GitPython 3.1.56__tar.gz → 3.1.57__tar.gz

{gitpython-3.1.56 → gitpython-3.1.57/GitPython.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GitPython
-Version: 3.1.56
+Version: 3.1.57
 Summary: GitPython is a Python library used to interact with Git repositories
 Home-page: https://github.com/gitpython-developers/GitPython
 Author: Sebastian Thiel, Michael Trier
@@ -33,6 +33,7 @@ Requires-Dist: gitdb<5,>=4.0.1
 Requires-Dist: typing-extensions>=3.10.0.2; python_version < "3.10"
 Provides-Extra: test
 Requires-Dist: coverage[toml]; extra == "test"
+Requires-Dist: basedpyright==1.39.9; (python_version >= "3.9" and sys_platform != "cygwin") and extra == "test"
 Requires-Dist: ddt!=1.4.3,>=1.1.1; extra == "test"
 Requires-Dist: mock; python_version < "3.8" and extra == "test"
 Requires-Dist: mypy==1.18.2; python_version >= "3.9" and extra == "test"
@@ -163,15 +164,13 @@ In the less common case that you do not want to install test dependencies, `pip
 
 #### With editable *dependencies* (not preferred, and rarely needed)
 
-In rare cases, you may want to work on GitPython and one or both of its [gitdb](https://github.com/gitpython-developers/gitdb) and [smmap](https://github.com/gitpython-developers/smmap) dependencies at the same time, with changes in your local working copy of gitdb or smmap immediately reflected in the behavior of your local working copy of GitPython. This can be done by making editable installations of those dependencies in the same virtual environment where you install GitPython.
-
-If you want to do that *and* you want the versions in GitPython's git submodules to be used, then pass `-e git/ext/gitdb` and/or `-e git/ext/gitdb/gitdb/ext/smmap` to `pip install`. This can be done in any order, and in separate `pip install` commands or the same one, so long as `-e` appears before *each* path. For example, you can install GitPython, gitdb, and smmap editably in the currently active virtual environment this way:
+GitPython, [gitdb](gitdb), and [smmap](smmap) live in this repository as independently packaged projects. To work on all three at once, install each one editably in the same virtual environment:
 
 ```sh
-pip install -e ".[test]" -e git/ext/gitdb -e git/ext/gitdb/gitdb/ext/smmap
+pip install -e smmap -e gitdb -e ".[test]"
 ```
 
-The submodules must have been cloned for that to work, but that will already be the case if you have run `./init-tests-after-clone.sh`. You can use `pip list` to check which packages are installed editably and which are installed normally.
+You can use `pip list` to check which packages are installed editably and which are installed normally.
 
 To reiterate, this approach should only rarely be used. For most development it is preferable to allow the gitdb and smmap dependencices to be retrieved automatically from PyPI in their latest stable packaged versions.
 

{gitpython-3.1.56 → gitpython-3.1.57}/GitPython.egg-info/requires.txt

@@ -26,3 +26,6 @@ mock
 
 [test:python_version >= "3.9"]
 mypy==1.18.2
+
+[test:python_version >= "3.9" and sys_platform != "cygwin"]
+basedpyright==1.39.9

{gitpython-3.1.56/GitPython.egg-info → gitpython-3.1.57}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: GitPython
-Version: 3.1.56
+Version: 3.1.57
 Summary: GitPython is a Python library used to interact with Git repositories
 Home-page: https://github.com/gitpython-developers/GitPython
 Author: Sebastian Thiel, Michael Trier
@@ -33,6 +33,7 @@ Requires-Dist: gitdb<5,>=4.0.1
 Requires-Dist: typing-extensions>=3.10.0.2; python_version < "3.10"
 Provides-Extra: test
 Requires-Dist: coverage[toml]; extra == "test"
+Requires-Dist: basedpyright==1.39.9; (python_version >= "3.9" and sys_platform != "cygwin") and extra == "test"
 Requires-Dist: ddt!=1.4.3,>=1.1.1; extra == "test"
 Requires-Dist: mock; python_version < "3.8" and extra == "test"
 Requires-Dist: mypy==1.18.2; python_version >= "3.9" and extra == "test"
@@ -163,15 +164,13 @@ In the less common case that you do not want to install test dependencies, `pip
 
