ci: Update macos-13 to macos-14 images on GitHub Actions - #7167
Merged
Conversation
ambv
commented
Dec 12, 2025
| export CLAR_AT_EXIT="leaks -quiet \$PPID" | ||
| # Exclude known Apple Security framework leak in CryptKit::FEEKeyInfoProvider | ||
| # which occurs during SSL/TLS handshakes and is not in libgit2's control | ||
| export CLAR_AT_EXIT="leaks -quiet -exclude=SSLHandshake \$PPID" |
Contributor
Author
There was a problem hiding this comment.
I could reproduce the memory leaks in SecureTransport's SSLHandshake locally on macOS 15 that leaks was reporting reported here. This framework is now deprecated and Network.framework is the recommended replacement.
Curl removed SecureTransport support entirely and just switched macOS to OpenSSL instead: curl/curl@08a3e8e
They do allow using the built-in Apple SecTrust certificate bundle when used with OpenSSL on macOS:
curl/curl@eefd03c
Therefore, I ignored this particular leak as the stack trace revealed it was entirely internal to Apple's framework:
1 (32 bytes) ROOT LEAK: <CryptKit::FEEKeyInfoProvider 0x15c21b6d0> [32]
STACK OF 1 INSTANCE OF 'ROOT LEAK: <CryptKit::FEEKeyInfoProvider>':
38 dyld 0x189f16b98 start + 6076
37 libgit2_tests 0x1022863c8 main + 196 main.c:33
36 libgit2_tests 0x10227ee34 clar_test_run + 96 clar.c:630
35 libgit2_tests 0x10227f1f8 clar_run_suite + 844 clar.c:424
34 libgit2_tests 0x102280f68 clar_run_test + 292 clar.c:324
33 libgit2_tests 0x1023c1a88 test_online_clone__network_full + 56 clone.c:191
32 libgit2_tests 0x1024bb9c0 git_clone + 52 clone.c:682
31 libgit2_tests 0x1024bbcbc clone_repo + 752 clone.c:655
30 libgit2_tests 0x1024bc690 clone_into + 400 clone.c:444
29 libgit2_tests 0x102567ad4 git_remote_connect_ext + 500 remote.c:963
28 libgit2_tests 0x1025a46cc git_smart__connect + 384 smart.c:171
27 libgit2_tests 0x1025a7810 git_smart__store_refs + 312 smart_protocol.c:58
26 libgit2_tests 0x1025a37fc git_smart__recv + 424 smart.c:29
25 libgit2_tests 0x10259c3f8 http_stream_read + 316 http.c:425
24 libgit2_tests 0x10259da70 git_http_client_send_request + 436 httpclient.c:1308
23 libgit2_tests 0x10259df4c http_client_connect + 420 httpclient.c:1109
22 libgit2_tests 0x10259f9fc server_connect + 172 httpclient.c:1052
21 libgit2_tests 0x10259fed8 server_connect_stream + 80 httpclient.c:832
20 libgit2_tests 0x1025a0148 git_stream_connect + 32 stream.h:15
19 libgit2_tests 0x102588928 stransport_connect + 92 stransport.c:92
18 com.apple.security 0x18d7427c0 SSLHandshake + 228
17 com.apple.security 0x18d7428e0 SSLHandshakeProceed + 168
16 libcoretls.dylib 0x1978eb920 tls_handshake_process + 112
15 libcoretls.dylib 0x1978ebf78 SSLProcessHandshakeRecordInner + 184
14 com.apple.security 0x18d9ee5d8 tls_handshake_message_callback + 64
13 libcoretls_cfhelpers.dylib 0x199af0704 tls_helper_set_peer_pubkey + 244
12 com.apple.security 0x18d8050c8 SecECKeyGetNamedCurve + 48
11 com.apple.security 0x18d7ff758 SecKeyCopyAttributes + 128
10 com.apple.security 0x18d9a152c SecCDSAKeyCopyAttributeDictionary(__SecKey*) + 968
9 com.apple.security 0x18d99fc5c SecCDSAKeyCopyExternalRepresentation(__SecKey*, __CFError**) + 708
8 com.apple.security 0x18d8b4ac8 Security::CssmClient::WrapKey::operator()(Security::CssmClient::Key&, Security::CssmData const*) + 268
7 com.apple.security 0x18d950690 CSSM_WrapKey + 200
6 com.apple.security 0x18d8bb154 cssm_WrapKey(long, unsigned long long, cssm_context const*, cssm_access_credentials const*, cssm_key const*, cssm_data const*, cssm_key*, unsigned long long) + 260
