A new document, gitsecurityboundary(7), has been added to clarify
the security boundaries Git guarantees and the responsibilities of
the user, aiming to provide a clear reference for what constitutes a
security vulnerability in Git.
* tc/security-boundary-doc:
Documentation: clarify Git's security boundary
The test environment setup in the CI scripts has been consolidated and
deduplicated to remove redundancies and simplify test flag management.
* ps/ci-consolidate-test-variables:
ci: don't override initial branch name in testbed job
ci/lib: add another NO_RUST build using glibc
t: honor default ref storage format
ci/lib: merge switches for specific job names
ci/lib: deduplicate test variables by pattern matching
ci/lib: always set GIT_TEST_USE_SET_E on Linux jobs
ci: consolidate setup of test environment
The code in 'git pack-objects' used to truncate object sizes on
platforms where 'long' is 32-bit but 'size_t' is larger (like 64-bit
Windows) when handling large objects exceeding 4GiB, which has been
corrected by using 'size_t' and 'off_t' appropriately.
* ep/pack-objects-streamed-large-blobs:
pack-objects: use size_t for streamed large blobs
The 'simple' push resolution in 'git rev-parse @{push}' has been
updated to mirror the behavior of 'git push'. When the configured push
remote differs from the fetch remote, it now resolves to the branch of
the same name on the push remote instead of failing.
* hn/remote-simple-push-triangular:
remote: resolve "simple" @{push} when pushing to another remote
remote: move "simple" @{push} resolution into a helper
Tests in 't5702' that grep the output of 'env' to check for the
'GIT_PROTOCOL' environment variable have been updated to explicitly
echo the variable instead, making them resilient to quoting changes
introduced in newer GNU coreutils.
* jk/test-env-quoting-fix:
t5702: be more resilient to env quoting
The 'range-diff' command has been updated to use the repository
context pointer from 'diff_options' instead of relying on the global
'the_repository' and 'the_hash_algo' variables, as part of the
libification effort.
* oa/range-diff-repo:
range-diff: use diffopt->repo instead of the_repository
The configuration parsing in the 'merge-ort' backend has been updated
to accept valueless settings for 'diff.renames', 'merge.renames', and
'merge.directoryRenames', which are now properly treated as true.
* tb/merge-ort-valueless-rename-config:
merge-ort: accept rename settings given without a value
The obsolete 'gittutorial-2' documentation and all references to it
have been removed from the documentation tree and 'command-list.txt'.
* je/doc-remove-gittutorial-2:
doc: remove references to gittutorial-2
doc: remove gittutorial-2
A test script 't7104' has been modernized to use 'test_path_is_file'
instead of 'test -f'.
* tk/t7104-test-path-is-file:
t7104: use test_path_is_file instead of test -f
The coding guidelines have been updated to officially allow the use
of C99 compound literals, as the test balloon has been flying
without issues since late 2024.
* pw/allow-compound-literals:
CodingGuidelines: allow compound literals
The error message given when pathname is too long has been updated
to use the pluralized translation function, Q_().
* kf/archive-zip-msg-i18n:
archive-zip: refactor 'path too long' error message to use Q_()
The CI workflow has been updated to pin GitHub Actions to their full
commit IDs rather than version tags, which secures the CI
environment against potential supply-chain attacks.
* tb/ci-pin-actions:
ci: pin actions in the main workflow to full commit IDs
The unused 'USE_THE_REPOSITORY_VARIABLE' macro has been removed from
'diffcore-break.c'.
* oa/diffcore-break-remove-use-the-repository-variable:
diffcore-break: remove USE_THE_REPOSITORY_VARIABLE
The 'unit-test' runner has been taught to safely ignore the
'--long-tests' ('-l') option, preventing it from failing when the
same compatibility arguments are passed to both unit and
integration tests. The list of ignored arguments has also been
sorted.