 #### With editable *dependencies* (not preferred, and rarely needed)
 
-In rare cases, you may want to work on GitPython and one or both of its [gitdb](https://github.com/gitpython-developers/gitdb) and [smmap](https://github.com/gitpython-developers/smmap) dependencies at the same time, with changes in your local working copy of gitdb or smmap immediately reflected in the behavior of your local working copy of GitPython. This can be done by making editable installations of those dependencies in the same virtual environment where you install GitPython.
-
-If you want to do that *and* you want the versions in GitPython's git submodules to be used, then pass `-e git/ext/gitdb` and/or `-e git/ext/gitdb/gitdb/ext/smmap` to `pip install`. This can be done in any order, and in separate `pip install` commands or the same one, so long as `-e` appears before *each* path. For example, you can install GitPython, gitdb, and smmap editably in the currently active virtual environment this way:
+GitPython, [gitdb](gitdb), and [smmap](smmap) live in this repository as independently packaged projects. To work on all three at once, install each one editably in the same virtual environment:
 
 ```sh
-pip install -e ".[test]" -e git/ext/gitdb -e git/ext/gitdb/gitdb/ext/smmap
+pip install -e smmap -e gitdb -e ".[test]"
 ```
 
-The submodules must have been cloned for that to work, but that will already be the case if you have run `./init-tests-after-clone.sh`. You can use `pip list` to check which packages are installed editably and which are installed normally.
+You can use `pip list` to check which packages are installed editably and which are installed normally.
 
 To reiterate, this approach should only rarely be used. For most development it is preferable to allow the gitdb and smmap dependencices to be retrieved automatically from PyPI in their latest stable packaged versions.
 

{gitpython-3.1.56 → gitpython-3.1.57}/README.md

@@ -101,15 +101,13 @@ In the less common case that you do not want to install test dependencies, `pip
 
 #### With editable *dependencies* (not preferred, and rarely needed)
 
-In rare cases, you may want to work on GitPython and one or both of its [gitdb](https://github.com/gitpython-developers/gitdb) and [smmap](https://github.com/gitpython-developers/smmap) dependencies at the same time, with changes in your local working copy of gitdb or smmap immediately reflected in the behavior of your local working copy of GitPython. This can be done by making editable installations of those dependencies in the same virtual environment where you install GitPython.
-
-If you want to do that *and* you want the versions in GitPython's git submodules to be used, then pass `-e git/ext/gitdb` and/or `-e git/ext/gitdb/gitdb/ext/smmap` to `pip install`. This can be done in any order, and in separate `pip install` commands or the same one, so long as `-e` appears before *each* path. For example, you can install GitPython, gitdb, and smmap editably in the currently active virtual environment this way:
+GitPython, [gitdb](gitdb), and [smmap](smmap) live in this repository as independently packaged projects. To work on all three at once, install each one editably in the same virtual environment:
 
 ```sh
-pip install -e ".[test]" -e git/ext/gitdb -e git/ext/gitdb/gitdb/ext/smmap
+pip install -e smmap -e gitdb -e ".[test]"
 ```
 
-The submodules must have been cloned for that to work, but that will already be the case if you have run `./init-tests-after-clone.sh`. You can use `pip list` to check which packages are installed editably and which are installed normally.
+You can use `pip list` to check which packages are installed editably and which are installed normally.
 
 To reiterate, this approach should only rarely be used. For most development it is preferable to allow the gitdb and smmap dependencices to be retrieved automatically from PyPI in their latest stable packaged versions.
 

gitpython-3.1.57/VERSION

@@ -0,0 +1 @@
+3.1.57

{gitpython-3.1.56 → gitpython-3.1.57}/doc/source/changes.rst

@@ -2,6 +2,20 @@
 Changelog
 =========
 
+3.1.57
+======
+
+A security fix for
+
+* https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3f7w-8rr8-f37f
+* https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-539m-9xh6-q6rr
+
+If you can, also try and provide feedback on the upcoming v4 branch
+https://github.com/gitpython-developers/GitPython/pull/2177 - patches welcome.
+
+See the following for all changes.
+https://github.com/gitpython-developers/GitPython/releases/tag/3.1.55
+
 3.1.56
 ======
 

