%global gitver 2.54.0 %global cachedir %{_localstatedir}/cache/%{name} %global filterdir %{_libexecdir}/%{name}/filters %global scriptdir %{_localstatedir}/www/cgi-bin %global cgitdata %{_datadir}/%{name} %global make_cgit \ export CFLAGS="%{optflags}" \ export LDFLAGS="%{?__global_ldflags}" \ make V=1 %{?_smp_mflags} \\\ DESTDIR=%{buildroot} \\\ INSTALL="install -p" \\\ CACHE_ROOT=%{cachedir} \\\ CGIT_SCRIPT_PATH=%{scriptdir} \\\ CGIT_SCRIPT_NAME=cgit \\\ CGIT_DATA_PATH=%{cgitdata} \\\ docdir=%{docdir} \\\ filterdir=%{filterdir} \\\ prefix=%{_prefix} Name: cgit Version: 1.3.1 Release: 100.korg.15%{?dist} Summary: A fast web interface for git Group: Development/Tools License: GPLv2 and MIT URL: http://git.zx2c4.com/cgit/ Source0: %{name}-%{version}-korg.tar.xz Source1: https://www.kernel.org/pub/software/scm/git/git-%{gitver}.tar.xz # Security guys might try to repoquery for these. Provides: bundled(git) = %gitver Provides: bundled(prismjs) = 1.30.0 Patch1: cgit-0.9.1-highlightv3.patch BuildRequires: highlight Requires: highlight BuildRequires: asciidoc BuildRequires: libcurl-devel BuildRequires: openssl-devel BuildRequires: lua-devel BuildRequires: make BuildRequires: gcc BuildRequires: zlib-devel # Needed for make test BuildRequires: gettext BuildRequires: unzip BuildRequires: tidy BuildRequires: perl %description Cgit is a fast web interface for git. It uses caching to increase performance. %prep %setup -q -a 1 -n %{name}-%{version}-korg %patch -P1 -p1 # setup the git dir rm -rf git mv git-%{gitver} git sed -i 's|^\(CFLAGS = \).*|\1%{optflags} -std=gnu99|' git/Makefile echo "CGIT_VERSION = %{version}-korg" > VERSION %build %{make_cgit} %{make_cgit} CGIT_TEST_NO_GIT_VERSION=YesPlease test # Something in the a2x chain doesn't like running in parallel. :/ %{make_cgit} -j1 doc-man doc-html highlight --print-style --style-outfile=stdout >> cgit.css %install %{make_cgit} install install-man %files %defattr(-,root,root,-) %doc COPYING README* *.html %license LICENSE.prismjs %{cgitdata} %{filterdir} %{scriptdir}/* %{_mandir}/man*/* %changelog * Mon Aug 31 2026 Konstantin Ryabitsev - 1.3.1-100.korg.15 - Update to latest kernel.org patches (korg-infra-deployment branch) - Drop prism.js's translucent-white highlight box behind strings, entities, operators and urls, which showed up as a literal white box behind every "=", "*", "<<", etc. - Load prism.css/prism.js from for the whole tree command instead of only next to a highlighted blob, so a directory listing also loads them and blob links below it render highlighted without a second, unstyled flash; still skipped when repo.source-filter is set * Mon Aug 31 2026 Konstantin Ryabitsev - 1.3.1-100.korg.14 - Update to latest kernel.org patches (korg-infra-deployment branch) - CSS tweaks for client-side highlighted blobs: drop prism.js's own boxed light theme (background fill, text-shadow emboss, hardcoded token colors) so a highlighted blob sits flush like an unhighlighted one, and make it inherit the table's line-height so line numbers stay in sync with code further down the page * Mon Aug 31 2026 Konstantin Ryabitsev - 1.3.1-100.korg.13 - Update to latest kernel.org patches (korg-infra-deployment branch) - Add optional enable-source-highlight cgitrc directive: highlights tree-view blobs client-side using a vendored, self-hosted prism.js, guessing the language from the blob's filename. Off by default; repo.source-filter still takes priority when set, so server-side highlighting is unaffected - Skip a redundant canonical-repo re-check when rendering the diff embedded in a commit page that already resolved it as