* ks/unit-tests-ignore-long-tests:
unit-tests: ignore --long-tests
unit-tests: reshuffle NOOP arguments to maintain order
A new user manual page on how to resolve merge conflicts has been
introduced, and other commands that could encounter conflicts have
been updated to link to it.
* je/doc-merge-conflicts:
doc: git-pull: link to new merge conflicts guide
doc: git-cherry-pick: link to new merge conflicts guide
doc: git-revert: link to new merge conflicts guide
doc: git-rebase: link to new merge conflicts guide
doc: git-merge: link to new merge conflicts guide
doc: add new gitmergeconflicts man page
A test in 't1450-fsck.sh' failed on older macOS when overwriting a
read-only loose object, which has been corrected by using 'mv -f'.
* tb/t1450-use-mv-f:
t1450: use 'mv -f' when overwriting a read-only file
The global state 'the_repository' in 'diffcore-rename.c' has been
removed by utilizing the repository pointer available within the
'diff_options' context structure.
* oa/diffcore-rename-no-the-repository:
diffcore-rename: stop using the_repository
The --dry-run option of git reflog expire has been corrected to
report "would prune" instead of "prune" when refs are named on the
command line, bringing it in line with the behavior of the --all
option.
* lb/reflog-expire-dry-run-fix:
builtin/reflog: say "would prune" for named refs with --dry-run
The command-line completion for 'git stash' has been updated to
dynamically discover subcommands and to correct a Zsh-specific
formatting issue where stash references were improperly unquoted.
Additionally, the deprecated 'save' subcommand has been removed from
completions and synopsis documentation.
* dk/stash-completion-updates:
completion: drop "stash save" completion altogether
doc: drop usage mentions of "git stash save"
completion: fix Zsh handling of stash names
Completion: extract common stash listing code
completion: simplify stash subcommand completion
Various functions and data structures that no longer need to be
globally visible, such as those exposed for the now-removed
'recursive' merge strategy, have been made file-scope static or
removed entirely to shrink the public API surface.
* jc/mark-static:
unpack-trees: hide verify_uptodate()
read-cache: hide refresh_cache_entry()
add -i: hide init/clear_add_i_state() functions
ident: remove unused author_ident_sufficiently_given()
Various cleanups in the 'commit-graph' builtin command, removing
global state and updating to not rely on the implicit
'the_repository' variable, in preparation for making the
commit-graph subsystem pluggable.
* ps/commit-graph-cleanups:
builtin/commit-graph: de-globalize options handling
builtin/commit-graph: de-globalize write options handling
builtin/commit-graph: simplify how we wire up common options
builtin/commit-graph: drop global "--object-dir=" switch
builtin/commit-graph: get rid of `the_repository`
builtin/commit-graph: drop declaration for `read_replace_refs`
builtin/commit-graph: rename subcommand functions
The 't1467-refs-rename.sh' test script has been updated to use the
'test_must_fail' helper instead of the '!' operator when checking for
expected command failures, ensuring that crashes are not silently
ignored.
* hk/test-t1467-refs-rename:
t/t1467: use test_must_fail in place of NOT operator
The beginner's tutorial in 'gittutorial.adoc' has been rewritten to
focus on a minimal set of commands needed to create a repository,
make commits, and push to a remote host, optimizing for a quick
one-hour learning experience.
* je/doc-new-git-tutorial:
doc: add new Git tutorial for beginners
doc: remove gittutorial
The object database files backend has been updated to reload
alternates when an object lookup fails on retry. This restores a lost
capability to find objects moved to a newly added alternate during a
concurrent repository rewrite, with caching and deduplication
optimizations to avoid performance regressions.
* ps/odb-reload-alternates:
odb/source-files: only reload alternates when the file has changed
odb/source-files: avoid stat'ing already-known alternates
odb/source-files: simplify directory duplication detection
odb/source-files: reload alternates on retry
odb/source-files: always load alternates via primary object directory
odb/source-files: rename alternates-related functions
The prune_packed_objects() API and its callbacks have been updated to
take a 'struct repository' pointer instead of relying on the global
'the_repository' variable, moving the subsystem closer to being fully
libified.
