unofficial mirror of bug-guix@gnu.org 
 help / color / mirror / code / Atom feed
From: bokr@bokr.com
To: "André Batista" <nandre@riseup.net>
Cc: "Ludovic Courtès" <ludovic.courtes@inria.fr>, 56398@debbugs.gnu.org
Subject: bug#56398: (guix git) fails to check out repos with nested submodules
Date: Fri, 25 Nov 2022 00:51:43 +0100	[thread overview]
Message-ID: <20221124235143.GA8148@LionPure> (raw)
In-Reply-To: <Y3+K7cBeds6756u7@andel>

Hi,

On +2022-11-24 12:17:01 -0300, André Batista wrote:
> Hi!
> 
> qui 04 ago 2022 às 13:59:20 (1659632360), ludovic.courtes@inria.fr enviou:
> > I think we should instead report it upstream.  Do you feel like doing
> > it?  I guess we’d need to give them the C version of the three-line
> > snippet I gave earlier.
> 
> Upstream issue #6433[1]
> 
> Apparently, GIT_SUBMODULE_STATUS_WD_UNINITIALIZED isn't actually set
> in this scenario, only GIT_SUBMODULE_STATUS_IN_CONFIG.
> 
> 1. https://github.com/libgit2/libgit2/issues/6433
> 
> 
>

Wondering if this[1] is all history in gnu/guix-land:

[1] <https://nvd.nist.gov/vuln/detail/CVE-2020-5260>

Wherein it says

--8<---------------cut here---------------start------------->8---
The problem has been patched in the versions published on
April 14th, 2020, going back to v2.17.x. Anyone wishing to
backport the change further can do so by applying commit
9a6bbee (the full release includes extra checks for git
fsck, but that commit is sufficient to protect clients
against the vulnerability). The patched versions are:
2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2,
2.24.2, 2.25.3, 2.26.1.
--8<---------------cut here---------------end--------------->8---

Is there an automated tool to answer the question,
"What executables (command line directly, or indirectly (including
config-directed interpretation)) does my system contain
that have known vulnerabilities?"

BTW: Newsflash: :)
     RMS paranoia now dernier-cri[3] as cited in [2]
[2] <https://www.theregister.com/2022/11/23/dod_cisa_omb_cybersecurity/>
[3] <https://dodcio.defense.gov/Portals/0/Documents/Library/DoD-ZTStrategy.pdf>

Something[3] to get (more) serious about for gnu/guix?
--
Regards,
Bengt Richter




  reply	other threads:[~2022-11-24 23:53 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-07-05 15:02 bug#56398: (guix git) fails to check out repos with nested submodules Ludovic Courtès
2022-07-07 21:35 ` André Batista
2022-07-08  2:45   ` André Batista
2022-07-08 10:17     ` bokr
2022-08-04 12:01       ` André Batista
2022-07-08  8:26   ` Ludovic Courtès
2022-08-04 11:43     ` André Batista
2022-08-04 11:59       ` Ludovic Courtès
2022-08-05 20:10         ` André Batista
2022-08-05 22:40           ` André Batista
2022-11-24 15:17         ` André Batista
2022-11-24 23:51           ` bokr [this message]
2022-11-28 15:41           ` André Batista
2022-11-28 16:57             ` Ludovic Courtès

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20221124235143.GA8148@LionPure \
    --to=bokr@bokr.com \
    --cc=56398@debbugs.gnu.org \
    --cc=ludovic.courtes@inria.fr \
    --cc=nandre@riseup.net \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).