git-sync

Mostly a baseimage CVE update

What's Changed

• V3: Allow quoted keys for --git-config by @thockin in https://github.com/kubernetes/git-sync/pull/642

Available at: registry.k8s.io/git-sync/git-sync:v3.6.2

Full Changelog: https://github.com/kubernetes/git-sync/compare/v3.6.1...v3.6.2

What's Changed

• Bump base image to 1.4.2 by @thockin in https://github.com/kubernetes/git-sync/pull/623

Full Changelog: https://github.com/kubernetes/git-sync/compare/v3.6.0...v3.6.1

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.6.1

NOTE: 3.6.x is probably the final minor series of 3.x, with future focus on bugfixes and security issues only. Further efforts will shift to 4.x, which has several breaking changes (mostly flags) but is cleaner overall.

What's Changed

• v3: log.V(9) md5sums of credentials by @thockin in https://github.com/kubernetes/git-sync/pull/581
  • This might help debug unreproduceable issues with credentials
• v3: Change from "store" to "cache" for credentials by @thockin in https://github.com/kubernetes/git-sync/pull/583
  • This is a security improvement and should help with some unreproduceable issues with credentials
• v3: Don't set known_hosts to /dev/null by @thockin in https://github.com/kubernetes/git-sync/pull/585
  • This cleans up log-spam

Full Changelog: https://github.com/kubernetes/git-sync/compare/v3.5.1...v3.6.0

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.6.0

What's Changed

• TrimSpace exec's stdout/stderr for log (v3) by @thockin in https://github.com/kubernetes/git-sync/pull/510
• Pass the whole environment to exechooks (v3 branch) by @thockin in https://github.com/kubernetes/git-sync/pull/515
• v3: Clean up fail-count logging by @thockin in https://github.com/kubernetes/git-sync/pull/548
• upgrade base image to address vulnerabilities by @thockin in https://github.com/kubernetes/git-sync/pull/558
• v3: Bump build image to go 1.18 by @thockin in https://github.com/kubernetes/git-sync/pull/559
• v3: Bump go.mod to 1.18 by @thockin in https://github.com/kubernetes/git-sync/pull/561
• Fix CVE-2022-2068 by @Liujingfang1 in https://github.com/kubernetes/git-sync/pull/589

Full Changelog: https://github.com/kubernetes/git-sync/compare/v3.5.0...v3.5.1

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.5.1

What's Changed

• Bump to go 1.17 by @thockin in https://github.com/kubernetes/git-sync/pull/483
• Set $GITSYNC_HASH in exechook (v3) by @thockin in https://github.com/kubernetes/git-sync/pull/490
• Set repoReady even when there wasn't a 1st clone (v3 branch) by @thockin in https://github.com/kubernetes/git-sync/pull/493
• Add GC controls, e2e regexes (v3 branch) by @thockin in https://github.com/kubernetes/git-sync/pull/495
• Support repo change between invocations by @sed-i in https://github.com/kubernetes/git-sync/pull/499
• update the base image to fix vulnerabilities by @Liujingfang1 in https://github.com/kubernetes/git-sync/pull/502

New Contributors

• @sed-i made their first contribution in https://github.com/kubernetes/git-sync/pull/499
• @Liujingfang1 made their first contribution in https://github.com/kubernetes/git-sync/pull/502

Full Changelog: https://github.com/kubernetes/git-sync/compare/v3.4.0...v3.5.0

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.5.0

What's Changed

• Avoid writing to /etc/passwd unless needed by @mac-chaffee in https://github.com/kubernetes/git-sync/pull/461
• Expose the ssh diagnostic message by @nan-yu in https://github.com/kubernetes/git-sync/pull/464
• Ensure web/exec hooks complete in --one-time by @thockin in https://github.com/kubernetes/git-sync/pull/469 and @ChrisERo in https://github.com/kubernetes/git-sync/pull/466
• Don't try to remove the root if it appears corrupt by @thockin in https://github.com/kubernetes/git-sync/pull/473
• Don't double-register the hook metric by @thockin in https://github.com/kubernetes/git-sync/pull/475
• Allow --dest to be an absolute path by @thockin in https://github.com/kubernetes/git-sync/pull/477

New Contributors

• @mac-chaffee made their first contribution in https://github.com/kubernetes/git-sync/pull/461
• @ChrisERo made their first contribution in https://github.com/kubernetes/git-sync/pull/466 (on the v4 branch, ported to v3 in https://github.com/kubernetes/git-sync/pull/469)

Full Changelog: https://github.com/kubernetes/git-sync/compare/v3.3.5...v3.4.0

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.4.0

This is a minor release. It includes the following changes and also picks up the latest base image, which addresses some vulnerabilities.

