git: raise the minimum version to 2.47.3 and publish the tested matrix #536

New issue

Open

opened 2026-09-17 02:02:27 +00:00 by hexajon · 0 comments

hexajon commented

2026-09-17 02:02:27 +00:00

Owner

The defect

TestMadTRefInspectGrepAtLocalOnlyRef fails on git 2.38.0:

grep failed: err=<nil> result=fatal: unable to resolve revision: --end-of-options

gitcli(7) documents --end-of-options as a general convention: everything after it is not an option, and it exists because -- is already taken in commands that separate revisions from paths. madtea uses it to stop a semi-trusted ref being parsed as a flag, which is correct usage. git below some version does not honour its own documented contract for grep.

The 2.43.1 release note says the form "failed to interpret --rev as a rev, and --path as a path. This was fixed for many programs like reset and checkout." It never names grep, so it does not establish a version where grep works.

Measured: fails on 2.38.0, works on 2.47.3. Everything between is unmeasured.

Why the floor moves to 2.47.3

Current Debian stable. Debian freezes package versions at release and backports only security fixes, so trixie carries 2.47.3 for its whole life. That makes it a stable, publishable target rather than a number derived from changelog archaeology, and it removes the need to determine exactly where the grep behaviour changed.

Versions measured from the distro repositories on 2026-09-17, not from a table:

Platform	Released	git	In scope
Debian 13 trixie	2025-08-09	2.47.3	yes
RHEL 9	2022-05-18	2.52.0	yes
RHEL 10	2025-05-20	2.52.0	yes
Ubuntu 26.04 LTS	2026-04-23	2.53.0	yes
macOS 26 Tahoe	2025-09-15	2.50.1	yes
macOS 27 Golden Gate	2026-09-14	2.50.1 or newer	yes
Homebrew git	rolling	2.55.0	yes
Ubuntu 24.04 LTS	2024-04-25	2.43.0	no
Debian 12 bookworm	2023-06-10	2.39.5	no
Ubuntu 22.04 LTS	2022-04-21	2.34.1	no
macOS 15 Sequoia, bundled git	2024-09-16	2.39.5	no

Ubuntu 24.04 is the notable exclusion: it is the current Ubuntu LTS, supported to 2029. Its package is 1:2.43.0-1ubuntu7.3, and its changelog carries only CVE backports (27613, 27614, 46835, 48384, 48385, 48386, 50349, 52006, 32002). The --end-of-options fix is a bugfix, not a CVE, so it is almost certainly absent there.

macOS 15's bundled git is excluded, but Homebrew installs 2.55.0 and takes precedence on PATH, so a Mac user who installs git at all is in scope. The version gate added in #524 gives anyone below the floor a clear error naming the found and required versions, not a mis-parse.

Work

New decision record superseding ADR 0038's version decision. It must carry the table above and the exclusion list. Under the no-deferred-checks rule it may not leave an unresolved item that could move the number.
Raise the floor constant in internal/gitexec and its tests.
README requirements, at both the install step and the build-from-source step.
Rewrite the git-matrix job. With the floor at trixie's own git, the floor leg needs no source build, which removes the GPG verification, the kernel.org download, the madtea-gitcache volume and the Rust toolchain problem. The job should cover the published in-scope versions using pinned images, not source builds.
Publish the tested matrix where users will find it.

Acceptance

No supported configuration runs a git the project does not test.
The published matrix and the enforced floor agree.
The git-matrix job runs green, and has been executed before it merges.

Refs #525, #524.

ADR 0038 pins the minimum git version at 2.38.0. madtea does not work on 2.38.0, so that record states a floor the tool does not meet. This raises the floor to the git in current Debian stable and publishes what CI actually tests. ## The defect `TestMadTRefInspectGrepAtLocalOnlyRef` fails on git 2.38.0: ``` grep failed: err=<nil> result=fatal: unable to resolve revision: --end-of-options ``` `gitcli(7)` documents `--end-of-options` as a general convention: everything after it is not an option, and it exists because `--` is already taken in commands that separate revisions from paths. madtea uses it to stop a semi-trusted ref being parsed as a flag, which is correct usage. git below some version does not honour its own documented contract for `grep`. The 2.43.1 release note says the form "failed to interpret `--rev` as a rev, and `--path` as a path. This was fixed for many programs like `reset` and `checkout`." It never names `grep`, so it does not establish a version where `grep` works. Measured: **fails on 2.38.0, works on 2.47.3.** Everything between is unmeasured. ## Why the floor moves to 2.47.3 Current Debian stable. Debian freezes package versions at release and backports only security fixes, so trixie carries 2.47.3 for its whole life. That makes it a stable, publishable target rather than a number derived from changelog archaeology, and it removes the need to determine exactly where the `grep` behaviour changed. Versions measured from the distro repositories on 2026-09-17, not from a table: | Platform | Released | git | In scope | |---|---|---|---| | Debian 13 trixie | 2025-08-09 | 2.47.3 | yes | | RHEL 9 | 2022-05-18 | 2.52.0 | yes | | RHEL 10 | 2025-05-20 | 2.52.0 | yes | | Ubuntu 26.04 LTS | 2026-04-23 | 2.53.0 | yes | | macOS 26 Tahoe | 2025-09-15 | 2.50.1 | yes | | macOS 27 Golden Gate | 2026-09-14 | 2.50.1 or newer | yes | | Homebrew git | rolling | 2.55.0 | yes | | Ubuntu 24.04 LTS | 2024-04-25 | 2.43.0 | **no** | | Debian 12 bookworm | 2023-06-10 | 2.39.5 | **no** | | Ubuntu 22.04 LTS | 2022-04-21 | 2.34.1 | **no** | | macOS 15 Sequoia, bundled git | 2024-09-16 | 2.39.5 | **no** | Ubuntu 24.04 is the notable exclusion: it is the current Ubuntu LTS, supported to 2029. Its package is `1:2.43.0-1ubuntu7.3`, and its changelog carries only CVE backports (27613, 27614, 46835, 48384, 48385, 48386, 50349, 52006, 32002). The `--end-of-options` fix is a bugfix, not a CVE, so it is almost certainly absent there. macOS 15's bundled git is excluded, but Homebrew installs 2.55.0 and takes precedence on PATH, so a Mac user who installs git at all is in scope. The version gate added in #524 gives anyone below the floor a clear error naming the found and required versions, not a mis-parse. ## Work - New decision record superseding ADR 0038's version decision. It must carry the table above and the exclusion list. Under the no-deferred-checks rule it may not leave an unresolved item that could move the number. - Raise the floor constant in `internal/gitexec` and its tests. - README requirements, at both the install step and the build-from-source step. - Rewrite the `git-matrix` job. With the floor at trixie's own git, the floor leg needs no source build, which removes the GPG verification, the kernel.org download, the `madtea-gitcache` volume and the Rust toolchain problem. The job should cover the published in-scope versions using pinned images, not source builds. - Publish the tested matrix where users will find it. ## Acceptance - No supported configuration runs a git the project does not test. - The published matrix and the enforced floor agree. - The `git-matrix` job runs green, and has been executed before it merges. Refs #525, #524.

hexajon added the

bug

label

2026-09-17 02:02:27 +00:00

hexajon referenced this issue

2026-09-17 02:21:48 +00:00

git: generate and verify the git CLI surface, the way surface-diff does for the forge API #537

hexajon referenced this issue

2026-09-17 02:42:09 +00:00

ci(drift): remove the git-matrix job #539

hexajon referenced this issue

2026-09-17 02:47:07 +00:00