Google Git
Sign in
gerrit / gerrit / dc3c749627b7327b05a82952157302108d2590cf
commitdc3c749627b7327b05a82952157302108d2590cf[log] [tgz]
authorEdwin Kempin <ekempin@google.com>Tue Dec 21 11:37:56 2021 +0100
committerEdwin Kempin <ekempin@google.com>Tue Dec 21 11:37:56 2021 +0100
tree5970485eb51cc318e0aa688f41deb16aa6798f8b
parent133e1c70c3f30c7be3ddfbafcf0eeb8d048022c4 [diff]
Upgrade flogger to 0.7.4 which upgraded log4j2 due to CVE-2021-44228

Flogger contains a log4j2 backend which has a dependency on log4j2. In
Flogger 0.7.3 the log4j2 backend depends on a log4j2 version (2.16) that
is still partly vulnerable due to CVE-2021-44228. With Flogger 0.7.4
that dependency was upgraded to log4j 2.17 where further fixes for the
vulnerability were done [1].

Gerrit does neither use the log4j2 backend nor has a dependency on it.
Gerrit also doesn't use log4j2. So this upgrade doesn't fix anything in
Gerrit. Doing the upgrade is rather a precaution in case Gerrit ever
upgrades to log4j2, because then it can be easily missed that flogger
needs to be upgraded too. Since the flogger upgrade is no work, let's
just do it now.

[1] https://github.com/google/flogger/releases/tag/flogger-0.7.4

Signed-off-by: Edwin Kempin <ekempin@google.com>
Change-Id: I16a5253352a4dc09ada034cfcf8f19bdbc4d6293
1 file changed
tree: 5970485eb51cc318e0aa688f41deb16aa6798f8b
  1. .settings/
  2. .ts-out/
  3. antlr3/
  4. contrib/
  5. Documentation/
  6. e2e-tests/
  7. java/
  8. javatests/
  9. lib/
  10. modules/
  11. plugins/
  12. polygerrit-ui/
  13. prolog/
  14. prologtests/
  15. proto/
  16. resources/
  17. tools/
  18. webapp/
  19. polymer-bridges
  20. .bazelignore
  21. .bazelproject
  22. .bazelrc
  23. .bazelversion
  24. .editorconfig
  25. .git-blame-ignore-revs
  26. .gitignore
  27. .gitmodules
  28. .gitreview
  29. .mailmap
  30. .pydevproject
  31. .zuul.yaml
  32. BUILD
  33. COPYING
  34. INSTALL
  35. Jenkinsfile
  36. package.json
  37. README.md
  38. SUBMITTING_PATCHES
  39. version.bzl
  40. WORKSPACE
  41. yarn.lock
README.md

Gerrit Code Review

Gerrit is a code review and project management tool for Git based projects.

Build Status Maven Central

Objective

Gerrit makes reviews easier by showing changes in a side-by-side display, and allowing inline comments to be added by any reviewer.

Gerrit simplifies Git based project maintainership by permitting any authorized user to submit changes to the master Git repository, rather than requiring all approved changes to be merged in by hand by the project maintainer.

Documentation

For information about how to install and use Gerrit, refer to the documentation.

Source

Our canonical Git repository is located on googlesource.com. There is a mirror of the repository on Github.

Reporting bugs

Please report bugs on the issue tracker.

Contribute

Gerrit is the work of hundreds of contributors. We appreciate your help!

Please read the contribution guidelines.

Note that we do not accept Pull Requests via the Github mirror.

Getting in contact

The Developer Mailing list is repo-discuss on Google Groups.

License

Gerrit is provided under the Apache License 2.0.

Build

Install Bazel and run the following:

    git clone --recurse-submodules https://gerrit.googlesource.com/gerrit
    cd gerrit && bazel build release

Install binary packages (Deb/Rpm)

The instruction how to configure GerritForge/BinTray repositories is here

On Debian/Ubuntu run:

    apt-get update & apt-get install gerrit=<version>-<release>

NOTE: release is a counter that starts with 1 and indicates the number of packages that have been released with the same version of the software.

On CentOS/RedHat run:

    yum clean all && yum install gerrit-<version>[-<release>]

On Fedora run:

    dnf clean all && dnf install gerrit-<version>[-<release>]

Use pre-built Gerrit images on Docker

Docker images of Gerrit are available on DockerHub

To run a CentOS 8 based Gerrit image:

    docker run -p 8080:8080 gerritcodereview/gerrit[:version]-centos8

To run a Ubuntu 20.04 based Gerrit image:

    docker run -p 8080:8080 gerritcodereview/gerrit[:version]-ubuntu20

NOTE: release is optional. Last released package of the version is installed if the release number is omitted.