chore(deps): update rust crate gix to 0.71.0 [security] #15391
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
rustbot
added
the
S-waiting-on-review
|
@Byron It looks like the new version of gitoxide is having trouble passing some tests. In particular, it seems to refuse to send credentials over http. Do you think you can take a look? |
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
|
I see, sorry for the hassle. I will take a look and post the fix here (if applicable) so one of you can push it to the branch. Alternatively, I can open another PR, but let's hope I get an idea of what's going on here first and swiftly. |
|
And here is the patch for 'git apply 0001-Configure-gix-transport-to-allow-sending-test-creden.patch' and in plain text: From 4e97bcc2bd61a92684bb411a2d501a8cdb5469a1 Mon Sep 17 00:00:00 2001
From: Sebastian Thiel <[email protected]>
Date: Sat, 5 Apr 2025 14:19:47 +0800
Subject: [PATCH] Configure `gix-transport` to allow sending test-credentials
over HTTP
Note that this also means there now are two gix-related dependencies to maintain.
One day `gix` might forward the respective feature in `gix-transport`, or maybe
Cargo will support configuring flags in the tree more easily.
---
Cargo.lock | 1 +
Cargo.toml | 6 ++++++
2 files changed, 7 insertions(+)
diff --git a/Cargo.lock b/Cargo.lock
index fb1a768b8..46e92153d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -327,6 +327,7 @@ dependencies = [
"git2",
"git2-curl",
"gix",
+ "gix-transport",
"glob",
"hex",
"hmac",
diff --git a/Cargo.toml b/Cargo.toml
index fd09de528..61d3aca02 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -48,6 +48,7 @@ filetime = "0.2.25"
flate2 = { version = "1.0.35", default-features = false, features = ["zlib"] }
git2 = "0.20.0"
git2-curl = "0.21.0"
+# When updating this, also see if `gix-transport` further down needs updating or some auth-related tests will fail.
gix = { version = "0.71.0", default-features = false, features = ["blocking-http-transport-curl", "progress-tree", "parallel", "dirwalk"] }
glob = "0.3.2"
handlebars = { version = "6.3.1", features = ["dir_source"] }
@@ -218,6 +219,11 @@ unicode-width.workspace = true
url.workspace = true
walkdir.workspace = true
+# When building Cargo for tests, a safety-measure in `gix` needs to be disabled
+# to allow sending credentials over HTTP connections.
+[target.'cfg(debug_assertions)'.dependencies]
+gix-transport = { version = "0.46.0", features = ["http-client-insecure-credentials"] }
+
[target.'cfg(target_has_atomic = "64")'.dependencies]
tracing-chrome.workspace = true
--
2.39.5 (Apple Git-154)
|
|
Hm, I don't think that's going to work as expected. I suppose we could just always enable that feature, and it wouldn't be any less secure than it was in 0.70 (or compared to libgit2), though I'm not sure if that is what we want to do. We could try to change the test server to use SSL via openssl, though that would require writing a little extra code to generate the certificates. WDYT? EDIT: Or perhaps we can just move that to a dev-dependency? |
In This leaves us in a place where we'd have to set a feature toggle based on some knowledge of what we are building. Maybe
Somehow I feel that testing should be supported so one doesn't have to go through the trouble locally.
That would be great, but I thought these aren't effective in the |
I don't think there is a way to really do that without manually setting the feature. How about we just disable these tests for gitoxide for now, and we open an issue to figure out how to resolve it later? I personally would prefer to figure out some way to go ahead and support ssl in tests. It's not hard to do with openssl, but unfortunately we don't have openssl on windows, which makes it a lot harder. |
|
Apologies for the late response! I am quite afraid of disabling tests as it's the first step towards regression. The few bits of Thus, my preferred solution here is to disable the feature in production as well, and to create an issue to maybe make this work. From 81970d03b3b2dd966e353e0e284949f0e42ac46b Mon Sep 17 00:00:00 2001
From: Sebastian Thiel <[email protected]>
Date: Fri, 11 Apr 2025 07:49:24 +0200
Subject: [PATCH] Configure `gix-transport` to allow sending test-credentials
over HTTP
Note that this also means there now are two gix-related dependencies to maintain.
One day `gix` might forward the respective feature in `gix-transport`, or maybe
Cargo will support configuring flags in the tree more easily.
Even though that's a regression compared to the previous builds, it's not a regression
compared to `git2` which also allwows to send credentials over HTTP.
One may also argue that `gitoxide` goes too far, trying to fix potential issues
with the protocol itself.