not canonical - Package the vendored prism.js/prism.css (PrismJS 1.30.0, MIT licensed): add LICENSE.prismjs as %%license, mark License as "GPLv2 and MIT", and add Provides: bundled(prismjs) = 1.30.0 for CVE-scanning tools * Mon Aug 31 2026 Konstantin Ryabitsev - 1.3.1-100.korg.12 - Rework the korg.11 fix for the canonical-repo commit-graph corruption: disabling the commit-graph on the canonical repository's short-lived lookup avoided the crash but made the reachability walk slow on deep history. Instead, the commit-graph stays enabled and the lookup simply never closes that repository, since cgit serves one request per process and exits -- closing it was the only thing that corrupted the shared commit-graph slab, and this process never needed the memory back anyway * Mon Aug 31 2026 Konstantin Ryabitsev - 1.3.1-100.korg.11 - Fix a production-crashing regression from korg.10: rendering a commit or diff page against a canonical repository could corrupt the commit-graph data of the repository actually being served, crashing the process (segfault, seen as nginx 502s) on any following request that needed it. The canonical-repo lookup opens the target repository briefly to check whether it publishes the object being viewed, and closing that lookup was tearing down a slab of commit-graph data shared by every repository open in the process, not just the one being closed. The canonical-repo lookup no longer uses a commit-graph for that check, so closing it no longer touches data any other repository depends on - Add tests/t0117-commit-graph-slab-collision.sh as a regression test * Mon Aug 31 2026 Konstantin Ryabitsev - 1.3.1-100.korg.10 - Update to latest kernel.org patches (korg-infra-deployment branch) - Abbreviate commit and diff pages when a canonical repository already publishes the object being viewed: keep the visitor on the page they asked for, but replace the message/diffstat/diff with a short notice and a link to the same object in the canonical repository, cutting the crawlable surface without silently switching repositories on them * Sat Aug 29 2026 Konstantin Ryabitsev - 1.3.1-100.korg.9 - Security: fix HTTP response splitting in the redirect helpers added over the last several builds. A raw CR/LF reaching the query string written into a Location header could terminate the header early and let the request splice extra headers or body onto the response; control bytes are now percent-encoded before they reach the header - Recognize percent-encoded query parameter names (h=, id=, id2=, url=) when deciding what to drop or replace in a redirect target, closing a way to dodge the canonical-URL redirects with an encoded name - Fix a redirect loop when the no-op path= redirect is reached via PATH_INFO instead of url=: the target was built from the current URL, which still carried the path being dropped * Fri Aug 28 2026 Konstantin Ryabitsev - 1.3.1-100.korg.8 - Update to latest kernel.org patches (korg-infra-deployment branch) - Redirect an abbreviated id= or id2= to its full-length object id whenever it resolves unambiguously, so every object gets one canonical URL instead of one per abbreviation length * Fri Aug 28 2026 Konstantin Ryabitsev - 1.3.1-100.korg.7 - Update to latest kernel.org patches (korg-infra-deployment branch) - Redirect away a redundant h=: dropped when id= is also given, or when it merely repeats the repository's default branch, so caches and crawlers converge on one canonical URL per page - Collapse an explicit refs/heads/ prefix on h= down to the bare branch name, unless a same-named tag would shadow it - Redirect away a path= on