{gitpython-3.1.56 → gitpython-3.1.57}/doc/source/intro.rst

@@ -97,11 +97,6 @@ and cloned using::
 
 	$ git clone https://github.com/gitpython-developers/GitPython git-python
 
-Initialize all submodules to obtain the required dependencies with::
-
-    $ cd git-python
-    $ git submodule update --init --recursive
-
 Finally verify the installation by running unit tests::
 
     $ python -m unittest

{gitpython-3.1.56 → gitpython-3.1.57}/doc/source/reference.rst

@@ -91,6 +91,7 @@ Objects.Util
 .. automodule:: git.objects.util
    :members:
    :undoc-members:
+   :private-members: _get_intermediate_items, _list_traverse, _traverse
    :special-members:
 
 Index.Base

{gitpython-3.1.56 → gitpython-3.1.57}/git/__init__.py

@@ -86,7 +86,7 @@ __all__ = [
     "to_hex_sha",
 ]
 
-__version__ = '3.1.56'
+__version__ = '3.1.57'
 
 from typing import Any, List, Optional, Sequence, TYPE_CHECKING, Tuple, Union
 

{gitpython-3.1.56 → gitpython-3.1.57}/git/cmd.py

@@ -1435,6 +1435,10 @@ class Git(metaclass=_GitMeta):
         if as_process:
             return self.AutoInterrupt(proc, command)
 
+        watchdog: Optional[threading.Timer] = None
+        kill_check: Optional[threading.Event] = None
+        timeout_error: Optional[Callable[[], Union[str, bytes]]] = None
+
         if sys.platform != "win32" and kill_after_timeout is not None:
             # Help mypy figure out this is not None even when used inside communicate().
             timeout = kill_after_timeout
@@ -1460,6 +1464,7 @@ class Git(metaclass=_GitMeta):
                         except OSError:
                             pass
                     # Tell the main routine that the process was killed.
+                    assert kill_check is not None
                     kill_check.set()
                 except OSError:
                     # It is possible that the process gets completed in the duration
@@ -1467,23 +1472,25 @@ class Git(metaclass=_GitMeta):
                     pass
                 return
 
+            def make_timeout_error() -> Union[str, bytes]:
+                err = f'Timeout: the command "{" ".join(redacted_command)}" did not complete in {timeout:g} secs.'
+                return err if universal_newlines else err.encode(defenc)
+
             def communicate() -> Tuple[AnyStr, AnyStr]:
+                assert watchdog is not None
+                assert kill_check is not None
                 watchdog.start()
                 out, err = proc.communicate()
                 watchdog.cancel()
                 if kill_check.is_set():
-                    err = 'Timeout: the command "%s" did not complete in %d secs.' % (
-                        " ".join(redacted_command),
-                        timeout,
-                    )
-                    if not universal_newlines:
-                        err = err.encode(defenc)
+                    err = make_timeout_error()
                 return out, err
 
             # END helpers
 
             kill_check = threading.Event()
             watchdog = threading.Timer(timeout, kill_process, args=(proc.pid,))
+            timeout_error = make_timeout_error
         else:
             communicate = proc.communicate
 
@@ -1504,15 +1511,24 @@ class Git(metaclass=_GitMeta):
                 status = proc.returncode
             else:
                 max_chunk_size = max_chunk_size if max_chunk_size and max_chunk_size > 0 else io.DEFAULT_BUFFER_SIZE
-                if proc.stdout is not None:
-                    stream_copy(proc.stdout, output_stream, max_chunk_size)
-                    stdout_value = proc.stdout.read()
-                if proc.stderr is not None:
-                    stderr_value = proc.stderr.read()
+                if watchdog is not None:
+                    watchdog.start()
+                try:
+                    if proc.stdout is not None:
+                        stream_copy(proc.stdout, output_stream, max_chunk_size)
+                        stdout_value = proc.stdout.read()
+                    if proc.stderr is not None:
+                        stderr_value = proc.stderr.read()
+                    status = proc.wait()
+                finally:
+                    if watchdog is not None:
+                        watchdog.cancel()
                 # Strip trailing "\n".
                 if stderr_value is not None and stderr_value.endswith(newline):  # type: ignore[arg-type]
                     stderr_value = stderr_value[:-1]
-                status = proc.wait()
+                if kill_check is not None and kill_check.is_set():
+                    assert timeout_error is not None
+                    stderr_value = timeout_error()
             # END stdout handling
         finally:
             if proc.stdout is not None:

{gitpython-3.1.56 → gitpython-3.1.57}/git/diff.py

@@ -284,7 +284,10 @@ class Diffable:
         # END paths handling
 
         kwargs["as_process"] = True
-        proc = diff_cmd(*self._process_diff_args(args), **kwargs)
+        args = self._process_diff_args(args)
+        if create_patch:
+            self.repo.git(c="diff.mnemonicPrefix=false")
+        proc = diff_cmd(*args, **kwargs)
 
         diff_method = Diff._index_from_patch_format if create_patch else Diff._index_from_raw_format
         index = diff_method(self.repo, proc)

{gitpython-3.1.56 → gitpython-3.1.57}/git/index/base.py

@@ -130,6 +130,8 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
     index directly before operating on it using the git command.
     """
 
+    unsafe_git_checkout_index_options = ["--prefix"]
+
     __slots__ = ("repo", "version", "entries", "_extension_data", "_file_path")
 
     _VERSION = 2
@@ -1212,6 +1214,7 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
         paths: Union[None, Iterable[PathLike]] = None,
         force: bool = False,
         fprogress: Callable = lambda *args: None,
+        allow_unsafe_options: bool = False,
         **kwargs: Any,
     ) -> Union[None, Iterator[PathLike], Sequence[PathLike]]:
         """Check out the given paths or all files from the version known to the index
@@ -1238,6 +1241,9 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
             no explicit paths are given. Otherwise progress information will be send
             prior and after a file has been checked out.
 
+        :param allow_unsafe_options:
+            Allow unsafe options, such as ``--prefix``.
+
         :param kwargs:
             Additional arguments to be passed to :manpage:`git-checkout-index(1)`.
 
@@ -1261,6 +1267,12 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
             i.e. if you want :manpage:`git-checkout(1)`-like behaviour, use
             ``head.checkout`` instead of ``index.checkout``.
         """
+        if not allow_unsafe_options:
+            Git.check_unsafe_options(
+                options=Git._option_candidates([], kwargs),
+                unsafe_options=self.unsafe_git_checkout_index_options,
+            )
+
         args = ["--index"]
         if force:
             args.append("--force")
@@ -1547,6 +1559,8 @@ class IndexFile(LazyMixin, git_diff.Diffable, Serializable):
                 args.extend(paths)
 
             kwargs["as_process"] = True
+            if create_patch:
+                self.repo.git(c="diff.mnemonicPrefix=false")
             proc = self.repo.git.diff(*args, **kwargs)
 
             diff_method = (

{gitpython-3.1.56 → gitpython-3.1.57}/git/objects/fun.py

@@ -115,11 +115,11 @@ def tree_entries_from_data(data: bytes) -> List[EntryTup]:
         # Default encoding for strings in git is UTF-8.
         # Only use the respective unicode object if the byte stream was encoded.
         name_bytes = data[ns:i]
-        name = safe_decode(name_bytes)
+        name = safe_decode(bytes(name_bytes))
 
         # Byte is NULL, get next 20.
         i += 1
-        sha = data[i : i + 20]
+        sha = bytes(data[i : i + 20])
         i = i + 20
         out.append((sha, mode, name))
     # END for each byte in data stream

{gitpython-3.1.56 → gitpython-3.1.57}/git/refs/tag.py

@@ -16,6 +16,7 @@ from .reference import Reference
 
 from typing import Any, TYPE_CHECKING, Type, Union
 
+from git.cmd import Git
 from git.types import AnyGitObject, PathLike
 
 if TYPE_CHECKING:
@@ -42,6 +43,8 @@ class TagReference(Reference):
 
     __slots__ = ()
 
+    unsafe_git_tag_options = ["--file", "-F"]
+
     _common_default = "tags"
     _common_path_default = Reference._common_path_default + "/" + _common_default
 
@@ -92,6 +95,7 @@ class TagReference(Reference):
         reference: Union[str, "SymbolicReference"] = "HEAD",
         logmsg: Union[str, None] = None,
         force: bool = False,
+        allow_unsafe_options: bool = False,
         **kwargs: Any,
     ) -> "TagReference":
         """Create a new tag reference.
@@ -121,12 +125,21 @@ class TagReference(Reference):
         :param force:
             If ``True``, force creation of a tag even though that tag already exists.
 
+        :param allow_unsafe_options:
+            Allow unsafe options, such as ``--file``.
+
         :param kwargs:
             Additional keyword arguments to be passed to :manpage:`git-tag(1)`.
 
         :return:
             A new :class:`TagReference`.
         """
+        if not allow_unsafe_options:
+            Git.check_unsafe_options(
+                options=Git._option_candidates([], kwargs),
+                unsafe_options=cls.unsafe_git_tag_options,
+            )
+
         if "ref" in kwargs and kwargs["ref"]:
             reference = kwargs["ref"]
 

{gitpython-3.1.56 → gitpython-3.1.57}/git/repo/base.py

@@ -151,8 +151,10 @@ class Repo:
         "-c",
         # Can install hooks that execute during clone:
         "--template",
+        # Fetches from an additional caller-controlled URI:
+        "--bundle-uri",
     ]
-    """Options to :manpage:`git-clone(1)` that allow arbitrary commands to be executed.
+    """Options to :manpage:`git-clone(1)` that permit unsafe command execution or I/O.
 
     The ``--upload-pack``/``-u`` option allows users to execute arbitrary commands
     directly:
@@ -164,6 +166,11 @@ class Repo:
 
     The ``--template`` option can install hooks that execute during clone:
     https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---templatetemplate-directory
+
+    The ``--bundle-uri`` option fetches from an additional URI before fetching from the
+    clone URL. An untrusted value can therefore make Git access local files or
+    unintended network resources:
+    https://git-scm.com/docs/git-clone#Documentation/git-clone.txt---bundle-uriuri
     """
 
     unsafe_git_archive_options = [
@@ -172,6 +179,10 @@ class Repo:
         # Writes output to a caller-controlled filesystem path.
         "--output",
         "-o",
+        # Reads from a caller-controlled filesystem path:
+        "--add-file",
+        # Injects a caller-controlled path and contents:
+        "--add-virtual-file",
     ]
 
     unsafe_git_revision_options = [

{gitpython-3.1.56 → gitpython-3.1.57}/git/util.py

@@ -540,8 +540,7 @@ def expand_path(p: Union[None, PathLike], expand_vars: bool = True) -> Optional[
 
 
 def remove_password_if_present(cmdline: Sequence[str]) -> List[str]:
-    """Parse any command line argument and if one of the elements is an URL with a
-    username and/or password, replace them by stars (in-place).
+    """Redact credentials in URLs and HTTP Authorization extra headers in a command line.
 
     If nothing is found, this just returns the command line as-is.
 
@@ -551,6 +550,16 @@ def remove_password_if_present(cmdline: Sequence[str]) -> List[str]:
     new_cmdline = []
     for index, to_parse in enumerate(cmdline):
         new_cmdline.append(to_parse)
+        config_key, separator, header = to_parse.partition("=")
+        header_name, colon, _ = header.partition(":")
+        if (
+            separator
+            and colon
+            and config_key.lower().endswith(".extraheader")
+            and header_name.strip().lower() == "authorization"
+        ):
+            new_cmdline[index] = "%s%s%s%s *****" % (config_key, separator, header_name, colon)
+            continue
         try:
             url = urlsplit(to_parse)
             # Remove password from the URL if present.
@@ -611,13 +620,17 @@ class RemoteProgress:
         self.error_lines: List[str] = []
         self.other_lines: List[str] = []
 
-    def _parse_progress_line(self, line: AnyStr) -> None:
+    def _parse_progress_line(self, line: AnyStr) -> Optional[object]:
         """Parse progress information from the given line as retrieved by
         :manpage:`git-push(1)` or :manpage:`git-fetch(1)`.
 