---
Cargo.lock | 1 +
Cargo.toml | 5 +++++
2 files changed, 6 insertions(+)
diff --git a/Cargo.lock b/Cargo.lock
index fb1a768b8..46e92153d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -327,6 +327,7 @@ dependencies = [
"git2",
"git2-curl",
"gix",
+ "gix-transport",
"glob",
"hex",
"hmac",
diff --git a/Cargo.toml b/Cargo.toml
index fd09de528..f0c170729 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -48,6 +48,7 @@ filetime = "0.2.25"
flate2 = { version = "1.0.35", default-features = false, features = ["zlib"] }
git2 = "0.20.0"
git2-curl = "0.21.0"
+# When updating this, also see if `gix-transport` further down needs updating or some auth-related tests will fail.
gix = { version = "0.71.0", default-features = false, features = ["blocking-http-transport-curl", "progress-tree", "parallel", "dirwalk"] }
glob = "0.3.2"
handlebars = { version = "6.3.1", features = ["dir_source"] }
@@ -252,6 +253,10 @@ features = [
annotate-snippets = { workspace = true, features = ["testing-colors"] }
cargo-test-support.workspace = true
gix = { workspace = true, features = ["revision"] }
+# When building Cargo for tests, a safety-measure in `gix` needs to be disabled
+# to allow sending credentials over HTTP connections.
+# As we can't set this only for tests, for now it's disabled in production as well.
+gix-transport = { version = "0.46.0", features = ["http-client-insecure-credentials"] }
same-file.workspace = true
snapbox.workspace = true
--
2.39.5 (Apple Git-154)
I'd love if this also works for you, but if not we can of course just disable the affected tests. |
This is needed because some tests send HTTP auth headers, and by default gix will refuse to do that over an insecure channel.
|
Just to be clear, putting it in dev-dependencies means it is only disabled during testing. This doesn't affect production. You can read more about this here. Essentially when it is building tests, it will unify, but if not it won't. Does that make sense? I think that seems good to me. |
|
Actually, I put it into dev-dependencies by accident and think that this would not work as building the This means the most recently provided patch should be good and is good for you, right? |
Update cargo 4 commits in 864f74d4eadcaea3eeda37a2e7f4d34de233d51e..d811228b14ae2707323f37346aee3f4147e247e6 2025-04-11 20:37:27 +0000 to 2025-04-15 15:18:42 +0000 - use `zlib-rs` for gzip compression in rust code (rust-lang/cargo#15417) - test(rustfix): Use `snapbox` for snapshot testing (rust-lang/cargo#15429) - chore(deps): update rust crate gix to 0.71.0 [security] (rust-lang/cargo#15391) - Make sure search paths inside OUT_DIR precede external paths (rust-lang/cargo#15221) Also, * The license exception of sha1_smol with BSD-3-Clause is no longer needed, as `gix-*` doesn't depend on it. * Cargo depends on zlib-rs, which is distributed under Zlib license r? ghost
Update cargo 4 commits in 864f74d4eadcaea3eeda37a2e7f4d34de233d51e..d811228b14ae2707323f37346aee3f4147e247e6 2025-04-11 20:37:27 +0000 to 2025-04-15 15:18:42 +0000 - use `zlib-rs` for gzip compression in rust code (rust-lang/cargo#15417) - test(rustfix): Use `snapbox` for snapshot testing (rust-lang/cargo#15429) - chore(deps): update rust crate gix to 0.71.0 [security] (rust-lang/cargo#15391) - Make sure search paths inside OUT_DIR precede external paths (rust-lang/cargo#15221) Also, * The license exception of sha1_smol with BSD-3-Clause is no longer needed, as `gix-*` doesn't depend on it. * Cargo depends on zlib-rs, which is distributed under Zlib license r? ghost
This PR contains the following updates:
0.70.0->0.71.0GitHub Vulnerability Alerts
CVE-2025-31130
Summary
gitoxide uses SHA-1 hash implementations without any collision detection, leaving it vulnerable to hash collision attacks.
Details
gitoxide uses the
sha1_smolorsha1crate, both of which implement standard SHA-1 without any mitigations for collision attacks. This means that two distinct Git objects with colliding SHA-1 hashes would break the Git object model and integrity checks when used with gitoxide.The SHA-1 function is considered cryptographically insecure. However, in the wake of the SHAttered attacks, this issue was mitigated in Git 2.13.0 in 2017 by using the sha1collisiondetection algorithm by default and producing an error when known SHA-1 collisions are detected. Git is in the process of migrating to using SHA-256 for object hashes, but this has not been rolled out widely yet and gitoxide does not support SHA-256 object hashes.
PoC
The following program demonstrates the problem, using the two SHAttered PDFs:
The output is as follows:
The latter behaviour matches Git.
Since the SHAttered PDFs are not in a valid format for Git objects, a direct proof‐of‐concept using higher‐level APIs cannot be immediately demonstrated without significant computational resources.