commit/diff/patch/rawdiff pages when the pinned commit doesn't actually touch that path * Fri Aug 28 2026 Konstantin Ryabitsev - 1.3.1-100.korg.6 - Restrict canonical-repo redirects to pages with no navigation of their own (blob, patch, plain, rawdiff, snapshot); commit, diff, log, tree and other chrome-bearing pages are never redirected, since they would go on browsing the substituted repository with nothing on the page to say so * Fri Aug 28 2026 Konstantin Ryabitsev - 1.3.1-100.korg.5 - Update to latest kernel.org patches (korg-infra-deployment branch) - Add optional canonical-repo cgitrc directive: when a request pinned by id= names an object that a designated upstream repository also holds, permanently redirect there instead of rendering it locally, so forks sharing an object database don't get crawled as duplicate content - Omit the redundant h= branch parameter from links that are already pinned by id=, so a revision has one canonical URL instead of two * Tue Aug 25 2026 Konstantin Ryabitsev - 1.3.1-100.korg.4 - Fix a NULL dereference when repo.path is not a valid git directory: the notes loader ran even when setup_git_directory_gently() failed, crashing every page that touched a repository being created or replicated - Don't let a stale lockfile pin the scan-path repolist cache forever; use an advisory lock so a dead holder's lockfile is taken over rather than failing every later refresh with EEXIST - Zero-pad the cached repolist filename (%%08lx rather than %%8lx) * Tue Aug 25 2026 Konstantin Ryabitsev - 1.3.1-100.korg.3 - Fix the Expires header on error pages: page.expires was assigned cache-dynamic-ttl directly, which is a count of minutes with no base, so error pages reported Expires five seconds past the epoch and were never cached by anything downstream * Tue Aug 25 2026 Konstantin Ryabitsev - 1.3.1-100.korg.2 - Update to latest kernel.org patches (korg-infra-deployment branch) - Fix corrupted pages served from the on-disk cache: a race in the cache locking could append the tail of a previous, larger cache entry to a page, persisting until the slot expired - Add optional enable-object-reachability-check to refuse objects not reachable from any reference (off by default) * Wed May 20 2026 Konstantin Ryabitsev - 1.3.1-100.korg.1 - Update to 1.3.1 with kernel.org patches - Add git-bug browsing support via Lua filter (feature/git-bug branch) - Bump bundled git to 2.54.0 (matches cgit 1.3.1 submodule pin) * Tue Mar 31 2026 Konstantin Ryabitsev - 1.3-100.korg.1 - Update to latest 1.3 with kernel.org patches * Fri Aug 09 2024 Konstantin Ryabitsev - 1.2.3-100.korg.2 - Update to latest for-jason and build for RHEL9 - Drop any conditionals for RHEL < 9 - Remove httpd dependency (we don't know what server we'll be using) - Don't install cachedir (we don't know what user it needs to be owned as) - Don't install default cgitrc * Wed Dec 06 2023 Konstantin Ryabitsev - 1.2.3-100.korg.1 - Build korg-specific deployment, using zx2c4 as basis (mostly, for the dark theme) * Mon May 11 2020 Konstantin Ryabitsev - 1.2.3-1 - Update to 1.2.3 - Build with make test * Tue Mar 07 2017 Pavel Raiskup - 1.1-3 - suggest using correct selinux context (rhbz#1429790) * Fri Feb 10 2017 Fedora Release Engineering - 1.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild * Wed Nov 23 2016 Kevin Fenzi - 1.1-1 - Update to 1.1. Fixes bug #1397820 * Mon Sep 19 2016 Pavel Raiskup - 1.0-2 - ensure we inform about git bundling appropriately * Tue Jun 07 2016 Kevin Fenzi - 1.0-1 - Update to 1.0 * Wed Feb 03 2016 Fedora Release Engineering - 0.12-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild * Sat Jan 16 2016 Kevin Fenzi - 0.12-1 - Update to 0.12. Fixes bug #1298912 - Fixes CVE-2016-1899 CVE-2016-1900 CVE-2016-1901 * Sat Sep 05 2015 Kevin Fenzi 0.11.2-3 - Fix up logic around webserver and httpd. - On Fedora require webserver and httpd-filesystem - On EPEL require httpd. * Wed Jun 17 2015 Fedora Release Engineering - 0.11.