Bug#975607: libgit2-28: relative paths in alternates mishandled when nested

[Utkarsh Gupta]

Hi Eric,

On Tue, Nov 24, 2020 at 6:00 AM Eric Wong  wrote:
> I've noticed libgit2 fails to handle relative paths for
> alternates properly when a relative path is nested from
> within another alternate.  Regular git(1) works fine
> (as shown in the attached script).
>
> I initially hit this in some Inline::C (Perl) code, but the Ruby
> "rugged" library hits it, too.
>
> I've attached a small Ruby script which reliably reproduces it
> with the "ruby-rugged" gem.  I chose Ruby for this bug report
> since I expect libgit2 maintainers to be familiar with it.
>
> More detailed info is in the comments of the attached script.
>
> This also affects libgit2-27 (0.27.7+dfsg.1-0.2) in buster in
> addition to buster-backports.
>
> This is an upstream bug, please forward as appropriate.

Thanks for reporting this here.
I've forwarded the bug upstream: https://github.com/libgit2/libgit2/issues/5711

As soon as we have a fix available for this, I'll be happy to backport this :)



- u

Bug#975607: libgit2-28: relative paths in alternates mishandled when nested

[Eric Wong]

Package: libgit2-28
Version: 0.28.3+dfsg.1-1~bpo10+1
Severity: normal
Tags: upstream

Dear Maintainer,

I've noticed libgit2 fails to handle relative paths for
alternates properly when a relative path is nested from
within another alternate.  Regular git(1) works fine
(as shown in the attached script).

I initially hit this in some Inline::C (Perl) code, but the Ruby
"rugged" library hits it, too.

I've attached a small Ruby script which reliably reproduces it
with the "ruby-rugged" gem.  I chose Ruby for this bug report
since I expect libgit2 maintainers to be familiar with it.

More detailed info is in the comments of the attached script.

This also affects libgit2-27 (0.27.7+dfsg.1-0.2) in buster in
addition to buster-backports.

This is an upstream bug, please forward as appropriate.

I will never use the upstream GitHub bug tracker due to their
Terms-of-Service, JavaScript CAPTCHA requirement, and it being
non-free software.

Thank you.

-- System Information:
Debian Release: 10.6
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-debug'), (500, 
'oldstable-updates'), (500, 'stable'), (500, 'oldstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Versions of packages libgit2-28 depends on:
ii  libc6  2.28-10
ii  libcom-err21.44.5-1+deb10u3
ii  libgssapi-krb5-2   1.17-3+deb10u1
ii  libhttp-parser2.8  2.8.1-1
ii  libk5crypto3   1.17-3+deb10u1
ii  libkrb5-3  1.17-3+deb10u1
ii  libmbedcrypto3 2.16.0-1
ii  libmbedtls12   2.16.0-1
ii  libmbedx509-0  2.16.0-1
ii  libssh2-1  1.8.0-2.1
ii  zlib1g 1:1.2.11.dfsg-1

libgit2-28 recommends no packages.

libgit2-28 suggests no packages.

-- no debconf information




lg2-alternate-bug.rb
Description: application/ruby