Merging debian version 1:2.45.1-1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 48 insertions, 0 deletions

diff --git a/debian/patches/0003-tests-verify-that-clone-c-core.hooksPath-dev-null-wor.diff b/debian/patches/0003-tests-verify-that-clone-c-core.hooksPath-dev-null-wor.diff
new file mode 100644
index 0000000..9a494d9
--- /dev/null
+++ b/debian/patches/0003-tests-verify-that-clone-c-core.hooksPath-dev-null-wor.diff
@@ -0,0 +1,48 @@
+From ce34e1b7a072db221190446e79cb373c7f6010a5 Mon Sep 17 00:00:00 2001
+From: Johannes Schindelin <johannes.schindelin@gmx.de>
+Date: Sat, 18 May 2024 10:32:42 +0000
+Subject: tests: verify that `clone -c core.hooksPath=/dev/null` works again
+
+commit a25a15726f4d1bf1c8362f1b3146096d6a87f965 upstream.
+
+As part of the protections added in Git v2.45.1 and friends,
+repository-local `core.hooksPath` settings are no longer allowed, as a
+defense-in-depth mechanism to prevent future Git vulnerabilities to
+raise to critical level if those vulnerabilities inadvertently allow the
+repository-local config to be written.
+
+What the added protection did not anticipate is that such a
+repository-local `core.hooksPath` can not only be used to point to
+maliciously-placed scripts in the current worktree, but also to
+_prevent_ hooks from being called altogether.
+
+We just reverted the `core.hooksPath` protections, based on the Git
+maintainer's recommendation in
+https://lore.kernel.org/git/xmqq4jaxvm8z.fsf@gitster.g/ to address this
+concern as well as related ones. Let's make sure that we won't regress
+while trying to protect the clone operation further.
+
+Reported-by: Brooke Kuhlmann <brooke@alchemists.io>
+Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
+Signed-off-by: Junio C Hamano <gitster@pobox.com>
+Signed-off-by: Jonathan Nieder <jrnieder@gmail.com>
+---
+ t/t1350-config-hooks-path.sh | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/t/t1350-config-hooks-path.sh b/t/t1350-config-hooks-path.sh
+index f6dc83e2aab..45a04929170 100755
+--- a/t/t1350-config-hooks-path.sh
++++ b/t/t1350-config-hooks-path.sh
+@@ -41,4 +41,11 @@ test_expect_success 'git rev-parse --git-path hooks' '
+ 	test .git/custom-hooks/abc = "$(cat actual)"
+ '
+ 
++test_expect_success 'core.hooksPath=/dev/null' '
++	git clone -c core.hooksPath=/dev/null . no-templates &&
++	value="$(git -C no-templates config --local core.hooksPath)" &&
++	# The Bash used by Git for Windows rewrites `/dev/null` to `nul`
++	{ test /dev/null = "$value" || test nul = "$value"; }
++'
++
+ test_done