5 com.apple.security 0x18d8802bc AppleCSPSession::WrapKey(unsigned long long, Security::Context const&, Security::AccessCredentials const&, Security::CssmKey const&, Security::CssmData const*, Security::CssmKey&, unsigned long long) + 680
4 com.apple.security 0x18d717498 AppleCSPSession::infoProvider(Security::CssmKey const&) + 244
3 libc++abi.dylib 0x18a26f5ec $_0::operator()() const::'lambda0'(unsigned long, std::__type_descriptor_t)::__invoke(unsigned long, std::__type_descriptor_t) + 16
2 libc++abi.dylib 0x18a26f644 __typed_operator_new_impl[abi:ne190102](unsigned long, std::__type_descriptor_t) + 36
1 libsystem_malloc.dylib 0x18a0d39cc _malloc + 88
0 libsystem_malloc.dylib 0x18a0e90f4 _malloc_zone_malloc_instrumented_or_legacy + 268
Member
|
Thanks for digging in here - especially around the memleak in securetransport. |
1 task
netbsd-srcmastr
pushed a commit
to NetBSD/pkgsrc
that referenced
this pull request
May 5, 2026
v1.9.3 This release includes a number of bugfixes and compatibility improvements, particularly around SHA256 support. * cmake: fix linker error when using ninja build generator by @kcsaul in libgit2/libgit2#7249 * Handle redirects with Content-Length: 0 correctly by @ethomson in libgit2/libgit2#7246 * ci: use poxygit v0.8.1 in the tests by @ethomson in libgit2/libgit2#7248 * Zero indexer stats in pack objects by @ethomson in libgit2/libgit2#7243 * submodule: git_index_add_bypath does not move conflict entries to REUC by @lrm29 in libgit2/libgit2#7003 * fix: prevent SSH timeout infinite loop and enable TCP keepalive by @ambv in libgit2/libgit2#7165 * merge_files: avoid UB in xdiff by @ethomson in libgit2/libgit2#7239 * git_merge_file_from_index: handle cases when a child (ours or theirs) is null by @eantoranz in libgit2/libgit2#7092 * cmake: write git.h.tmp to current binary directory by @kcsaul in libgit2/libgit2#7241 * fix(pack): ensure pack_backend__read returns null terminated buffer by @kanru in libgit2/libgit2#7238 * Check object lengths against headers in read_loose by @howtonotwin in libgit2/libgit2#7178 * cmake: don't recreate git2.h unnecessarily by @ethomson in libgit2/libgit2#7234 * Memory Backend Corruption Fix by @kcsaul in libgit2/libgit2#7232 * Fixed a heap-buffer-overflow in the smart_pkt.c:set_data function by @oliverchang in libgit2/libgit2#7118 * fix(transport): get oid_type on local transport by @weihanglo in libgit2/libgit2#7229 * `GIT_REMOTE_DOWNLOAD_TAGS_ALL`: remove stray "the" in docs by @DanielEScherzer in libgit2/libgit2#7228 * fix(clone): propagate object format in local clone by @weihanglo in libgit2/libgit2#7226 * repo: Fix possible null pointer dereference by @csware in libgit2/libgit2#7225 * revparse: Allow `HEAD` abbreviation `@` by @KoviRobi in libgit2/libgit2#7218 * camke: include libssh2 in `Requires.private` in the PC file by @carlosmn in libgit2/libgit2#7215 * futils: fix undefined behavior in O_FSYNC fallback definition by @cehoffman in libgit2/libgit2#7211 * pcre: actually fix dangling-pointer warning by @ethomson in libgit2/libgit2#7206 * pcre: update cmake warnings for non-gcc by @ethomson in libgit2/libgit2#7205 * Fix some warnings with gcc by @ethomson in libgit2/libgit2#7203 * fix: apply insteadOf from global config for detached remotes by @weihanglo in libgit2/libgit2#7195 * Fix `git_index_entry` documentation by @bakersdozen123 in libgit2/libgit2#7192 * config: Fix potential null value passed to %s by @ethomson in libgit2/libgit2#7190 * index: support USE_NSEC=OFF by @ethomson in libgit2/libgit2#7187 * feat(remote): expose `git_remote_oid_type` by @weihanglo