Install git From Source on Ubuntu
When apt doesn’t give you the latest version on an AWS EC2 Ubuntu instance
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⚙️ Part of my series on Automating Cybersecurity Metrics. The Code.
🔒 Related Stories: GitHub Security | Application Security | Secure Code | Ubuntu on AWS
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
So I reinstall git and run the clone command above in the folder where I want to download the git repository.
Next I check out the read me (scroll down):
Which sends me to an install file which has a lot of instructions but the pertinent ones to me are:
Normally you can just do “make” followed by “make install”, and that will install the git programs in your own ~/bin/ directory.
Sounds simple right? (ahahahaha)
Let’s try it. I get into the change to the git directory and run the commands.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*QKz412U7IdLMWL4Mj5NDLQ.png)
I have to install make. Having make on your host can be a security weakness if you don’t need it, but I need it.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*tKAUfXAB8reu6z4Ko0WuDw.png)
Let the fun begin. I’m missing some requirements for the build. Why do I need oss-fuzz to build git for source code management? Hmm. Ok. Maybe for some commands that perform testing of some kind.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*C1cjstjuIvlIVX87ms5smg.png)
The instructions and Make file are, as one would expect, complicated for this app. I grep the Makefile for oss-fuzz.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*uS76lMKMGZPjCQJW4z5Btw.png)
Then I check some of the code around the first line to see what it’s doing. As expected, I can see that this code is not really required. It is for testing. A comment says to install it anyway to prevent “bit-rot” ??
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*A5SXFUtVTo79s50VwDg1zQ.png)
What is bit rot?
Data degradation is the gradual corruption of computer data due to an accumulation of non-critical failures in a data storage device. The phenomenon is also known as data decay, data rot or bit rot.
https://en.wikipedia.org/wiki/Data_degradation
Well I’m not sure how much I have to worry about bit rot on this temp VM. Maybe I can remove this section of code. This particular comment is really very interesting to me but I don’t have time to explore it further right now. I’m curious about the security implications of this existing on developer machines if this is truly included in every build…but I digress.
I could just comment it out but this doesn’t solve all my problems.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*bBIfY2ouQluyW3kb5bVFag.png)
Well, scrolling down further in the install instructions (because nothing is ever easy with Linux and Make, etc.) I find a bunch of things I need to install or change and to avoid boring you with the details here are the changes I made.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*kHaC5eMPCxkonq_oOtmQ9g.png)
I run locate zlib and a bunch of things come up so I hope that one is covered. I don’t know if those are the correct versions of zlib. Apt can’t find zlib. I’ll hope for the best.
I think these are covered:
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*6TH9wFxnXBRjV8330YJMBQ.png)
I don’t think I need this PERL functionality.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*tVPycKmhMsSeOerDBDdOWw.png)
NO_PERL basically depends on a PERL_PATH so comment out the section that sets the Perl path to a default if undefined:
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*YLuNsSKxFazjpjNaMvLdKA.png)
I’m not going to and do not want any email sending functionality. But pretty sure I have OpenSSL anyway and I can get the latest version of libcurl. If I set NO_OPENSSL perhaps the mail functionality is still there but unencrypted. That’s not good. I’ll leave it but make sure I have an updated version of libcurl and open ssl.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*ZffUu9xInTme886QVmxL9A.png)
I installed apt-show-versions so I can see what versions I have running.
sudo apt install apt-show-versions
Well it doesn’t show the packages are available, but they seem to be installed when I use locate (installed in an earlier post in this Ubuntu series.) However, the version of libcurl is 3 or 4. Hmm. But just out of curiosity I checked the version of curl:
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*Uju2KPe8ku1joAs8OBe4ww.png)
This shows that libcurl is at version 7.81.0. Aha. There’s zlib.