Impact
An attacker with the ability to mount a collision attack on SHA-1 like the SHAttered or SHA-1 is a Shambles attacks could create two distinct Git objects with the same hash. This is becoming increasingly affordable for well‐resourced attackers, with the Shambles researchers in 2020 estimating $45k for a chosen‐prefix collision or $11k for a classical collision, and projecting less than $10k for a chosen‐prefix collision by 2025. The result could be used to disguise malicious repository contents, or potentially exploit assumptions in the logic of programs using gitoxide to cause further vulnerabilities.
This vulnerability affects any user of gitoxide, including
gix-*library crates, that reads or writes Git objects.Release Notes
GitoxideLabs/gitoxide (gix)
v0.71.0: gix v0.71.0Compare Source
Changed
debug_assertionsThis should hopefully not be a breaking change, as the same code
could produce the same behaviour if compiled with different flags,
and the semantic meaning of the resulting configuration should be
the same. But Hyrum’s law is always lurking…
Documentation
New Features
Repository::checkout_options().It's a low-level set of options to drive (quite unsafe) checkouts.
They are unsafe as they may be configured to overwrite, and are in no
way similar to
git checkout.Repository::head_tree_id_or_empty()for convenience.Repository::workdir_path()to easily obtain aPathfor worktree items.Repository::workdir()as replacement forRepository::work_dir().Keep the latter as deprecated though.
filter::Pipeline::worktree_file_to_object()now can addCommittype objects.filter::Pipeline::worktree_file_to_object().That way it's easier to correctly add whole files into the object
database.
repofields public for ease of use.That way, functions or methods taking such a type as argument
have access to the underlying repository so it doesn't need
to be passed as separate argument.
blob::platform::Resource::intern_source_strip_newline_separators()That way it will be easier to have typical Git-style patches diffs around
files that don't end with a newline.
Repository::big_file_threshold()to easily learn what Git considers a big file.Bug Fixes
Don't panic when rev-parsing
^^^and similarfilter::Pipeline::convert_to_git()now also works on Windows under all circumstances.assure
Repository::commit_as()also uses the committer for reflogsPreviously it would retrieve the configured committer, or trigger an error
if there was none despite the commiter being provided to
commit_as().This als adds
Repository::edit_references_as(committer)to allow passinga given committer.
Other
Repository::commit()now explains how to create a commit without ref updates.Changed (BREAKING)
The hashing API has moved to
gix_hash::hasher, and we now usesha1-checkedunconditionally.Bug Fixes (BREAKING)
with_pruned()is doing by renaming it towith_boundary().This is how it acts, and it's not at all the same as
hide()ingit2.Commit Statistics
Thanks Clippy
Clippy helped 1 time to make code idiomatic.
Commit Details
view details
Repository::commit_as()also uses the committer for reflogs (9bec947)^^^and similar (aa8daf8)ada5a94)b41312b)38dff41)4660f7a)gix_object::{try_ =>}compute_hashusers (3d7e379)fbf6cc8)fd12ef8)cd96b64)gix-features(5f8bff8)32b54b3)5cb5337)gix_fs::stack::ToNormalPathComponentseverywhere. (1f98edb)implreturns in traits. (569c186)bfa3253)filter::Pipeline::convert_to_git()now also works on Windows under all circumstances. (dcdb8ea)7b17da6),just before)on same line in function calls (66a5ae1)01bd76d)7255a5f)5a1b3d6)316f113)5e618b6)8b1b55c)configcorruption" (9061fc4)configcorruption (d290ad9)0bf1d5b)dc8bd63)GIT_AUTHOR_NAMEorGIT_COMMITTER_NAMEare set (94dda22)Repository::checkout_options(). (5054780)Repository::head_tree_id_or_empty()for convenience. (02878c9)Repository::workdir_path()to easily obtain aPathfor worktree items. (776f9be)Repository::workdir()as replacement forRepository::work_dir(). (518fbbc)10e41ee)cf7f34d)debug_assertions(9800e9c)16a248b)8e96ed3)b4fe425)Repository::commit()now explains how to create a commit without ref updates. (866affd)503098d)5c327bb)filter::Pipeline::worktree_file_to_object()now can addCommittype objects. (27e62d7)c042813)filter::Pipeline::worktree_file_to_object(). (70ebd5f)repofields public for ease of use. (23d2bed)914bf28)blob::platform::Resource::intern_source_strip_newline_separators()(37582b0)daa6d4a)with_pruned()is doing by renaming it towith_boundary(). (b78e7dd)79cb655)d7ddbb7)687322b)1a69c40)Repository::big_file_threshold()to easily learn what Git considers a big file. (f3257f3)8df0db2)Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.