* sm/prune-packed-libification:
prune-packed: remove USE_THE_REPOSITORY_VARIABLE
The output from 'git init' has been corrected to display the
absolute path of the created repository, addressing a recent
regression.
* mh/init-show-abspath:
init: show absolute path of (re)initialized repository
The test script 't0081-find-pack.sh' has been updated to use the
'test_path_is_file' helper instead of the raw 'test -f' command.
* ss/t0081-test-path-is-file:
t0081: modernize the code testing whether a file exists
The advice subsystem has been updated to suggest using the
'--global' option when recommending a command snippet to squelch
future advice messages, since global configuration is generally
more appropriate for user-level preferences than per-repository
settings.
* jc/advice-config-set-global:
advice: give cut-and-pasteable advice to squelch
The documentation on contributing has been updated to emphasize the
importance of discussing review feedback before sending the next
iteration, and the section on sending an updated version has been
moved to appear after the discussion of the review process.
* jc/myfirstcontribution-discuss-then-reroll:
MyFirstContribution: clarify that "reviewing" is a discussion
MyFirstContribution: move "how to send v2" after discussing reviews
64b1abe962 (merge-recursive: fix overwriting dirty files involved in
renames, 2018-04-19) made this function available to external callers.
With the removal of the "recursive" strategy in ad45b327c0
(merge-recursive.[ch]: thoroughly debug these, 2025-04-08), the last
external caller of this function want away.
Make it file-scope static again.
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Once upon a time, there was a merge strategy called "recursive",
which was added in 6d297f8137 (Status update on merge-recursive in
C, 2006-07-08). This implementation came with its own machinery
that creates an in-core index entry, and then refreshed the index
entry it created by calling the refresh_cache_entry() function
borrowed from the read-cache.c API. refresh_cache_entry() used to
be file-scope static, but was made public with this change.
When ad45b327c0 (merge-recursive.[ch]: thoroughly debug these,
2025-04-08) finally removed the entire code for the "recursive"
merge strategy, the last external caller of refresh_cache_entry()
went with it.
Hide the low-level implementation detail again by making it a
file-scope static function. The external callers would indirectly
call it when they call make_cache_entry() or rename_index_entry_at()
external interface, which "ort" (the successor of "recursive") does.
Signed-off-by: Junio C Hamano <gitster@pobox.com>
The "add -i" machinery is encapsulated in run_add_i() function,
which uses init_add_i_state() to initialize the machinery, does its
thing, and clear_add_i_state() to tear it down. External callers
have no need to call anything other than run_add_i(), starting at
d51b61f5da (add-patch: remove dependency on "add-interactive"
subsystem, 2026-03-02), which refactored the code paths involved.
Make init/clear_add_i_state() file-scope static functions, and
"struct add_i_state" type as well.
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Like so many other open source projects, the Git project has seen an
ever-increasing flood of security reports. Many of those reports
describe valid bugs yet are redirected from the git-security mailing
list because they are deemed "not vulnerabilities". While some Git
contributors seem to have a very concrete idea how to discern between
bugs that constitute vulnerabilities (and hence must be fixed in secret,
to keep Git users safe) from bugs that can be fixed in the open, most
reporters must be quite puzzled because the Git project provides no
clear document to help define the security boundaries Git tries to
guarantee.
Of course, there _are_ hints and bits and pieces of documentation: Git's
security guidance has accumulated across individual fixes. Some might be
tempted to describe the boundary as "before clone" versus "after clone",
but history establishes a more precise distinction. e69ac42fcc (docs:
document security issues around untrusted .git dirs, 2024-04-16)
explains why cloned content can generally be inspected with `git log`:
repository-local hooks and configuration are not copied, whereas an
untrusted `.git` directory remains unsafe. 779ea9303a (Documentation:
define protected configuration, 2022-07-14) likewise ties trust to
configuration scope rather than timing alone.
