[pkgsrc/trunk]: pkgsrc/devel/libgit2 libgit2: update to 0.27.1.

[wiz <wiz%pkgsrc.org@localhost>]

details:   https://anonhg.NetBSD.org/pkgsrc/rev/cc4a28d2b12f
branches:  trunk
changeset: 308954:cc4a28d2b12f
user:      wiz <wiz%pkgsrc.org@localhost>
date:      Tue Jun 05 18:48:22 2018 +0000

description:
libgit2: update to 0.27.1.

v0.27.1
---------

This is a security release fixing insufficient validation of submodule names
(CVE-2018-11235, reported by Etienne Stalmans) and disallows `.gitmodules` files
as symlinks.

While submodule names come from the untrusted ".gitmodules" file, we blindly
append the name to "$GIT_DIR/modules" to construct the final path of the
submodule repository. In case the name contains e.g. "../", an adversary would
be able to escape your repository and write data at arbitrary paths. In
accordance with git, we now enforce some rules for submodule names which will
cause libgit2 to ignore these malicious names.

Adding a symlink as `.gitmodules` into the index from the workdir or checking
out such files is not allowed as this can make a Git implementation write
outside of the repository and bypass the `fsck` checks for CVE-2018-11235.

libgit2 is not susceptible to CVE-2018-11233.

diffstat:

 devel/libgit2/Makefile |   5 ++---
 devel/libgit2/distinfo |  10 +++++-----
 2 files changed, 7 insertions(+), 8 deletions(-)

diffs (28 lines):

diff -r 109c5d186ed0 -r cc4a28d2b12f devel/libgit2/Makefile
--- a/devel/libgit2/Makefile    Tue Jun 05 18:29:50 2018 +0000
+++ b/devel/libgit2/Makefile    Tue Jun 05 18:48:22 2018 +0000
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.25 2018/04/29 21:31:33 adam Exp $
+# $NetBSD: Makefile,v 1.26 2018/06/05 18:48:22 wiz Exp $
 
-DISTNAME=      libgit2-0.27.0
-PKGREVISION=   1
+DISTNAME=      libgit2-0.27.1
 CATEGORIES=    devel
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libgit2/}
 GITHUB_TAG=    v${PKGVERSION_NOREV}
diff -r 109c5d186ed0 -r cc4a28d2b12f devel/libgit2/distinfo
--- a/devel/libgit2/distinfo    Tue Jun 05 18:29:50 2018 +0000
+++ b/devel/libgit2/distinfo    Tue Jun 05 18:48:22 2018 +0000
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.11 2018/04/17 10:50:24 wiz Exp $
+$NetBSD: distinfo,v 1.12 2018/06/05 18:48:22 wiz Exp $
 
-SHA1 (libgit2-0.27.0.tar.gz) = a545ed6d67833b4dbcce32db7a7d757b14165493
-RMD160 (libgit2-0.27.0.tar.gz) = 2b9a8fb2e00dceb8c764d84a70898e4dd745a8f0
-SHA512 (libgit2-0.27.0.tar.gz) = 1304f0b6182e1e6e7fccbec1a568aefb662e144a1aea4fff5901f3c012ff0f3d28720f17d19b9a1bc6c892c32fe602766fe98a15538a94a468d65d3e4a1680ca
-Size (libgit2-0.27.0.tar.gz) = 4761312 bytes
+SHA1 (libgit2-0.27.1.tar.gz) = 2ce74b2dcec76ee0467a26c0cda8153bd29a2ad4
+RMD160 (libgit2-0.27.1.tar.gz) = 46dd959617292cebdbcb031ef49f62acd6e5e62f
+SHA512 (libgit2-0.27.1.tar.gz) = 4cdee4aec0f0c7b36226ee29276b8802d6b59817f95b1357f35225c23a8d6de70242b2dd9a5fb3b765c3242f4ed1848933e20fc24899071d8b443d46c43ce99d
+Size (libgit2-0.27.1.tar.gz) = 4765926 bytes