https://gitlab.com/gitlab-org/gitlab/-/issues/20058
Fixes: https://gitlab.com/gitlab-org/gitaly/-/issues/836
Changelog: added
Signed-off-by: arkn98 <2424696-arkn98@users.noreply.gitlab.com>
|
|
go: Update module google.golang.org/protobuf to v1.29.0
See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5513
Merged-by: Toon Claes <toon@gitlab.com>
Approved-by: Toon Claes <toon@gitlab.com>
Approved-by: Justin Tobler <jtobler@gitlab.com>
Co-authored-by: GitLab Renovate Bot <gitlab-bot@gitlab.com>
|
|
go: Update module golang.org/x/sys to v0.6.0
See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5482
Merged-by: Toon Claes <toon@gitlab.com>
Approved-by: Toon Claes <toon@gitlab.com>
Approved-by: James Fargher <proglottis@gmail.com>
Co-authored-by: GitLab Renovate Bot <gitlab-bot@gitlab.com>
|
|
Implement Git trace2 integration
See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5464
Merged-by: Toon Claes <toon@gitlab.com>
Approved-by: Toon Claes <toon@gitlab.com>
Reviewed-by: Toon Claes <toon@gitlab.com>
Reviewed-by: Patrick Steinhardt <psteinhardt@gitlab.com>
Reviewed-by: Quang-Minh Nguyen <qmnguyen@gitlab.com>
Co-authored-by: Quang-Minh Nguyen <qmnguyen@gitlab.com>
|
|
|
|
|
|
We encourage wrapping error with %w when constructing a new error. The
new error contains the original error so that it is able to be unwrapped
later. This commit converts all error wrapping to %w.
|
|
This commit fixes manually quoted string interpolation with '%s' and
"%s". Quoting this way doesn't escape special characters such as endline
and makes debugging harder later. We encourage to use %q verb instead.
|
|
For the `no-proto-changes` Makefile target we diff the newly generated
protobufs in `${PROTO_DEST_DIR}` against the in-tree files located in
`proto/go`.
By placing `${PROTO_DEST_DIR}` as the first argument the diff will show
it as the 'old' value, which is unintuitive as it's much more likely to
have been changed. Swap the order so new files are treated as new.
|
