1257635 - Upgrade git version to > 2.7.3 on linux build and test machines to address CVE-2016-2324 and CVE‑2016‑2315

Status: RESOLVED FIXED

(Infrastructure & Operations :: RelOps: Puppet, task)

Comment 1

[Jake Watkins [:dividehex]]

git 2.7.4 has been built for centos(both i386 and x86_64) and puppetagain repos have been updated. We'll deploy first thing Monday.

Comment 2

[Jake Watkins [:dividehex]]

Attachment: bug11257635-1.patch

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 8732904 [details] [diff] [review]
bug11257635-1.patch

Review of attachment 8732904 [details] [diff] [review]:
-----------------------------------------------------------------

Very nice!

Comment 4

[Jake Watkins [:dividehex]]

Comment on attachment 8732904 [details] [diff] [review]
bug11257635-1.patch

remote:   https://hg.mozilla.org/build/puppet/rev/71d4d717602d
remote:   https://hg.mozilla.org/build/puppet/rev/47b220b79993

Comment 5

[Jake Watkins [:dividehex]]

Comment on attachment 8732904 [details] [diff] [review]
bug11257635-1.patch

Backed out due to breaking other package dependency

remote:   https://hg.mozilla.org/build/puppet/rev/7e1a8288462f
remote:   https://hg.mozilla.org/build/puppet/rev/561da7d3e9aa


Mon Mar 21 10:08:02 -0700 2016 Puppet (err): Execution of '/bin/rpm -e mozilla-git-2.4.1-3.el6.x86_64' returned 1: error: Failed dependencies:
        mozilla-git is needed by (installed) git-remote-hg-185852e-1.el6.x86_64
Mon Mar 21 10:08:02 -0700 2016 /Stage[main]/Packages::Mozilla::Git/Package[mozilla-git]/ensure (err): change from 2.4.1-3.el6 to absent failed: Execution of '/bin/rpm -e mozilla-git-2.4.1-3.el6.x86_64' returned 1: error: Failed dependencies:
        mozilla-git is needed by (installed) git-remote-hg-185852e-1.el6.x86_64

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

I think only Mark uses git-remote-hg, and even then only maybe, and only on the puppetmasters.  Maybe we should just give up on that?

Comment 7

[Jake Watkins [:dividehex]]

(In reply to Dustin J. Mitchell [:dustin] from comment #6)
> I think only Mark uses git-remote-hg, and even then only maybe, and only on
> the puppetmasters.  Maybe we should just give up on that?

I rebuilt the package to require git instead of mozilla-git, but I'm all in favor of dropping tools like this.  It also looks like the code base isn't being maintained anymore.  This might be a problem as we move forward with updating git and/or hg

Comment 8

[Dustin J. Mitchell [:dustin] (he/him)]

Yeah, apparently git-cinnabar is the way forward for git/hg integration.  It's also possible, with modern hg's, to do puppet work in hg alone.

Comment 9

[Jake Watkins [:dividehex]]

Attachment: bug1257635-2.patch

Same as the last plus removal of git-remote-hg

Comment 10

[Dustin J. Mitchell [:dustin] (he/him)]

Comment on attachment 8733074 [details] [diff] [review]
bug1257635-2.patch

Review of attachment 8733074 [details] [diff] [review]:
-----------------------------------------------------------------

OK if Mark's got a way to do development without git-remote-hg.

::: modules/packages/manifests/mozilla/git_remote_hg.pp
@@ +7,5 @@
>      case $::operatingsystem {
>          CentOS: {
>              package {
>                  "git-remote-hg":
> +                    ensure => absent;

Is this just temporary, after which this class will be removed?

Comment 11

[Jake Watkins [:dividehex]]

(In reply to Dustin J. Mitchell [:dustin] from comment #10)
> Comment on attachment 8733074 [details] [diff] [review]
> bug1257635-2.patch
> 
> Review of attachment 8733074 [details] [diff] [review]:
> -----------------------------------------------------------------
> 
> OK if Mark's got a way to do development without git-remote-hg.
> 
> ::: modules/packages/manifests/mozilla/git_remote_hg.pp
> @@ +7,5 @@
> >      case $::operatingsystem {
> >          CentOS: {
> >              package {
> >                  "git-remote-hg":
> > +                    ensure => absent;
> 
> Is this just temporary, after which this class will be removed?

Yes.  The class will be removed soon down the line.

Comment 12

[Jake Watkins [:dividehex]]

Comment on attachment 8733074 [details] [diff] [review]
bug1257635-2.patch

remote:   https://hg.mozilla.org/build/puppet/rev/f2057c07032e
remote:   https://hg.mozilla.org/build/puppet/rev/ff66fc5a84b6

Comment 13

[Jake Watkins [:dividehex]]

Attachment: bug1257635-3-bump-git-version-ubuntu.patch

Comment 14

[Jake Watkins [:dividehex]]

Comment on attachment 8733111 [details] [diff] [review]
bug1257635-3-bump-git-version-ubuntu.patch

remote:   https://hg.mozilla.org/build/puppet/rev/36f91620d83b
remote:   https://hg.mozilla.org/build/puppet/rev/bef3388106f1

Comment 15

[Jake Watkins [:dividehex]]

For reference, the ubuntu git packages were pulled directly from the Ubuntu git maintainer's stable ppa
https://launchpad.net/~git-core/+archive/ubuntu/ppa