update libgit2 to newer snapshot

[davidkna]

Fixes CVE 2022-24765

@justinsteven has a writeup of this issue (see also starship/starship#3974)

I think this also fixes #795.

I needed to make some changes to the libgit2-sys build.rs to get this to build and the owner validation needed to be disabled for the tests on Windows, I've not investigated the cause in detail.

Furthermore, I've increased the minor version and treated this as a breaking change, since this change could prevent opening a repository if it is not owned by the current user.

I am disclosing this security issue publicly because this class of vulnerability has already been reported publicly in several other similar projects.

[justinsteven]

@justinsteven has a writeup of this issue (see also starship/starship#3974)

For absolute clarity, the writeup linked to does not discuss CVE-2022-24765. The writeup is regarding similar but separate problems.

[ehuss]

Thanks for the PR! I should have opened an issue about this, as we have been working on it.

There are some issues here:

• It looks like this updated to the branch. However, we have moved on to the main branch in Support for building refactored libgit2 sources for vendored-libgit2 feature #822. This reverts all those changes, so I think it should stay on main.
• I'd like to delay updating until Ownership check on windows seems too strict libgit2/libgit2#6279 is fixed.
• GIT_EOWNER should be added
• There are some tricky sha changes added recently, I had a partial fix at: ehuss@5443555
• It looks like you defined GIT_OPT_GET_OWNER_VALIDATION twice (oops, misread GET and SET)

[davidkna]

@ehuss So should I rather close this for now, if you're already working on this? It looks like libgit2/libgit2#6279 is the cause of the ownership issue in the tests on Windows I fixed.

It looks like you defined GIT_OPT_GET_OWNER_VALIDATION twice.

It has GET and SET variants.

[ehuss]

No, it's fine to keep this open, if you're willing to make the updates mentioned above.

[davidkna]

Okay, I am fine with updating this a bit more. What exactly is missing in ehuss@5443555? It seems to mostly match what's in the libgit2 cmake files. Having to include sha256-support, despite it not having a stable release, is a bit unfortunate.

[ehuss]

I think the only things missing on my branch were GIT_EOWNER and GIT_OPT_GET_OWNER_VALIDATION and GIT_OPT_SET_OWNER_VALIDATION.

[davidkna]

@ehuss libgit2 v1.4.4 was just released, which is supposed to fix the Windows behavior. Updated to latest main libgit2.

[ehuss]

Thanks! Hopefully the fallout from this won't be too severe.