Bug 206417 - devel/cgit: Update to 0.12 (Security fixes)
Summary: devel/cgit: Update to 0.12 (Security fixes)
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: Jason Unovitch
URL:
Keywords: patch, patch-ready, security
Depends on:
Blocks:
 
Reported: 2016-01-20 02:33 UTC by Jason Unovitch
Modified: 2016-01-21 02:18 UTC (History)
2 users (show)

See Also:
junovitch: maintainer-feedback+
junovitch: merge-quarterly+

Attachments
Untested patch with update (2.32 KB, patch)
2016-01-20 05:25 UTC, Kevin Zheng 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jason Unovitch freebsd_committer freebsd_triage 2016-01-20 02:33:44 UTC 
Maintainer of devel/cgit,
Cgit has announced several security vulnerabilities [1] are fixed in the most recent upstream release [2]. Can you please provide a tested patch for the port?

[1] http://www.openwall.com/lists/oss-security/2016/01/14/3
[2] http://lists.zx2c4.com/pipermail/cgit/2016-January/002817.html
Comment 1 Jason Unovitch freebsd_committer freebsd_triage 2016-01-20 02:34:14 UTC 
Take and add CC. I'll be working this security update.
Comment 2 Kevin Zheng 2016-01-20 05:25:22 UTC 
Created attachment 165849 [details]
Untested patch with update

Untested patch with update to 0.12. I don't have access to a poudriere just this moment, so it would be great if someone could poudriere-test this patch.
Comment 3 Kevin Zheng 2016-01-20 05:27:33 UTC 
Redundant line in pkg-plist:
%%PORTDOCS%%%%DOCSDIR%%/%%PORTNAME%%rc.5.txt

This file was listed in PORTDOCS.
Comment 4 commit-hook freebsd_committer freebsd_triage 2016-01-20 23:41:59 UTC 
A commit references this bug:

Author: junovitch
Date: Wed Jan 20 23:41:20 UTC 2016
New revision: 406815
URL: https://svnweb.freebsd.org/changeset/ports/406815

Log:
  Document cgit -- multiple vulnerabilities

  PR:		206417
  Security:	CVE-2016-1899
  Security:	CVE-2016-1900
  Security:	CVE-2016-1901
  Security:	https://vuxml.FreeBSD.org/freebsd/62c0dbbd-bfce-11e5-b5fe-002590263bf5.html

Changes:
  head/security/vuxml/vuln.xml
Comment 5 commit-hook freebsd_committer freebsd_triage 2016-01-20 23:44:01 UTC 
A commit references this bug:

Author: junovitch
Date: Wed Jan 20 23:42:59 UTC 2016
New revision: 406816
URL: https://svnweb.freebsd.org/changeset/ports/406816

Log:
  devel/cgit: update 0.11.2 -> 0.12

  Changes:	http://lists.zx2c4.com/pipermail/cgit/2016-January/002817.html

  PR:		206417
  Submitted by:	Kevin Zheng <kevinz5000@gmail.com> (maintainer)
  Security:	CVE-2016-1899
  Security:	CVE-2016-1900
  Security:	CVE-2016-1901
  Security:	https://vuxml.FreeBSD.org/freebsd/62c0dbbd-bfce-11e5-b5fe-002590263bf5.html
  MFH:		2016Q1

Changes:
  head/devel/cgit/Makefile
  head/devel/cgit/distinfo
  head/devel/cgit/pkg-plist
Comment 6 commit-hook freebsd_committer freebsd_triage 2016-01-21 01:25:07 UTC 
A commit references this bug:

Author: junovitch
Date: Thu Jan 21 01:24:45 UTC 2016
New revision: 406817
URL: https://svnweb.freebsd.org/changeset/ports/406817

Log:
  MFH: r406816

  devel/cgit: update 0.11.2 -> 0.12

  Changes:	http://lists.zx2c4.com/pipermail/cgit/2016-January/002817.html

  PR:		206417
  Submitted by:	Kevin Zheng <kevinz5000@gmail.com> (maintainer)
  Approved by:	ports-secteam (miwi)
  Security:	CVE-2016-1899
  Security:	CVE-2016-1900
  Security:	CVE-2016-1901
  Security:	https://vuxml.FreeBSD.org/freebsd/62c0dbbd-bfce-11e5-b5fe-002590263bf5.html

Changes:
_U  branches/2016Q1/
  branches/2016Q1/devel/cgit/Makefile
  branches/2016Q1/devel/cgit/distinfo
  branches/2016Q1/devel/cgit/pkg-plist
Comment 7 Jason Unovitch freebsd_committer freebsd_triage 2016-01-21 02:18:33 UTC 
(In reply to Kevin Zheng from comment #2)
Done. Poudriere was clean on 9.3 -> CURRENT after the removal of the redundant line mentioned in comment 3. Thank you for the quick turnaround.

- Set merge-quarterly+ as it was approved by ports-secteam (miwi)
- Set maintainer-feedback+ as the patch was from the port's maintainer
- Fix keywords: drop needs-patch and needs-qa and add patch/patch-ready
- Close PR