State the governing principle in one place: Git's security boundary
concerns unexpected or implicit execution of attacker-controlled code. A
theoretical opportunity to inspect repository contents is not consent to
execute them. Conversely, explicitly choosing an execution-capable
mechanism is materially different. Execution after clone is therefore
not inherently a vulnerability.
This distinction underlies 4cd1cf31ef (Git 2.20.2, 2019-12-04), which
describes CVE-2019-19604 as code running during recursive clone plus a
submodule update "without the user explicitly having asked for that".
a1d4f67c12 (transport: make protocol.file.allow be user by default,
2022-07-29) likewise contrasts direct user action with recursion lacking
user input. e4930e86c0 (t5510: verify that D/F confusion cannot lead to
an RCE, 2024-03-24) similarly frames remote code execution as code run
by an operation not expected to run it.
Timing remains relevant when it removes any meaningful choice.
873a466ea3 (clone: drop the protections where hooks aren't run,
2024-05-20) notes that clone-time hook execution leaves no chance to
inspect first. Conversely, 8d1a744820 (setup.c: create
safe.bareRepository, 2022-07-14) addresses post-clone use of embedded
bare repositories. Together these cases show why timing alone cannot
define the boundary.
Assisted-by: GPT-5.6 Sol
Helped-by: Patrick Steinhardt <ps@pks.im>
Helped-by: Junio C Hamano <gitster@pobox.com>
Co-authored-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Toon Claes <toon@iotcl.com>
Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Use of "test -e" and "! test -e" in t5402 have been updated
to use test_path_exists and test_path_missing.
* tk/t5402-test-path-helper:
t5402: use test_path_* helpers instead of test -e and test -f
The documentation for SSH signature verification has been updated to
clarify that key lifetime checks depend on spoofable dates.
* cr/doc-gpg-ssh-key-lifetime:
doc: gpg: say which date SSH key lifetimes are checked against
The 'git multi-pack-index write' command has been updated to silently
return success when there are no object entries to index. This avoids
writing empty 'multi-pack-index' layers, which previously caused
subsequent incremental midx writes using the '--bitmap' option to fail
when attempting to load the missing reverse index.
* pp/midx-write-skip-empty:
midx-write: skip writes with no object entries
The testbed job overrides GIT_TEST_DEFAULT_INITIAL_BRANCH_NAME to
"master". This is rather pointless nowadays though, as we already
configure the initial branch name to either "main" or "master" depending
on the "WITH_BREAKING_CHANGES" toggle.
Drop this override.
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
With 32d5b90590 (Enable Rust by default, 2026-04-09) we have enabled
Rust by default. As part of that change we also lost test coverage of
non-Rust builds, as the only platform where we still exercise without
Rust is on Alpine Linux with musl libc.
Adapt the "linux-asan-ubsan" job to disable Rust to restore some of that
coverage. This job was chosen because we also get more bang for the buck
checking for memory safety issues in a job where we use C instead of
Rust, as Rust is supposedly memory-safe by itself already.
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
When running with breaking changes enabled then we will also run tests
with the SHA256 object hash by default, unless explicitly overridden.
But we don't do the same for ref storage format and will continue to run
tests with the "files" backend even though "reftables" are going to be
the default backend there.
Adapt the logic to also use the compiled-in default ref storage backend
for running our tests. Like this we'll now exercise the "reftable"
backend when breaking changes are enabled.
This of course also applies to our CI jobs, where jobs exercising
breaking changes will run now with both SHA256 and reftables. This
renders the explicit "linux-reftable-sha256" job obsolete. Drop it.
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
With the preceding consolidations of test variables we now pointlessly
have three switches over "$jobname". Merge them into a single switch.
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
We have a couple of test variables that we set in multiple different
jobs. These jobs always have specific identifiers in their names and can
thus easily be told apart from the other jobs.
Use this fact to deduplicate the setup of those test variables by
pattern matching for those identifiers.
