Do not require Git 2.7.3

Due to numerous vulnerabilities in previous git versions, the minimum required git version was increased from 1.7.10 to 2.7.3: 7ae573c7.

Although requiring a git version free of known security holes is commendable, requiring the latest version is probably not the best way to do so, since neither Debian 7, Debian 8 nor Ubuntu 14.04 have git 2.7.3 (or later) in their repositories. Nevertheless, all of them have fixed the recent vulnerabilities.

Debian has backported these fixes

• to git 2.1.4 for jessie (v2.1.4-2.1+deb8u2)
• to git 1.7.10.4 for wheezy (v1.7.10.4-1+wheezy3).

Ubuntu has backported these fixes to git 1.9.1 (v1.9.1-1ubuntu0.3).

Also git releases v2.6.6, v2.5.5 and v2.4.11 contain these fixes as well. So these (and higher) versions should be accepted as well.

I suggest to revert the version requirement to 1.7.10 (which is probably there for technical/feature reasons) and find another way to ensure that users don't have a vulnerable git version installed.

see also https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/3240#note_4409226

Title changed from Do not require Git 2.7.4 to Do not require Git 2.7.3

/cc @jacobvosmaer @DouweM

Fair enough cc @DouweM

So we would basically need a list of safe ones, instead of a single minimum requirement?

Any ETA for this issue?

I was also a concerned debian 8 user until reading this. Please fix this

Merge request gitlab-org/gitlab-ce!6273 will need specific features only in the releases shipped after 2.7. As features won't be back ported to other releases we'll not, now or in the future, support earlier git versions.

Status changed to closed

For debian jessie users: git 1.9 is in backports, that will work properly for most features afaict; just the feature introduced in !6273 (closed) won't work. And if you reaaaaly don't want to upgrade you can patch app/models/repository.rb:

diff --git a/app/models/repository.rb b/app/models/repository.rb
index 5155722..44150ed 100644
--- a/app/models/repository.rb
+++ b/app/models/repository.rb
@@ -220,10 +220,8 @@ class Repository
     # offer 'compare and swap' ref updates. Without compare-and-swap we can
     # (and have!) accidentally reset the ref to an earlier state, clobbering
     # commits. See also https://github.com/libgit2/libgit2/issues/1534.
-    command = %w[git update-ref --stdin -z]
-    _, status = Gitlab::Popen.popen(command, path_to_repo) do |stdin|
-      stdin.write("update #{name}\x00#{newrev}\x00#{oldrev}\x00")
-    end
+    command = %W[#{Gitlab.config.git.bin_path} update-ref #{name} #{newrev} #{oldrev}]
+    out, status = Gitlab::Popen.popen(command, path_to_repo)

Which doens't change anything functionally afaict.

@holstvoogd !6273 (closed) did not ship yet. 😉 So you have another month!

Raspberry Pi is stuck on v2.1.4 of git.