Open SSL is at version 3.0.2.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*n6PSMbjLqrrkucmErPI9Fg.png)
We don’t really need these if they cause a problem:
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*SEr1ndDkdsDs8wK24rB8Xw.png)
In my case, I could also disable localization:
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*j2aAJ-FLW5bIWZfqZLqeQw.png)
I’ve got python.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*PwN1Abrfg-mPOhWCwPSeAw.png)
Well it seems like I should have most everything but when I run make again I get this:
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*UcIiDO2U0cyAHxjW_W9u9A.png)
This page hints at some development version of this library:
When I try to install it I get this error:
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*xCcQvCuSdaiH4XYYSyfRVg.png)
OK let’s install the first one:
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*KvFlM7d2-a6IYDxhrOlJ_w.png)
Next error — daemon.o — something is missing. It’s not super clear.
Random internet searching led me to this page cached page of a now deprecated google group (the page no longer exists) which hints I need to install gcc:
So I did:
sudo apt-get install gcc
Next error:
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*eiYK_zpsPfFy3AeoCmWhhg.png)
By the way I also added V=1 at the top of the make file to get more verbose output. I didn’t see any additional information from the error message initially but perhaps installing gcc let to this more verbose output.
Anyway, I have OpenSSL installed. Hmm. Don’t ask me how but I guessed I needed this:
sudo apt-get install libssl-dev
Next:
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*mRToXoZ5nZI8F01gZ_8OPg.png)
sudo apt-get install libz-dev
Progress. Next time I run make I’m getting a bunch of output like this:
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*8XMr6if8aocQlK0UtgzZ1Q.png)
So close, and yet so far.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*4ijG2jSDaQF3UILmD-A61w.png)
I read at the top of the make file I can skip expat. It’s an XML-parsing library. But we can also just install it as explained here:
Except that the library is not found.
Also, if you don’t install it you can’t use http push with Git.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*fcyABkiZzaU6Cy8ZcmrY9g.png)
Might want that. Hmm. aha.
sudo apt-get install -y libexpat1-dev
But is that actually safe to install? What is libexpat1-dev?
I can search “libexpat1-dev security” in Google for security issues.
I can probably uninstall the libraries after I’m done since they weren’t required initially when I installed git. That would require some testing to ensure I didn’t break anything in the process.
Back in business until — some issues with Bulgarian language:
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*8UJ8vTg6R6EabQyd9HwY8g.png)
Well, as noted above I can set NO_GETTEXT for English only.
By the way I added all these flags to the top of my Makefile, including disabling IPV6 since I don’t allow it on my network.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*k4ZZSWd6TUgA8YN3hSKXZg.png)
Now I’m watching the long list of objects scroll by once again…
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*7I0cDIXSAdwhAwNVoTomHQ.png)
Woot! Make ran. But we’re not out of the woods yet. Now for make install.
Does all this mean it worked? I mean it says “done.”
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*J9BYhNApXR7omdJoCkdrdQ.png)
If I just try to run “git” at this point it will fail. Git is installed but not in my path. I can see from the path that it is installed at:
/home/ubuntu/bin
So I can cd over to that directory and list the files to confirm.
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*6akZLrTttkZs6Lznyaoajg.png)
Then I can execute git as a file with the version option to see which version is installed:
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/1*xF-JgUWkqYd9R7Na8txb9g.png)
Yay! Phew.
That was hideous. What a thrilling way to spend a Friday night.
There may be a better way but I like to see exactly what I’m installing rather than have some magic random tool install everything for me — along with the “gifts I don’t want” as I like to say in my security classes.
I tried using a command with apt to install the dependencies and it didn’t work. A tool called aptitude wanted me to add some repositories I wasn’t real keen on adding so I just stepped through all this instead. I didn’t actually need those other repositories, as you can see, so I find that tool a bit questionable at the moment. Perhaps it was related to the languages.
By the way I did remove the extraneous expat library.
sudo apt remove libexpat1-dev
You can do that with the other development libraries as well most likely.
Now I want to be able to run git from anywhere on my file system. But this post is long enough! I’ll get to that next.
Follow for updates.
Teri Radichel | © 2nd Sight Lab 2023
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab
Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation
Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
![](https://cdn-images-1.readmedium.com/v2/resize:fit:800/0*H9Ew1KCl-29nZiPR.jpeg)