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
The GIT_TEST_USE_SET_E test variable determines whether we run our test
suite with `set -e` enabled or not. This works on all of our supported
Linux distributions, but it doesn't work on macOS because the version of
Bash used there is rather old and thus has some differences in
behaviour.
We currently set that variable for a bunch of distros explicitly, which
is tedious to keep up-to-date. For example, our "linux32" job does not
enable the test variable even though it could. Adapt the script to
instead set it on any Linux distribution.
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
The setup of our test environment is split up across "ci/lib.sh" and
"ci/run-build-and-tests.sh". It is not exactly obvious why that split
even exists, and because of the split you have to know about both of the
locations to be able to figure out the specific environment that applies
to a specific job.
Consolidate the setup into "ci/lib.sh". Note that this is a pure move
for now that results in some awkward duplication. This duplication will
be cleaned up in subsequent commits.
Signed-off-by: Patrick Steinhardt <ps@pks.im>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
In builtin/pack-objects.c, write_no_reuse_object() handles blobs
exceeding core.bigFileThreshold by writing them in a streaming path. It
takes the size from st->size (size_t) and assigns it to an "unsigned
long" variable, which is then written to the pack object header, and
write_large_blob_data() adds up the compressed length in an "unsigned
long" as well.
On platforms where "long" is 32 bits but size_t is 64 bits, like 64-bit
Windows, handling a blob of 4GiB or more truncates the size in the pack
header while the data decompresses to the full size, corrupting the
object. If the compressed data also exceeds 4GiB, the length
accumulation overflows "unsigned long", misaligning the offsets of all
subsequent objects in the index.
When running repack or gc on a loose large blob, the original loose copy
is pruned, leaving only the corrupted packed copy and resulting in data
loss. Truncating st->size to 16 bits, with a 100KiB loose blob reachable
from a commit and "git -c core.bigFileThreshold=1k repack -a -d", leaves
a corrupt packed object and no loose copy.
Switch the streamed path to use size_t for the object size, and off_t
for the length of the compressed data, which write_large_blob_data()
adds up while it writes the stream piece by piece, and for
write_no_reuse_object()'s return value, like write_reuse_object()
already does. Other truncations in pack-objects are not reachable
because core.bigFileThreshold is itself an "unsigned long".
Triggering this requires processing an object of 4GiB or more on a
platform where "long" is 32 bits but size_t is 64 bits, so no test is
added.
Helped-by: Simon Richter <Simon.Richter@hogyros.de>
Signed-off-by: Elia Pinto <gitter.spiros@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
"git -c merge.renames merge" fails with "missing value for
'merge.renames'", although git(1) says that "git -c foo.bar" sets
foo.bar to true. The same happens with diff.renames and
merge.directoryRenames, and with a setting written without
"= <value>" in a config file, which git-config(1) also documents as
true. Every command that merges through merge-ort fails this way.
merge-ort reads these settings with repo_config_get_string(), which
rejects a missing value. Read them with repo_config_get_value()
instead. git_config_rename() and git_parse_maybe_bool() already take
a missing value as true.
Assisted-by: Claude Fable 5.1
Signed-off-by: Thomas Bachem <mail@thomasbachem.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
output_pair_header() and patch_diff() receive a diffopt whose repo
field names the repository to work on, yet they abbreviate object
names and look up commits in the_repository. get_filespec(), called
from patch_diff(), also uses the_hash_algo, which is the hash
algorithm of the_repository. If a caller set up diffopt for another
repository, these functions would still read from the global one.
Use diffopt->repo in output_pair_header(), and add a hash algorithm
parameter to get_filespec() so that patch_diff() can pass
diffopt->repo->hash_algo.
Keep USE_THE_REPOSITORY_VARIABLE because read_patches(), output() and
is_range_diff_range() still use the_repository.
Signed-off-by: Okhuomon Ajayi <okhuomonajayi54@gmail.com>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano