Review: golang-github-go-git-go-git 5.19.2-1
Package Information
| Description | highly extensible Git implementation in pure Go (v5) go-git is a highly extensible git implementation library written in pure Go. It can be used to manipulate git repositories at low level (plumbing) or high level (porcelain), through an idiomatic Go API. It also supports several types of storage, such as in-memory filesystems, or custom implementations, thanks to the Storer interface. |
|---|---|
| Maintainer | Debian Go Packaging Team <team+pkg-go@tracker.debian.org> |
| Changed By | Reinhard Tartler <siretart@tauware.de> |
| Sponsor | siretart@debian.org |
| Distribution | unstable |
| Architecture | any all |
| VCS | git: https://salsa.debian.org/go-team/packages/golang-github-go-git-go-git.git (browse) |
| Closes | #1138090 |
| Popcon Installs | 40 |
| Binary NEW | Yes (binary-only upload) |
| Tracker | https://tracker.debian.org/pkg/golang-github-go-git-go-git |
| Uploaded | 4 hours ago |
New Package Report
.changes
| Distribution | unstable |
|---|---|
| Date | Mon, 21 Sep 2026 21:15:47 -0400 |
| Source | golang-github-go-git-go-git |
| Version | 5.19.2-1 |
| Changed-By | Reinhard Tartler |
| Architecture | all amd64 source |
Changelog
golang-github-go-git-go-git (5.19.2-1) unstable; urgency=medium
.
* Team upload.
* New upstream version 5.19.2. (Closes: #1143903)
- Fix path traversal in reference names (CVE-2026-71557).
- Restrict symlink resolution to worktree boundary (CVE-2026-71556).
* Rename binary package to golang-github-go-git-go-git-v5-dev and provide
transitional golang-github-go-git-go-git-dev package.
* debian/patches:
- Add 0004 and 0005 to fix FTBFS with Go 1.27 (Closes: #1146194).
- Add 0006 to serialize packfile fixture extraction (Closes: #1138090).
- Add 0007 to respect context cancellation in utils/ioutil (Closes: #1142868).
- Renumber existing patches with numeric prefixes..dsc
| Priority | optional |
|---|---|
| Component | main |
| Package-List | go-git deb golang optional arch=any golang-github-go-git-go-git-dev deb oldlibs optional arch=all golang-github-go-git-go-git-v5-dev deb golang optional arch=all |
| Section | golang |
debian/copyright
Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: go-git
Upstream-Contact: https://github.com/go-git/go-git/issues
Source: https://github.com/go-git/go-git
Files: *
Copyright: 2018 Sourced Technologies, S.L.
License: Apache-2.0
Files: debian/*
Copyright: 2021, Pirate Praveen <praveen@debian.org>
2025-2026 Simon Josefsson <simon@josefsson.org>
2026 Andrew Lee (李健秋) <ajqlee@debian.org>
License: Apache-2.0
Comment: Debian packaging is licensed under the same terms as upstream
Files: plumbing/format/gitignore/doc.go
Copyright: Oleg Sklyar, Silvertern and source{d}
License: Apache-2.0
License: Apache-2.0
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
.
http://www.apache.org/licenses/LICENSE-2.0
.
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Comment:
On Debian systems, the complete text of the Apache version 2.0 license
can be found in "/usr/share/common-licenses/Apache-2.0".
Review Information
accepted — allocated to awm 1 hour ago, started 1 hour ago, completed 0 hours ago.
Final Comment
Hi,
Please recognize Google copyright of oss-fuzz.sh in debian/copyright.
Thanks!
Public Notes
0 hours ago
● public
Missed Author Check
Command: dnq author-check -prepare
Exit code: 0
Author check: scanned 500 files.
NOT IN debian/copyright (1):
Google LLC
oss-fuzz.sh:2
Result: ATTENTION REQUIRED — 1 author not in debian/copyright