Merge pull request #2021 from JuliaDocs/mp/0.27.24

Backports for 0.27.24

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Documenter.jl changelog
 
+## Version `v0.27.24`
+
+* ![Security][badge-security] `deploydocs` now takes extra care to avoid committing the temporary SSH key file to the Git repo. ([#2018][github-2018])
+
 ## Version `v0.27.23`
 
 * ![Enhancement][badge-enhancement] The `native` and `docker` PDF builds now run with the `-interaction=batchmode` (instead of `nonstopmode`) and `-halt-on-error` options to make the LaTeX error logs more readable and to fail the build early. ([#1908][github-1908])
@@ -1094,6 +1098,7 @@
 [github-1886]: https://github.com/JuliaDocs/Documenter.jl/pull/1886
 [github-1908]: https://github.com/JuliaDocs/Documenter.jl/pull/1908
 [github-1909]: https://github.com/JuliaDocs/Documenter.jl/pull/1909
+[github-2018]: https://github.com/JuliaDocs/Documenter.jl/pull/2018
 <!-- end of issue link definitions -->
 
 [julia-38054]: https://github.com/JuliaLang/julia/issues/38054

Project.toml

@@ -1,6 +1,6 @@
 name = "Documenter"
 uuid = "e30172f5-a6a5-5a46-863b-614d45cd2de4"
-version = "0.27.23"
+version = "0.27.24"
 
 [deps]
 ANSIColoredPrinters = "a4c015fc-c6ff-483c-b24f-f7ea428134e9"

src/Documenter.jl

@@ -710,7 +710,7 @@ function git_push(
         end
 
         # Add, commit, and push the docs to the remote.
-        run(`$(git()) add -A .`)
+        run(`$(git()) add -A -- ':!.documenter-identity-file.tmp' ':!**/.documenter-identity-file.tmp'`)
         if !success(`$(git()) diff --cached --exit-code`)
             if archive !== nothing
                 run(`$(git()) commit -m "build based on $sha"`)
@@ -732,14 +732,16 @@ function git_push(
         # Get the parts of the repo path and create upstream repo path
         user, host, upstream = user_host_upstream(repo)
 
-        keyfile = abspath(joinpath(root, ".documenter"))
+        keyfile = abspath(joinpath(root, ".documenter-identity-file.tmp"))
+        ispath(keyfile) && error("Keyfile not cleaned up from last run: $(keyfile)")
         try
             if is_preview
                 keycontent = documenter_key_previews(deploy_config)
             else
                 keycontent = documenter_key(deploy_config)
             end
             write(keyfile, base64decode(keycontent))
+            chmod(keyfile, 0o600) # user-only rw permissions
         catch e
             @error """
             Documenter failed to decode the DOCUMENTER_KEY environment variable.
@@ -749,7 +751,6 @@ function git_push(
             rm(keyfile; force=true)
             rethrow(e)
         end
-        chmod(keyfile, 0o600)
 
         try
             mktemp() do sshconfig, io

test/doctests/doctests.jl

@@ -90,6 +90,9 @@ function onormalize(s)
     # Remove stacktraces
     s = replace(s, r"(│\s+Stacktrace:)(\n(│\s+)\[[0-9]+\].*)(\n(│\s+)@.*)?+" => s"\1\\n\3{STACKTRACE}")
 
+    # In Julia 1.9, the printing of UndefVarError has slightly changed (added backticks around binding name)
+    s = replace(s, r"UndefVarError: `([A-Za-z0-9.]+)` not defined"m => s"UndefVarError: \1 not defined")
+
     return s
 end
 

test/doctests/src/softscope.md

@@ -21,7 +21,9 @@ DocTestFilters = [
     # remove stacktraces
     r"Stacktrace:(\n \[[0-9]+\].*)*",
     # remove file paths from at-block URLs
-    r"└ @ .+:[0-9]+"
+    r"└ @ .+:[0-9]+",
+    # Account for the printing change of UndefVarError
+    r"UndefVarError: `?s`? not defined",
 ]
 ```
 

test/utilities.jl

@@ -229,7 +229,11 @@ end
             # NOTE: the target path in the `git submodule add` command is necessary for
             # Windows builds, since otherwise Git claims that the path is in a .gitignore
             # file.
-            @test trun(`$(git()) submodule add $(path_repo) repository`)
+            #
+            # protocol.file.allow=always is necessary to work around a changed default
+            # setting that was changed due to a security flaw.
+            # See: https://bugs.launchpad.net/ubuntu/+source/git/+bug/1993586
+            @test trun(`$(git()) -c protocol.file.allow=always submodule add $(path_repo) repository`)
             @test trun(`$(git()) add -A`)
             @test trun(`$(git()) commit -m"Initial commit."`)
         end