in libgit2/libgit2#7185 * fix(smart): keep caps across RPC stream resets by @weihanglo in libgit2/libgit2#7183 * fix wrong comment by @Murmele in libgit2/libgit2#7181 * fix(sha256): pass correct oid type by @weihanglo in libgit2/libgit2#7179 * examples: correct `git_commit_time` comment by @qaqland in libgit2/libgit2#7175 * tests: update to latest clar by @ethomson in libgit2/libgit2#7173 * delta: fix undefined behavior in hdr_sz varint parsing by @Oblivionsage in libgit2/libgit2#7172 * ci: Update macos-13 to macos-14 images on GitHub Actions by @ambv in libgit2/libgit2#7167 * ci: Fix cases of -Werror=discarded-qualifiers raised by @gcc 15.2 by @ambv in libgit2/libgit2#7164 * Use CMAKE_INSTALL_INCLUDEDIR for libgit2package INSTALL_INTERFACE by @aware70 in libgit2/libgit2#7155 * Fix C4703 uninitialized pointer variable warnings by @ShiningMassXAcc in libgit2/libgit2#7154 * test: check the correct filesystem for case-sensitivity by @ambv in libgit2/libgit2#7153 * ci: update ci/docker/fedora to work with Rawhide 44 by @ambv in libgit2/libgit2#7152 * refs: honor REFSPEC_SHORTHAND for multi-segment refs by @roberth in libgit2/libgit2#7148 * config: Fix potential null value passed to %s by @orgads in libgit2/libgit2#7131 * Fix potential access to uninitialized variables by @orgads in libgit2/libgit2#7130 * refspec: Detect DEL character in is_valid_name by @xokdvium in libgit2/libgit2#7120 * Update documentation to clarify that cert cb is always called by @ehuss in libgit2/libgit2#7119 * Update `racy.c` reference by @emmanuel-ferdman in libgit2/libgit2#7091 * Avoid duplicate definition of git_http_auth_dummy. by @JohannesWilde in libgit2/libgit2#7077
netbsd-srcmastr
pushed a commit
to NetBSD/pkgsrc
that referenced
this pull request
May 13, 2026
v1.9.3 This release includes a number of bugfixes and compatibility improvements, particularly around SHA256 support. * cmake: fix linker error when using ninja build generator by @kcsaul in libgit2/libgit2#7249 * Handle redirects with Content-Length: 0 correctly by @ethomson in libgit2/libgit2#7246 * ci: use poxygit v0.8.1 in the tests by @ethomson in libgit2/libgit2#7248 * Zero indexer stats in pack objects by @ethomson in libgit2/libgit2#7243 * submodule: git_index_add_bypath does not move conflict entries to REUC by @lrm29 in libgit2/libgit2#7003 * fix: prevent SSH timeout infinite loop and enable TCP keepalive by @ambv in libgit2/libgit2#7165 * merge_files: avoid UB in xdiff by @ethomson in libgit2/libgit2#7239 * git_merge_file_from_index: handle cases when a child (ours or theirs) is null by @eantoranz in libgit2/libgit2#7092 * cmake: write git.h.tmp to current binary directory by @kcsaul in libgit2/libgit2#7241 * fix(pack): ensure pack_backend__read returns null terminated buffer by @kanru in libgit2/libgit2#7238 * Check object lengths against headers in read_loose by @howtonotwin in libgit2/libgit2#7178 * cmake: don't recreate git2.h unnecessarily by @ethomson in libgit2/libgit2#7234 * Memory Backend Corruption Fix by @kcsaul in libgit2/libgit2#7232 * Fixed a heap-buffer-overflow in the smart_pkt.c:set_data function by @oliverchang in libgit2/libgit2#7118 * fix(transport): get oid_type on local transport by @weihanglo in libgit2/libgit2#7229 * `GIT_REMOTE_DOWNLOAD_TAGS_ALL`: remove stray "the" in docs by @DanielEScherzer in libgit2/libgit2#7228 * fix(clone): propagate object format in local clone by @weihanglo in libgit2/libgit2#7226 * repo: Fix possible null pointer dereference by @csware in libgit2/libgit2#7225 * revparse: Allow `HEAD` abbreviation `@` by @KoviRobi in libgit2/libgit2#7218 * camke: include libssh2 in `Requires.private` in the PC file by @carlosmn in libgit2/libgit2#7215 * futils: fix undefined behavior in O_FSYNC fallback definition by @cehoffman in libgit2/libgit2#7211 * pcre: actually fix dangling-pointer warning by @ethomson in libgit2/libgit2#7206 * pcre: update cmake warnings for non-gcc by @ethomson in libgit2/libgit2#7205 * Fix some warnings with gcc by @ethomson in libgit2/libgit2#7203 * fix: apply insteadOf from global config for detached remotes by @weihanglo in libgit2/libgit2#7195 * Fix `git_index_entry` documentation by @bakersdozen123 in libgit2/libgit2#7192 * config: Fix potential null value passed to %s by @ethomson in libgit2/libgit2#7190 * index: support USE_NSEC=OFF by @ethomson in libgit2/libgit2#7187 * feat(remote): expose `git_remote_oid_type` by @weihanglo in libgit2/libgit2#7185 * fix(smart): keep caps across RPC stream resets by @weihanglo in libgit2/libgit2#7183 * fix wrong comment by @Murmele in libgit2/libgit2#7181 * fix(sha256): pass correct oid type by @weihanglo in libgit2/libgit2#7179 * examples: correct `git_commit_time` comment by @qaqland in libgit2/libgit2#7175 * tests: update to latest clar by @ethomson in libgit2/libgit2#7173 * delta: fix undefined behavior in hdr_sz varint parsing by @Oblivionsage in libgit2/libgit2#7172 * ci: Update macos-13 to macos-14 images on GitHub Actions by @ambv in libgit2/libgit2#7167 * ci: Fix cases of -Werror=discarded-qualifiers raised by @gcc 15.2 by @ambv in libgit2/libgit2#7164 * Use CMAKE_INSTALL_INCLUDEDIR for libgit2package INSTALL_INTERFACE by @aware70 in libgit2/libgit2#7155 * Fix C4703 uninitialized pointer variable warnings by @ShiningMassXAcc in libgit2/libgit2#7154 * test: check the correct filesystem for case-sensitivity by @ambv in libgit2/libgit2#7153 * ci: update ci/docker/fedora to work with Rawhide 44 by @ambv in libgit2/libgit2#7152 * refs: honor REFSPEC_SHORTHAND for multi-segment refs by @roberth in libgit2/libgit2#7148 * config: Fix potential null value passed to %s by @orgads in libgit2/libgit2#7131 * Fix potential access to uninitialized variables by @orgads in libgit2/libgit2#7130 * refspec: Detect DEL character in is_valid_name by @xokdvium in libgit2/libgit2#7120 * Update documentation to clarify that cert cb is always called by @ehuss in libgit2/libgit2#7119 * Update `racy.c` reference by @emmanuel-ferdman in libgit2/libgit2#7091 * Avoid duplicate definition of git_http_auth_dummy. by @JohannesWilde in libgit2/libgit2#7077
netbsd-srcmastr
pushed a commit
to NetBSD/pkgsrc
that referenced
this pull request
May 21, 2026
v1.9.3 This release includes a number of bugfixes and compatibility improvements, particularly around SHA256 support. * cmake: fix linker error when using ninja build generator by @kcsaul in libgit2/libgit2#7249 * Handle redirects with Content-Length: 0 correctly by @ethomson in libgit2/libgit2#7246 * ci: use poxygit v0.8.1 in the tests by @ethomson in libgit2/libgit2#7248 * Zero indexer stats in pack objects by @ethomson in libgit2/libgit2#7243 * submodule: git_index_add_bypath does not move conflict entries to REUC by @lrm29 in libgit2/libgit2#7003 * fix: prevent SSH timeout infinite loop and enable TCP keepalive by @ambv in libgit2/libgit2#7165 * merge_files: avoid UB in xdiff by @ethomson in libgit2/libgit2#7239 * git_merge_file_from_index: handle cases when a child (ours or theirs) is null by @eantoranz in libgit2/libgit2#7092 * cmake: write git.h.tmp to current binary directory by @kcsaul in