Skip to content

[staging] git: 2.39.0 → 2.39.1#211281

Merged
SuperSandro2000 merged 1 commit intoNixOS:stagingfrom
LibreCybernetics:update-git
Jan 18, 2023
Merged

[staging] git: 2.39.0 → 2.39.1#211281
SuperSandro2000 merged 1 commit intoNixOS:stagingfrom
LibreCybernetics:update-git

Conversation

@fabianhjr
Copy link
Member

@fabianhjr fabianhjr commented Jan 17, 2023 •
edited by mweinelt
Loading

Advisories:

CVEs:

  • CVE-2022-23521 (Critical)
  • CVE-2022-41903 (Critical)
  • CVE-2022-41953 (Windows only)
Description of changes
Things done
  • Built on platform(s)
    • x86_64-linux
    • aarch64-linux (gitFull)
    • x86_64-darwin (gitFull)
    • aarch64-darwin (gitFull)
  • For non-Linux: Is sandbox = true set in nix.conf? (See Nix manual)
  • Tested, as applicable:
  • Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
  • Tested basic functionality of all binary files (usually in ./result/bin/)
  • 23.05 Release Notes (or backporting 22.11 Release notes)
    • (Package updates) Added a release notes entry if the change is major or breaking
    • (Module updates) Added a release notes entry if the change is significant
    • (Module addition) Added a release notes entry if adding a new NixOS module
    • (Release notes changes) Ran nixos/doc/manual/md-to-db.sh to update generated release notes
  • Fits CONTRIBUTING.md.

@fabianhjr fabianhjr added the 1.severity: security Issues which raise a security issue, or PRs that fix one label Jan 17, 2023
@fabianhjr
Copy link
Member Author

fabianhjr commented Jan 17, 2023

Currently building/testing.

@fabianhjr
Copy link
Member Author

fabianhjr commented Jan 17, 2023

Built on NixOS (x86_64-linux)

@fabianhjr
Copy link
Member Author

fabianhjr commented Jan 17, 2023

Previous update went trough staging: #205682

@mweinelt mweinelt marked this pull request as draft January 17, 2023 20:43
@mweinelt mweinelt added backport staging-22.11 9.needs: port to stable A PR needs a backport to the stable release. and removed backport staging-22.11 labels Jan 17, 2023
@fabianhjr fabianhjr mentioned this pull request Jan 17, 2023
Merged
13 tasks
@fabianhjr fabianhjr added 8.has: port to stable This PR already has a backport to the stable release. and removed 9.needs: port to stable A PR needs a backport to the stable release. labels Jan 17, 2023
@mweinelt
Copy link
Member

mweinelt commented Jan 17, 2023

I think we should go through staging.

@fabianhjr
Copy link
Member Author

fabianhjr commented Jan 17, 2023

I am concerned that this would affect Hydra.

As far as I understand this an adversary could use a new PR to get RCE.

@vcunat
Copy link
Member

vcunat commented Jan 17, 2023

Hydra.nixos.org doesn't touch PRs (automatically).

@mweinelt
Copy link
Member

mweinelt commented Jan 17, 2023

How do you imagine this could happen?

@fabianhjr
Copy link
Member Author

fabianhjr commented Jan 17, 2023 •
edited
Loading

  1. An adversary creates an attack commit with .gitattributes exploiting mentioned CVEs, and a message which passes the ofBorg message checks.
  2. ofBorg checks out the PR with the exploit since trusted users is currently disabled.
  3. (assumption) ofBorg runs on shared resources with Hydra (so no merge is needed to attack)

@SuperSandro2000
Copy link
Member

SuperSandro2000 commented Jan 17, 2023

(assumption) ofBorg runs on shared resources with Hydra (so no merge is needed to attack)

AFAIK it does not.

@fabianhjr
git: 2.39.0 → 2.39.1
f50df0e 
Advisories:

- https://github.blog/2023-01-17-git-security-vulnerabilities-announced-2/

CVEs:

- CVE-2022-23521
- CVE-2022-41903
- CVE-2022-41953
@SuperSandro2000
Copy link
Member

SuperSandro2000 commented Jan 17, 2023

Can we get a rebuild count estimation first?
I would be fine to send this straight to staging-next but it wouldn't be ideal when we send a 25k+ rebuild commit to master and ofborg/hydra would only recover in a few days from it.

