Harden the request path, scan and error recovery

1 file changed, 13 insertions, 15 deletions

diff --git a/source/cgit.mk b/source/cgit.mkindex 1199278..4109930 100644--- a/source/cgit.mk+++ b/source/cgit.mk@@ -27,18 +27,14 @@ CGIT_BUILD = $(CGIT_ROOT)/$(BUILDDIR) # The CGIT_ values used below are exported by the top level Makefile. $(CGIT_BUILD)/VERSION: force-version 	@mkdir -p $(CGIT_BUILD)/-	@cd $(CGIT_ROOT) && '$(SHELL_PATH_SQ)' $(TOOLSDIR)/gen-version.sh "$(CGIT_VERSION)" $(BUILDDIR)/VERSION+	@cd $(CGIT_ROOT) && \+		'$(SHELL_PATH_SQ)' $(TOOLSDIR)/gen-version.sh "$(CGIT_VERSION)" $(BUILDDIR)/VERSION -include $(CGIT_BUILD)/VERSION .PHONY: force-version -# The language the cgit sources are written in. Both GCC and Clang default to-# this today, so pinning it changes nothing now and stops the meaning of the-# sources drifting when a compiler moves its default on, as GCC 15 did by-# defaulting to gnu23. The GNU dialect rather than plain c17 because git's-# headers use GNU extensions, and because dlsym cannot be used through a-# conforming cast. Only the cgit objects are held to this, and Git keeps-# whatever its own build decides, which on some platforms is a different-# standard again.+# Pinned so a compiler moving its default, as GCC 15 did to gnu23, cannot+# change what the sources mean. The GNU dialect because git's headers use GNU+# extensions and dlsym needs a non-conforming cast. Git keeps its own choice. CGIT_STD ?= gnu17  # CGIT_CFLAGS is tracked separately so that changing it does not force a rebuild@@ -157,12 +153,14 @@ $(CGIT_BUILD)/.depend: $(CGIT_BUILD)/CGIT-CFLAGS: FORCE 	@mkdir -p $(CGIT_BUILD)/ 	@FLAGS='$(subst ','\'',$(CGIT_CFLAGS))'; \-	    if test x"$$FLAGS" != x"`cat $(CGIT_BUILD)/CGIT-CFLAGS 2>/dev/null`" ; then \-		echo 1>&2 "    * new CGit build flags"; \-		echo "$$FLAGS" >$(CGIT_BUILD)/CGIT-CFLAGS; \-	    fi--$(CGIT_OBJS): $(CGIT_BUILD)/%.o: $(CGIT_SRC)/%.c GIT-CFLAGS $(CGIT_BUILD)/CGIT-CFLAGS $(missing_dep_dirs)+		OLD=`cat $(CGIT_BUILD)/CGIT-CFLAGS 2>/dev/null`; \+		if test x"$$FLAGS" != x"$$OLD"; then \+			echo 1>&2 "    * new CGit build flags"; \+			echo "$$FLAGS" >$(CGIT_BUILD)/CGIT-CFLAGS; \+		fi++$(CGIT_OBJS): $(CGIT_BUILD)/%.o: $(CGIT_SRC)/%.c GIT-CFLAGS $(CGIT_BUILD)/CGIT-CFLAGS \+		$(missing_dep_dirs) 	$(QUIET_CC)$(CC) -o $@ -c $(dep_args) $(ALL_CFLAGS) $(EXTRA_CPPFLAGS) $(CGIT_CFLAGS) $<  $(CGIT_BUILD)/cgit: $(CGIT_OBJS) GIT-LDFLAGS $(GITLIBS)
diff --git a/source/cgit.mk b/source/cgit.mk
index 1199278..4109930 100644
--- a/source/cgit.mk
+++ b/source/cgit.mk
@@ -27,18 +27,14 @@ CGIT_BUILD = $(CGIT_ROOT)/$(BUILDDIR)
 # The CGIT_ values used below are exported by the top level Makefile.
 $(CGIT_BUILD)/VERSION: force-version
 	@mkdir -p $(CGIT_BUILD)/
-	@cd $(CGIT_ROOT) && '$(SHELL_PATH_SQ)' $(TOOLSDIR)/gen-version.sh "$(CGIT_VERSION)" $(BUILDDIR)/VERSION
+	@cd $(CGIT_ROOT) && \
+		'$(SHELL_PATH_SQ)' $(TOOLSDIR)/gen-version.sh "$(CGIT_VERSION)" $(BUILDDIR)/VERSION
 -include $(CGIT_BUILD)/VERSION
 .PHONY: force-version
 
-# The language the cgit sources are written in. Both GCC and Clang default to
-# this today, so pinning it changes nothing now and stops the meaning of the
-# sources drifting when a compiler moves its default on, as GCC 15 did by
-# defaulting to gnu23. The GNU dialect rather than plain c17 because git's
-# headers use GNU extensions, and because dlsym cannot be used through a
-# conforming cast. Only the cgit objects are held to this, and Git keeps
-# whatever its own build decides, which on some platforms is a different
-# standard again.
+# Pinned so a compiler moving its default, as GCC 15 did to gnu23, cannot
+# change what the sources mean. The GNU dialect because git's headers use GNU
+# extensions and dlsym needs a non-conforming cast. Git keeps its own choice.
 CGIT_STD ?= gnu17
 
 # CGIT_CFLAGS is tracked separately so that changing it does not force a rebuild
@@ -157,12 +153,14 @@ $(CGIT_BUILD)/.depend:
 $(CGIT_BUILD)/CGIT-CFLAGS: FORCE
 	@mkdir -p $(CGIT_BUILD)/
 	@FLAGS='$(subst ','\'',$(CGIT_CFLAGS))'; \
-	    if test x"$$FLAGS" != x"`cat $(CGIT_BUILD)/CGIT-CFLAGS 2>/dev/null`" ; then \
-		echo 1>&2 "    * new CGit build flags"; \
-		echo "$$FLAGS" >$(CGIT_BUILD)/CGIT-CFLAGS; \
-	    fi
-
-$(CGIT_OBJS): $(CGIT_BUILD)/%.o: $(CGIT_SRC)/%.c GIT-CFLAGS $(CGIT_BUILD)/CGIT-CFLAGS $(missing_dep_dirs)
+		OLD=`cat $(CGIT_BUILD)/CGIT-CFLAGS 2>/dev/null`; \
+		if test x"$$FLAGS" != x"$$OLD"; then \
+			echo 1>&2 "    * new CGit build flags"; \
+			echo "$$FLAGS" >$(CGIT_BUILD)/CGIT-CFLAGS; \
+		fi
+
+$(CGIT_OBJS): $(CGIT_BUILD)/%.o: $(CGIT_SRC)/%.c GIT-CFLAGS $(CGIT_BUILD)/CGIT-CFLAGS \
+		$(missing_dep_dirs)
 	$(QUIET_CC)$(CC) -o $@ -c $(dep_args) $(ALL_CFLAGS) $(EXTRA_CPPFLAGS) $(CGIT_CFLAGS) $<
 
 $(CGIT_BUILD)/cgit: $(CGIT_OBJS) GIT-LDFLAGS $(GITLIBS)