libgit2/libgit2#7241 * fix(pack): ensure pack_backend__read returns null terminated buffer by @kanru in libgit2/libgit2#7238 * Check object lengths against headers in read_loose by @howtonotwin in libgit2/libgit2#7178 * cmake: don't recreate git2.h unnecessarily by @ethomson in libgit2/libgit2#7234 * Memory Backend Corruption Fix by @kcsaul in libgit2/libgit2#7232 * Fixed a heap-buffer-overflow in the smart_pkt.c:set_data function by @oliverchang in libgit2/libgit2#7118 * fix(transport): get oid_type on local transport by @weihanglo in libgit2/libgit2#7229 * `GIT_REMOTE_DOWNLOAD_TAGS_ALL`: remove stray "the" in docs by @DanielEScherzer in libgit2/libgit2#7228 * fix(clone): propagate object format in local clone by @weihanglo in libgit2/libgit2#7226 * repo: Fix possible null pointer dereference by @csware in libgit2/libgit2#7225 * revparse: Allow `HEAD` abbreviation `@` by @KoviRobi in libgit2/libgit2#7218 * camke: include libssh2 in `Requires.private` in the PC file by @carlosmn in libgit2/libgit2#7215 * futils: fix undefined behavior in O_FSYNC fallback definition by @cehoffman in libgit2/libgit2#7211 * pcre: actually fix dangling-pointer warning by @ethomson in libgit2/libgit2#7206 * pcre: update cmake warnings for non-gcc by @ethomson in libgit2/libgit2#7205 * Fix some warnings with gcc by @ethomson in libgit2/libgit2#7203 * fix: apply insteadOf from global config for detached remotes by @weihanglo in libgit2/libgit2#7195 * Fix `git_index_entry` documentation by @bakersdozen123 in libgit2/libgit2#7192 * config: Fix potential null value passed to %s by @ethomson in libgit2/libgit2#7190 * index: support USE_NSEC=OFF by @ethomson in libgit2/libgit2#7187 * feat(remote): expose `git_remote_oid_type` by @weihanglo in libgit2/libgit2#7185 * fix(smart): keep caps across RPC stream resets by @weihanglo in libgit2/libgit2#7183 * fix wrong comment by @Murmele in libgit2/libgit2#7181 * fix(sha256): pass correct oid type by @weihanglo in libgit2/libgit2#7179 * examples: correct `git_commit_time` comment by @qaqland in libgit2/libgit2#7175 * tests: update to latest clar by @ethomson in libgit2/libgit2#7173 * delta: fix undefined behavior in hdr_sz varint parsing by @Oblivionsage in libgit2/libgit2#7172 * ci: Update macos-13 to macos-14 images on GitHub Actions by @ambv in libgit2/libgit2#7167 * ci: Fix cases of -Werror=discarded-qualifiers raised by @gcc 15.2 by @ambv in libgit2/libgit2#7164 * Use CMAKE_INSTALL_INCLUDEDIR for libgit2package INSTALL_INTERFACE by @aware70 in libgit2/libgit2#7155 * Fix C4703 uninitialized pointer variable warnings by @ShiningMassXAcc in libgit2/libgit2#7154 * test: check the correct filesystem for case-sensitivity by @ambv in libgit2/libgit2#7153 * ci: update ci/docker/fedora to work with Rawhide 44 by @ambv in libgit2/libgit2#7152 * refs: honor REFSPEC_SHORTHAND for multi-segment refs by @roberth in libgit2/libgit2#7148 * config: Fix potential null value passed to %s by @orgads in libgit2/libgit2#7131 * Fix potential access to uninitialized variables by @orgads in libgit2/libgit2#7130 * refspec: Detect DEL character in is_valid_name by @xokdvium in libgit2/libgit2#7120 * Update documentation to clarify that cert cb is always called by @ehuss in libgit2/libgit2#7119 * Update `racy.c` reference by @emmanuel-ferdman in libgit2/libgit2#7091 * Avoid duplicate definition of git_http_auth_dummy. by @JohannesWilde in libgit2/libgit2#7077
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
macos-13 is no longer available, any PR triggering Mac builds is currently failing.