libgit2 / discussions Goto Github PK

Both ASAN and valgrind complain about memory leaks coming from libgit use of SSL.
I'm running libgit version 1.0.0.

==16329== 61,206 (1,488 direct, 59,718 indirect) bytes in 6 blocks are definitely lost in loss record 238 of 238
==16329==    at 0x483A7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==16329==    by 0x4E87D98: OPENSSL_malloc (mem.c:108)
==16329==    by 0x4E2EC09: asn1_item_ex_combine_new (tasn_new.c:182)
==16329==    by 0x4E2EC8F: ASN1_item_new (tasn_new.c:79)
==16329==    by 0x4EAB5E6: X509_parse_from_buffer (x_x509.c:160)
==16329==    by 0x4DB3E54: bssl::ssl_crypto_x509_session_cache_objects(ssl_session_st*) (ssl_x509.cc:304)
==16329==    by 0x4DBE3EA: bssl::tls13_process_certificate(bssl::SSL_HANDSHAKE*, bssl::SSLMessage const&, bool) (tls13_both.cc:316)
==16329==    by 0x4DC04F2: do_read_server_certificate (tls13_client.cc:556)
==16329==    by 0x4DC04F2: bssl::tls13_client_handshake(bssl::SSL_HANDSHAKE*) (tls13_client.cc:778)
==16329==    by 0x4D96207: do_tls13 (handshake_client.cc:794)
==16329==    by 0x4D96207: bssl::ssl_client_handshake(bssl::SSL_HANDSHAKE*) (handshake_client.cc:1759)
==16329==    by 0x4D94625: bssl::ssl_run_handshake(bssl::SSL_HANDSHAKE*, bool*) (handshake.cc:676)
==16329==    by 0x4DAC600: SSL_do_handshake (ssl_lib.cc:890)
==16329==    by 0x4D115CB: openssl_connect (openssl.c:647)

Currently, I am porting the project to Scons by just submitting all the source files in deps/ and src/ to be compiled and setting the include paths as include/ and deps/.

However, my task is in a C++ project (Godot Engine) and I am having trouble figuring out all the minor dependencies that have been configured in libgit2 through CMake. Is there a list of all the libraries I need to link again while making this port?

There is this C++/Qt language binding library for libgit2, that is also mentioned on the libgit2 website: LibQGit2. There hasn't been much interest in that project and it has stagnated for a few years now. Currently it uses libgit2 API from version 0.22. But: it is about to be resurrected and patches exist (not yet pushed) already that adapt to libgit2 API version 0.27.

I'm writing this issue because LibQGit2 is currently hosted in the KDE infrastructure. During the past three years I and one another guy (with whom I was working) are the only contributors to the LibQGit2 project. I can say pretty strongly that the project was bequeathed to me.

I don't see any benefit in having LibQGit2 in the KDE infrastructure. I would propose that the repository shall be moved under the libgit2 organization in GitHub – just like pretty much all the other language binding libraries are. Could this be achieved? What would it mean in practice, politically and otherwise? Would it make libgit2 somehow (differently than currently) endorse LibQGit2 or something?

The recent security release v0.27.1 has once again brought up the issue that there is no security mailing list for libgit2 yet. On our contributors summit, we all voiced the intention to set one up, but we hoped that there would be a bit more head time to do so. Anyway, I feel like we should set that up now as soon as possible. Included should be stake holders of our most important users and potentially some maintainers of bindings.

While I'm not particularly happy with that choice, I'd think Google Groups to be a somewhat sane choice, as you can also register without needing a Google account. I'd be very happy to use another solution, preferably an open one. I'll hopefully be able to take a look whether good alternatives exist this Friday.