• Flag --sync-hook-command ($GIT_SYNC_HOOK_COMMAND) is deprecated (but still works). Use --exechook-command ($GIT_SYNC_EXECHOOK_COMMAND) instead (functionally identical). This adds flags --exechook-timeout ($GIT_SYNC_EXECHOOK_TIMEOUT) and --exechook-backoff ($GIT_SYNC_EXECHOOK_BACKOFF) to parallel webhooks.
• Fix a bug that can mis-attribute callers in log-lines.
• Create git worktrees using the specific SHA rather than branch name. This allows to change branches with persistent volumes. Otherwise should be functionally identical.
• Add flag password-file ($GIT_SYNC_PASSWORD_FILE), which reads the password from a file and this is considered as safer than reading from env or flag directly.
  • --password and --password-file can't be specified at the same time.
  • If --username is specified, then one of --password or --password-file must be specified.

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.3.5

This is a security release. It picks up the latest base image, which addresses:

• https://nvd.nist.gov/vuln/detail/CVE-2021-20231

• https://nvd.nist.gov/vuln/detail/CVE-2021-20232

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.3.4

This is a minor release.

• Fix a race between ls-remote and fetch that could crash
• Clean up worktrees in case of corruption

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.3.3

This is a bugfix release. There is a known bug in libcurl that made HTTPS basically not work. This release changes how git is included so only the most backport of git is installed, and not the backport of libcurl.

See https://superuser.com/questions/1642858/git-throws-fatal-unable-to-access-https-github-com-user-repo-git-failed-se for some more information

Other changes:

• Container image is now just 1 layer
• Make the --error-file world-readable (for use across container boundaries)

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.3.2

EDIT: This release is broken for HTTPS.

This release is fairly small:

• Create the git-root directory if it does not exist and we need to write to the error file.

• Add sparse-checkout support via a new --sparse-checkout-file flag ($GIT_SYNC_SPARSE_CHECKOUT_FILE). (https://github.com/kubernetes/git-sync/commit/07e552b5060351364595f064d273556a9bc34f75)

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.3.1

This release includes several noteworthy changes:

• Explicitly set GIT_SYNC_ROOT=/tmp/git in the container image so it is easier to use as non-root with a volume.

• Update Go to 1.15 and debian-base image to buster-v1.4.0

• Add a --git-config flag for arbitrary git settings (https://github.com/kubernetes/git-sync/commit/45bba183ca89d315e8fc2672128b2d4c966042f0 for more info)

• Use a newer git version (from debian backports)

• Change the symlink target to just the SHA. This allows users to call readlink() on the link and learn the current checked out SHA.

• Fix cases of exit(0) when errors occurred and running as pid1 inside a container.

• Copy all license files for all deps into the container image at /LICENSES/

• Move the exec-hook to AFTER the symlink flip.

• Add a a --error-file flag to export runtime errors. This is useful to be able to inspect the status when running as a sidecar container. (https://github.com/kubernetes/git-sync/commit/8ea449292bd570a2a290ef099dd589e15ad5f40b)

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.3.0

This is a minor release.

• Add support for octal values to int env vars (specifically GIT_SYNC_PERMISSIONS)

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.2.2

This is a minor release.

• Add a --sync-hook-command flag ($GIT_SYNC_HOOK_COMMAND) which is executed after syncing a new hash of the remote repository

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.2.1

This is a minor release, except that it makes 1 potentially significant change in behavior.

The --wait flag (aka GIT_SYNC_WAIT) used to default to 0, meaning "immediately". It is now defaulting to 1 second. This should somewhat mitigate users who don't set it and pound their git-servers.

In v4.x I will propose to make it longer by default.

Available for all supported platforms at k8s.gcr.io/git-sync/git-sync:v3.2.0

• Add a metric for askpass calls
• Fix multi-arch builds, so they actually work
• Add socat to the image so users can set up proxying
• Better flag input checking
• Better logs and error messages
• Add --submodules flag with option to NOT recursively clone submodules

Available at k8s.gcr.io/git-sync/git-sync:v3.1.7
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Note the new image pull path includes a "sub-dir" which is different than previous releases!

Fix bugs that would race on wait(), causing occasional errors or panics.

Fix bug with signals that come in and caused us to miss SIGCHLD.

Fix bugs which mixed stderr with stdout, causing problems with some git configurations that issue warnings.

Move to go 1.14

Available at k8s.gcr.io/git-sync:v3.1.6

• Bump debian to buster (fixes a bunch of CVEs)

• Make health-checking report true only after git has synced once.

Available at k8s.gcr.io/git-sync:v3.1.5

• Better logging of commands we run

• Add --askpass-url flag to get username/password from a URL (e.g. http://metadata)

• Add --add-user flag to tell git-sync to write the current UID/GID to /etc/passwd. This enables git-over-SSH as an arbitrary UID.

• Change git credential from cache to store.

Available at k8s.gcr.io/git-sync:v3.1.4

• Added submodules support. Repos which have submodules will have those submodules synced automatically. The --depth flag applies to submodules as well as the main repo.

• Send the git hash of the sync to webhooks in the "Gitsync-Hash" HTTP header.

• Handle being run as pid 1 by catching SIGCHLD and forwarding other signals. This should eliminate zombie processes when running in docker containers or Kubernetes pods.

• Build with Go 1.13

Available at k8s.gcr.io/git-sync:v3.1.3