         - Lines that do not contain progress info are stored in :attr:`other_lines`.
         - Lines that seem to contain an error (i.e. start with ``error:`` or ``fatal:``)
           are stored in :attr:`error_lines`.
+
+        The base implementation returns ``None``. Subclasses may return another
+        value for compatibility with existing overrides, but callers should treat
+        the return value as unspecified.
         """
         # handle
         # Counting objects: 4, done.
@@ -632,7 +645,7 @@ class RemoteProgress:
 
         if self._cur_line.startswith(("error:", "fatal:")):
             self.error_lines.append(self._cur_line)
-            return
+            return None
 
         cur_count, max_count = None, None
         match = self.re_op_relative.match(line_str)
@@ -642,7 +655,7 @@ class RemoteProgress:
         if not match:
             self.line_dropped(line_str)
             self.other_lines.append(line_str)
-            return
+            return None
         # END could not get match
 
         op_code = 0
@@ -673,7 +686,7 @@ class RemoteProgress:
             self.line_dropped(line_str)
             # Note: Don't add this line to the other lines, as we have to silently
             # drop it.
-            return
+            return None
         # END handle op code
 
         # Figure out stage.
@@ -699,6 +712,7 @@ class RemoteProgress:
             max_count and float(max_count),
             message,
         )
+        return None
 
     def new_message_handler(self) -> Callable[[str], None]:
         """
@@ -708,7 +722,7 @@ class RemoteProgress:
         """
 
         def handler(line: AnyStr) -> None:
-            return self._parse_progress_line(line.rstrip())
+            self._parse_progress_line(line.rstrip())
 
         # END handler
 

{gitpython-3.1.56 → gitpython-3.1.57}/pyproject.toml

@@ -28,20 +28,26 @@ warn_unreachable = true
 implicit_reexport = true
 # strict = true
 # TODO: Remove when 'gitdb' is fully annotated.
-exclude = ["^git/ext/gitdb"]
+exclude = ["^(gitdb|smmap)/"]
 [[tool.mypy.overrides]]
-module = "gitdb.*"
+module = ["gitdb", "gitdb.*"]
+follow_imports = "skip"
 ignore_missing_imports = true
 
 [tool.basedpyright]
 typeCheckingMode = "standard"
 pythonVersion = "3.7"
+include = [
+    "git",
+    "test/deprecation",
+]
 extraPaths = [
-    "git/ext/gitdb",
-    "git/ext/gitdb/gitdb/ext/smmap",
+    "gitdb",
+    "smmap",
 ]
 exclude = [
-    "git/ext/gitdb",
+    "gitdb",
+    "smmap",
 ]
 
 [tool.coverage.run]
@@ -57,6 +63,8 @@ line-length = 120
 # Exclude a variety of commonly ignored directories.
 exclude = [
     "git/ext/",
+    "gitdb/",
+    "smmap/",
     "build",
     "dist",
 ]

{gitpython-3.1.56 → gitpython-3.1.57}/setup.py

@@ -71,7 +71,7 @@ setup(
     author_email="byronimo@gmail.com, mtrier@gmail.com",
     license="BSD-3-Clause",
     url="https://github.com/gitpython-developers/GitPython",
-    packages=find_packages(exclude=["test", "test.*"]),
+    packages=find_packages(include=["git", "git.*"]),
     include_package_data=True,
     package_dir={"git": "git"},
     python_requires=">=3.7",

{gitpython-3.1.56 → gitpython-3.1.57}/test-requirements.txt

@@ -1,4 +1,5 @@
 coverage[toml]
+basedpyright==1.39.9 ; python_version >= "3.9" and sys_platform != "cygwin"
 ddt >= 1.1.1, != 1.4.3
 mock ; python_version < "3.8"
 mypy==1.18.2 ; python_version >= "3.9" # pin mypy version to avoid new errors

gitpython-3.1.56/VERSION

@@ -1 +0,0 @@
-3.1.56