From f0d041f947bd72908bb553592f9d3419a26b0881 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Fri, 18 Aug 2017 11:19:14 -0400 Subject: releasing package git-annex version 6.20170818 --- CHANGELOG | 14 +++++++------- git-annex.cabal | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 68e6b5cf5..0c0f5631f 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -1,12 +1,14 @@ -git-annex (6.20170521) UNRELEASED; urgency=medium +git-annex (6.20170818) unstable; urgency=high * Security fix: Disallow hostname starting with a dash, which would get passed to ssh and be treated an option. This could - be used by an attacker who provides a crafted ssh url to execute - arbitrary code via -oProxyCommand. + be used by an attacker who provides a crafted repository url + to cause the victim to execute arbitrary code via -oProxyCommand. (The same class of security hole recently affected git itself.) + * git-annex.cabal: Deal with breaking changes in Cabal 2.0. * Fix build with QuickCheck 2.10. * fsck: Support --json. + * move, copy: Support --batch. * Added GIT_ANNEX_VECTOR_CLOCK environment variable, which can be used to override the default timestamps used in log files in the git-annex branch. This is a dangerous environment variable; use with caution. @@ -15,11 +17,9 @@ git-annex (6.20170521) UNRELEASED; urgency=medium * test: Avoid most situations involving failure to delete test directories, by forking a worker process and only deleting the test directory once it exits. - * move, copy: Support --batch. * Disable http-client's default 30 second response timeout when HEADing an url to check if it exists. Some web servers take quite a long time to answer a HEAD request. - * Windows: Win32 package has subsumed Win32-extras; update dependency. * Added remote configuration settings annex-ignore-command and annex-sync-command, which are dynamic equivilants of the annex-ignore and annex-sync configurations. @@ -39,9 +39,9 @@ git-annex (6.20170521) UNRELEASED; urgency=medium * Fix the external special remotes git-annex-remote-ipfs, git-annex-remote-torrent and the example.sh template to correctly support filenames with spaces. - * git-annex.cabal: Deal with breaking changes in Cabal 2.0. + * Windows: Win32 package has subsumed Win32-extras; update dependency. - -- Joey Hess Sat, 17 Jun 2017 13:02:24 -0400 + -- Joey Hess Fri, 18 Aug 2017 11:19:06 -0400 git-annex (6.20170520) unstable; urgency=medium diff --git a/git-annex.cabal b/git-annex.cabal index 7f5047f7e..16b6bda27 100644 --- a/git-annex.cabal +++ b/git-annex.cabal @@ -1,5 +1,5 @@ Name: git-annex -Version: 6.20170520 +Version: 6.20170818 Cabal-Version: >= 1.8 License: GPL-3 Maintainer: Joey Hess -- cgit v1.2.3