[REGRESSION] Can't clone GitHub repos (fetch-pack error) due to avoiding deprecated OpenSSL SHA-1 routines

From: Bagas Sanjaya <bagasdotme@gmail.com>
To: Git Mailing List <git@vger.kernel.org>
Cc: Eric Wong <e@80x24.org>, Junio C Hamano <gitster@pobox.com>,
	Jonathan Tan <jonathantanmy@google.com>
Subject: [REGRESSION] Can't clone GitHub repos (fetch-pack error) due to avoiding deprecated OpenSSL SHA-1 routines
Date: Thu, 31 Aug 2023 19:47:19 +0700	[thread overview]
Message-ID: <ZPCL11k38PXTkFga@debian.me> (raw)

[-- Attachment #1: Type: text/plain, Size: 2610 bytes --]

Hi,

I built Git v2.42.0 on Debian testing, linked with OpenSSL (v3.0.10 from
distribution) with Makefile knob `OPENSSL_SHA1=YesPlease 
OPENSSL_SHA256=YesPlease`. I tried to shallow clone git.git repository:

```
$ git clone https://github.com/git/git --depth=1 git-scm
```

All the necessary objects were fetched but the clone errored instead with:

```
fatal: fetch-pack: invalid index-pack output
```

This issue is a regression since v2.41.0 doesn't have it. Bisecting, the
culprit is commit bda9c12073e7 (avoid SHA-1 functions deprecated in OpenSSL 3+,
2023-08-01). AFAIK, the culprit doesn't touch `fetch-pack.c` as I hoped.

The full bisection log is:

```
git bisect start '--term-good=ok' '--term-bad=oops'
# status: waiting for both good and bad commits
# ok: [fe86abd7511a9a6862d5706c6fa1d9b57a63ba09] Git 2.41
git bisect ok fe86abd7511a9a6862d5706c6fa1d9b57a63ba09
# status: waiting for bad commit, 1 good commit known
# oops: [43c8a30d150ecede9709c1f2527c8fba92c65f40] Git 2.42
git bisect oops 43c8a30d150ecede9709c1f2527c8fba92c65f40
# ok: [1d76e69212102c3373b552186590b76d6ad8d84c] Merge branch 'jc/doc-hash-object-types'
git bisect ok 1d76e69212102c3373b552186590b76d6ad8d84c
# ok: [914a353a128d4d885e138f189e235ad6094d436e] Merge branch 'jc/am-parseopt-fix'
git bisect ok 914a353a128d4d885e138f189e235ad6094d436e
# ok: [e48d9c78cc00805660b83ac809188d0c413e4c46] Merge branch 'am/doc-sha256'
git bisect ok e48d9c78cc00805660b83ac809188d0c413e4c46
# oops: [cecd6a5ffce2c35f18e8ac537c9e2f71ac99932b] Merge branch 'jc/send-email-pre-process-fix'
git bisect oops cecd6a5ffce2c35f18e8ac537c9e2f71ac99932b
# oops: [8cdd5e713d7ba54b9d26ac997408bb745ab55088] Merge branch 'ma/locate-in-path-for-windows'
git bisect oops 8cdd5e713d7ba54b9d26ac997408bb745ab55088
# ok: [a82fb66fed250e16d3010c75404503bea3f0ab61] A few more topics before -rc1
git bisect ok a82fb66fed250e16d3010c75404503bea3f0ab61
# oops: [cf07e53bae8492fc6ee8a8d394e2fba858daa0a4] Merge branch 'bc/ident-dot-is-no-longer-crud-letter'
git bisect oops cf07e53bae8492fc6ee8a8d394e2fba858daa0a4
# oops: [bda9c12073e786e2ffa2c3ec479c7fe098d49999] avoid SHA-1 functions deprecated in OpenSSL 3+
git bisect oops bda9c12073e786e2ffa2c3ec479c7fe098d49999
# ok: [3e440ea0aba0660f356a3e5b9fc366d5d6960847] sha256: avoid functions deprecated in OpenSSL 3+
git bisect ok 3e440ea0aba0660f356a3e5b9fc366d5d6960847
# first oops commit: [bda9c12073e786e2ffa2c3ec479c7fe098d49999] avoid SHA-1 functions deprecated in OpenSSL 3+
```

Thanks.

-- 
An old man doll... just what I always wanted! - Clara

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]