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild * Sat Mar 14 2015 Kevin Fenzi 0.11.2-1 - Update to 0.11.2 * Tue Mar 10 2015 Kevin Fenzi 0.11.1-1 - Update to 0.11.1 * Mon Feb 16 2015 Kevin Fenzi 0.11.0-1 - Update to 0.11.0 * Mon Feb 09 2015 Pavel Raiskup - 0.10.2-5 - require "any" 'webserver' instead of concrete 'httpd' (#1138599) * Fri Aug 15 2014 Fedora Release Engineering - 0.10.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild * Tue Jul 08 2014 Pavel Raiskup - 0.10.2-3 - currently epel-7-ppc64 does not have highlight package (#1117261) * Tue Jul 08 2014 Pavel Raiskup - 0.10.2-2 - install README.SELinux documentation again (#1036123) - generate cgit.conf for httpd >= 2.4 when needed * Tue Jul 01 2014 Kevin Fenzi 0.10.2-1 - Update to 0.10.2. Fixes bug #1114970 * Wed Jun 11 2014 Kevin Fenzi 0.10.1-4 - Add patch to fix raw patch handling * Sat Jun 07 2014 Fedora Release Engineering - 0.10.1-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild * Thu Mar 20 2014 Ville Skyttä - 0.10.1-2 - Include highlight styles in cgit.css * Thu Feb 27 2014 Kevin Fenzi 0.10.1-1 - Update to 0.10.1 - Correctly enable lua filters. * Wed Feb 19 2014 Kevin Fenzi 0.10-1 - Update to 0.10 * Sat Aug 03 2013 Fedora Release Engineering - 0.9.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild * Mon May 27 2013 Todd Zullinger - 0.9.2-1 - Update to 0.9.2, fixes CVE-2013-2117 * Wed Feb 13 2013 Fedora Release Engineering - 0.9.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild * Wed Nov 21 2012 Kevin Fenzi 0.9.1-3 - Fixed ldflags. Fixes bug 878611 * Sat Nov 17 2012 Kevin Fenzi 0.9.1-2 - Add patch to use correct version of highlight for all branches except epel5 * Thu Nov 15 2012 Kevin Fenzi 0.9.1-1 - Update to 0.9.1 - Fixes bug #870714 - CVE-2012-4548 - Fixes bug #820733 - CVE-2012-4465 * Wed Jul 18 2012 Fedora Release Engineering - 0.9.0.2-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild * Thu Jan 12 2012 Fedora Release Engineering - 0.9.0.2-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild * Fri Jul 22 2011 Todd Zullinger - 0.9.0.2-2 - Fix potential XSS vulnerability in rename hint * Thu Jul 21 2011 Todd Zullinger - 0.9.0.2-1 - Update to 0.9.0.2 * Sun Mar 06 2011 Todd Zullinger - 0.9-1 - Update to 0.9 - Fixes: CVE-2011-1027 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1027 - Generate and install man page and html docs - Use libcurl-devel on RHEL >= 6 - Include example filter scripts - Update example cgitrc * Tue Feb 08 2011 Fedora Release Engineering - 0.8.2.1-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild * Mon Sep 27 2010 Todd Zullinger - 0.8.2.1-4 - Appy upstream git patch for CVE-2010-2542 (#618108) * Fri Aug 21 2009 Tomas Mraz - 0.8.2.1-3 - rebuilt with new openssl * Fri Jul 24 2009 Fedora Release Engineering - 0.8.2.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild * Sun Mar 15 2009 Todd Zullinger - 0.8.2.1-1 - Update to 0.8.2.1 * Mon Feb 23 2009 Fedora Release Engineering - 0.8.2-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild * Sun Feb 01 2009 Todd Zullinger - 0.8.2-1 - Update to 0.8.2 - Drop upstreamed Makefile patch * Sun Jan 18 2009 Todd Zullinger - 0.8.1-2 - Rebuild with new openssl * Mon Jan 12 2009 Todd Zullinger - 0.8.1-1 - Initial package