@fabianhjr
Copy link
Member Author

fabianhjr commented Jan 17, 2023

Rebased on merge-base of origin/staging origin/master so it should be easy to change target and merge to either staging or main branch.

@mweinelt
Copy link
Member

mweinelt commented Jan 17, 2023

I would be fine to send this straight to staging-next but

there is none open right now.

@fabianhjr
Copy link
Member Author

fabianhjr commented Jan 17, 2023

Currently running ./maintainers/scripts/rebuild-amount.sh HEAD^ to get an estimate rebuild count.

@vcunat
Copy link
Member

vcunat commented Jan 17, 2023 •
edited
Loading

Probably very similar amounts as recent git updates: #205682
i.e. very high, perhaps over half of everything

@mweinelt mweinelt changed the base branch from master to staging January 17, 2023 21:36
@mweinelt mweinelt marked this pull request as ready for review January 17, 2023 21:38
@fabianhjr
Copy link
Member Author

fabianhjr commented Jan 17, 2023 

Estimating rebuild amount by counting changed Hydra jobs (parallel=unset).
      1 pkgs-lib-tests
  20564 x86_64-darwin
  28692 x86_64-linux

@fabianhjr fabianhjr changed the title git: 2.39.0 → 2.39.1 [staging] git: 2.39.0 → 2.39.1 Jan 17, 2023
@ofborg ofborg bot requested review from globin, primeos and wmertens January 17, 2023 22:15
@ofborg ofborg bot added 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-darwin: 5001+ This PR causes many rebuilds on Darwin and must target the staging branches. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 5001+ This PR causes many rebuilds on Linux and must target the staging branches. labels Jan 17, 2023
@zowoq zowoq mentioned this pull request Jan 17, 2023
Closed
13 tasks
SuperSandro2000
SuperSandro2000 approved these changes Jan 18, 2023
View reviewed changes
Copy link
Member

@SuperSandro2000 SuperSandro2000 left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There seems to be no follow up to #209180 yet, so staging it yes.

Not sure why ofborg failed to build it but I can't load the logs.

Edit: related to passthru tests, to be exact buildbot.

@ofborg build git

Planning to merge this rather sooner than later.

@vcunat maybe we can do a fast staging-next run?

@SuperSandro2000
Copy link
Member

SuperSandro2000 commented Jan 18, 2023

Oh, yeah 22.11 was already merged.

@SuperSandro2000 SuperSandro2000 merged commit f2a48e1 into NixOS:staging Jan 18, 2023
@fabianhjr fabianhjr deleted the update-git branch January 18, 2023 15:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SuperSandro2000 SuperSandro2000 SuperSandro2000 approved these changes

@mweinelt mweinelt Awaiting requested review from mweinelt

@grahamc grahamc Awaiting requested review from grahamc

@risicle risicle Awaiting requested review from risicle

@lheckemann lheckemann Awaiting requested review from lheckemann

@domenkozar domenkozar Awaiting requested review from domenkozar

@peterhoeg peterhoeg Awaiting requested review from peterhoeg

@NeQuissimus NeQuissimus Awaiting requested review from NeQuissimus

@vcunat vcunat Awaiting requested review from vcunat

@zowoq zowoq Awaiting requested review from zowoq

@primeos primeos Awaiting requested review from primeos

@wmertens wmertens Awaiting requested review from wmertens

@globin globin Awaiting requested review from globin

+1 more reviewer

@vic vic vic approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

1.severity: security Issues which raise a security issue, or PRs that fix one 8.has: port to stable This PR already has a backport to the stable release. 10.rebuild-darwin: 501+ This PR causes many rebuilds on Darwin and should normally target the staging branches. 10.rebuild-darwin: 5001+ This PR causes many rebuilds on Darwin and must target the staging branches. 10.rebuild-linux: 501+ This PR causes many rebuilds on Linux and should normally target the staging branches. 10.rebuild-linux: 5001+ This PR causes many rebuilds on Linux and must target the staging branches.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@fabianhjr @mweinelt @vcunat @SuperSandro2000 @vic