1257633 - Upgrade git version to > 2.7.3 on OS X build and test machines to address CVE-2016-2324 and CVE‑2016‑2315

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: Puppet, task)

Comment 1

[Jake Watkins [:dividehex]]

Attachment: bug1257633-1-upgrade-git-osx.patch

Installs git-2.7.4 to osx
Also adds back in the anchors which shouldn't have been removed previously

Comment 2

[Jake Watkins [:dividehex]]

I'm going out on a limb here and assuming we can get away with a single non os specific version build.  If this proves incorrect, I'll backout by linking and bumping the previous version by release number. pkgdmg isn't versionable but the can be worked around for rollbacks in this way.

Comment 3

[Jake Watkins [:dividehex]]

Comment on attachment 8733612 [details] [diff] [review]
bug1257633-1-upgrade-git-osx.patch

remote:   https://hg.mozilla.org/build/puppet/rev/ec6a2cd0cbcf
remote:   https://hg.mozilla.org/build/puppet/rev/6b21dc400b73

Comment 4

[Kim Moir [:kmoir] ET]

See bug 1263082 for comments, it looks like there is a bogus version of git for mac in automation, this is hitting us in on the bld-lion-r5 machines that we are using to run release automation

Comment 5

[Jake Watkins [:dividehex]]

I've rebuilt git for 10.6, 10.7 and 10.10 and tested the binaries on each os version respectively.

Deployed here:
remote:   https://hg.mozilla.org/build/puppet/rev/c010230e92ed

Comment 6

[Nick Thomas [:nthomas] (UTC+12)]

We're hitting a new error now, please see https://bugzilla.mozilla.org/show_bug.cgi?id=1263082#c10.

Comment 7

[Jake Watkins [:dividehex]]

Attachment: bug1257633-2-fix-git-osx-10.7.patch

This is a fixed release of git 2.7.4 for osx 10.7.  Since the package resource on osx is not versionable, I had to separate out 10.7 in a case statement.  Comments are including in the manifest as a reminder.

Tested on bld-lion-r5-088:

[[e-mail] ~]# /tools/git/bin/git --version
dyld: Library not loaded: /opt/local/lib/libiconv.2.dylib
  Referenced from: /tools/git/bin/git
  Reason: Incompatible library version: git requires version 8.0.0 or later, but libiconv.2.dylib provides version 7.0.0
Trace/BPT trap: 5

[[e-mail] ~]# /tools/git/bin/git --version
git version 2.7.4

Comment 8

[Jake Watkins [:dividehex]]

Comment on attachment 8740053 [details] [diff] [review]
bug1257633-2-fix-git-osx-10.7.patch

remote:   https://hg.mozilla.org/build/puppet/rev/fa1b9555c45b
remote:   https://hg.mozilla.org/build/puppet/rev/e59161fe1667

Comment 9

[Jake Watkins [:dividehex]]

Attachment: bug1257633-3-bump-release-git-dmg-script.patch

Updates the release # in the git-dmg.sh build script

Comment 10

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 8740065 [details] [diff] [review]
bug1257633-3-bump-release-git-dmg-script.patch

I assume all three versions didn't get upgraded to -3 because it was too much work to build 'em all?

Comment 11

[Jake Watkins [:dividehex]]

(In reply to Dustin J. Mitchell [:dustin] from comment #10)
> Comment on attachment 8740065 [details] [diff] [review]
> bug1257633-3-bump-release-git-dmg-script.patch
> 
> I assume all three versions didn't get upgraded to -3 because it was too
> much work to build 'em all?

Correct.

Comment 12

[Jake Watkins [:dividehex]]

Comment on attachment 8740065 [details] [diff] [review]
bug1257633-3-bump-release-git-dmg-script.patch

remote:   https://hg.mozilla.org/build/puppet/rev/fab0c33f36e9
remote:   https://hg.mozilla.org/build/puppet/rev/518362ec5fd9