From 23047e6b700645efe9ed38d479417c6fa0543704 Mon Sep 17 00:00:00 2001 From: Matthew John Cheetham Date: Wed, 1 Jul 2026 09:41:24 +0100 Subject: [PATCH 1/3] fixup! azure-pipelines: add ESRP code signing We have been using an inappropriate key for our Debian package signing; let's use a more appropriate one. Signed-off-by: Matthew John Cheetham Signed-off-by: Johannes Schindelin --- .azure-pipelines/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.azure-pipelines/release.yml b/.azure-pipelines/release.yml index fc1b197d607799..997b46b2678cf5 100644 --- a/.azure-pipelines/release.yml +++ b/.azure-pipelines/release.yml @@ -1192,13 +1192,13 @@ extends: version: '8.x' - template: .azure-pipelines/esrp/sign.yml@self parameters: - displayName: 'Example sign Debian package' + displayName: 'Sign Debian package' folderPath: '$(Build.ArtifactStagingDirectory)/app' pattern: '**/*.deb' inlineOperation: | [ { - "KeyCode": "CP-453387-Pgp", + "KeyCode": "CP-500207-Pgp", "OperationCode": "LinuxSign", "ToolName": "sign", "ToolVersion": "1.0", From b2ce41e8cb96004611b85c4f3263fcef2bd98c4f Mon Sep 17 00:00:00 2001 From: Johannes Schindelin Date: Wed, 1 Jul 2026 11:38:48 +0200 Subject: [PATCH 2/3] fixup! Adjust README.md for microsoft/git Since switching to ESRP, Microsoft Git's Linux packages use a different GPG key to sign the packages. Let's adjust the instructions how to verify the package signatures. Signed-off-by: Johannes Schindelin --- README.md | 30 +++++++++++++----------------- 1 file changed, 13 insertions(+), 17 deletions(-) diff --git a/README.md b/README.md index ce4a0e199310dc..3e0fa1516b879c 100644 --- a/README.md +++ b/README.md @@ -122,44 +122,40 @@ To download and validate the signature of this package, run the following: sudo apt-get install -y curl debsig-verify # Download public key signature file -curl -s https://api.github.com/repos/microsoft/git/releases/latest \ -| grep -E 'browser_download_url.*msft-git-public.asc' \ -| cut -d : -f 2,3 \ -| tr -d \" \ -| xargs -I 'url' curl -L -o msft-git-public.asc 'url' +curl -Os https://packages.microsoft.com/keys/microsoft-2025.asc # De-armor public key signature file -gpg --output msft-git-public.gpg --dearmor msft-git-public.asc +gpg --output microsoft-2025.gpg --dearmor microsoft-2025.asc -# Note that the fingerprint of this key is "B8F12E25441124E1", which you can +# Note that the fingerprint of this key is "EE4D7792F748182B", which you can # determine by running: -gpg --show-keys msft-git-public.asc | head -n 2 | tail -n 1 | tail -c 17 +gpg --show-keys microsoft-2025.asc | head -n 2 | tail -n 1 | tail -c 17 # Copy de-armored public key to debsig keyring folder -sudo mkdir /usr/share/debsig/keyrings/B8F12E25441124E1 -sudo mv msft-git-public.gpg /usr/share/debsig/keyrings/B8F12E25441124E1/ +sudo mkdir /usr/share/debsig/keyrings/EE4D7792F748182B +sudo mv microsoft-2025.gpg /usr/share/debsig/keyrings/EE4D7792F748182B/ # Create an appropriate policy file -sudo mkdir /etc/debsig/policies/B8F12E25441124E1 +sudo mkdir /etc/debsig/policies/EE4D7792F748182B cat > generic.pol << EOL - + - + - + EOL -sudo mv generic.pol /etc/debsig/policies/B8F12E25441124E1/generic.pol +sudo mv generic.pol /etc/debsig/policies/EE4D7792F748182B/generic.pol -# Download Debian package +# Download Debian package (substitute `amd64` with `arm64` on ARM machines) curl -s https://api.github.com/repos/microsoft/git/releases/latest \ -| grep "browser_download_url.*deb" \ +| grep "browser_download_url.*amd64.deb" \ | cut -d : -f 2,3 \ | tr -d \" \ | xargs -I 'url' curl -L -o msft-git.deb 'url' From 1f95d4c608552394485d129542e2f31f18ff3396 Mon Sep 17 00:00:00 2001 From: Derrick Stolee Date: Tue, 23 Jun 2026 13:14:19 -0400 Subject: [PATCH 3/3] fixup! gvfs-helper: run prefetch index-pack in parallel Signed-off-by: Derrick Stolee --- gvfs-helper.c | 1 + t/t5797-gvfs-helper-prefetch-threads.sh | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/gvfs-helper.c b/gvfs-helper.c index 1e441e2c89f3e4..da47ace8b6a228 100644 --- a/gvfs-helper.c +++ b/gvfs-helper.c @@ -2447,6 +2447,7 @@ static int prefetch_get_next_task(struct child_process *cp, strvec_pushl(&cp->args, "-o", entry->temp_path_idx.buf, NULL); strvec_push(&cp->args, entry->temp_path_pack.buf); cp->no_stdin = 1; + cp->no_stdout = 1; return 1; } diff --git a/t/t5797-gvfs-helper-prefetch-threads.sh b/t/t5797-gvfs-helper-prefetch-threads.sh index 33efdb4b2160b9..a215570ccfada6 100755 --- a/t/t5797-gvfs-helper-prefetch-threads.sh +++ b/t/t5797-gvfs-helper-prefetch-threads.sh @@ -21,6 +21,7 @@ do_prefetch_all () { --no-progress \ prefetch >OUT.output 2>OUT.stderr && + test_must_be_empty OUT.stderr && verify_received_packfile_count 3 && verify_prefetch_keeps 1200000000 } @@ -34,6 +35,7 @@ do_prefetch_since () { --no-progress \ prefetch --since="1000000000" >OUT.output 2>OUT.stderr && + test_must_be_empty OUT.stderr && verify_received_packfile_count 2 && verify_prefetch_keeps 1200000000 } @@ -47,6 +49,7 @@ do_prefetch_up_to_date () { --no-progress \ prefetch --since="1000000000" >OUT.output 2>OUT.stderr && + test_must_be_empty OUT.stderr && verify_received_packfile_count 2 && verify_prefetch_keeps 1200000000 && @@ -57,6 +60,7 @@ do_prefetch_up_to_date () { --no-progress \ prefetch >OUT.output 2>OUT.stderr && + test_must_be_empty OUT.stderr && verify_received_packfile_count 0 && verify_prefetch_keeps 1200000000 }