-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Thu, 20 Aug 2026 20:16:44 +0100 Source: ostree Architecture: source Version: 2026.4-1 Distribution: unstable Urgency: medium Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org> Changed-By: Simon McVittie <smcv@debian.org> Closes: 1144283 Changes: ostree (2026.4-1) unstable; urgency=medium . * New upstream release - Fix regression when downloading large Flatpak apps/runtimes (reopens: #1144105) (Closes: #1144283) * d/p/static-delta-validate-bspatch-payload-offset-and-length.patch: Add post-release patch to fix offset validation. This was an out-of-bounds read when downloading from a malicious/crafted ostree repository, but is not believed to be practically exploitable for anything worse than a crash (denial-of-service). * Mention #1144105, #1144106 in previous changelog entry Checksums-Sha1: 07c6c9a404da2898f100a5759e3a6699c928f2c8 3659 ostree_2026.4-1.dsc be31484d5c00353b6c3d966750c83eb44a8a53d0 2141564 ostree_2026.4.orig.tar.xz 12b48ff7d96c87988c7876e2091b92a61c961927 32388 ostree_2026.4-1.debian.tar.xz c92fa07d27f72b9b4447340ff03c6c141cd597f9 4404808 ostree_2026.4-1.git.tar.xz eaec49b59524ecf5d5b322673d96a740bbccf948 17660 ostree_2026.4-1_source.buildinfo Checksums-Sha256: fe860de2bd97e6cb51964238cab33b680905edaeed3d5dd21b813e71c3fe19f8 3659 ostree_2026.4-1.dsc b26c9016eb03bb4ee52cc00c642d56e00fc79ae7faac6bf4aa317d7451339ef7 2141564 ostree_2026.4.orig.tar.xz 88138ea5ab0c0a8dfa5e0eea991ef308e5f70b44f3b2ce10f4bf6c93e1d35d38 32388 ostree_2026.4-1.debian.tar.xz 82c6e8eacbc3d6a9f15cd566dd667acf455dd6a5cc12790efdb9bdf6bf2af954 4404808 ostree_2026.4-1.git.tar.xz ffdb7973926bf001b20ce5dca311bf10ce007023652c8d41b8ab08d1d309132d 17660 ostree_2026.4-1_source.buildinfo Files: f23b4b366843ad133268cf2091b81d6f 3659 admin optional ostree_2026.4-1.dsc 22d3422529c07eef716fea8a6c9b0c2b 2141564 admin optional ostree_2026.4.orig.tar.xz d880d033e7125ecb69e7b8e8fbb6522d 32388 admin optional ostree_2026.4-1.debian.tar.xz 7389dee2cf3f871f1e2fb656b786791b 4404808 admin None ostree_2026.4-1.git.tar.xz 17d23b44b3169c15b74c4b36172498ba 17660 admin optional ostree_2026.4-1_source.buildinfo Git-Tag-Info: tag=5b299e2d91e6d04ca690a674004237f6127aa26f fp=7a073ad1ae694fa25bff62e5235c099d3eb33076 Git-Tag-Tagger: Simon McVittie <smcv@debian.org> -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmqHVmMACgkQYG0ITkaD wHnBgQ//Q9BXJf4onNGDNZb1LxLc1HQob5wDZ0gN23VuSr5qX1cbxaIO0+AO/d+j Ngl5zWr4cuuSjHcVCwHcrx35Oss5zY6A8COOkqq8UIoVRK6mzsPh4hXqTuMw1rEX f6uqN0MgXfT0Z4/CSvFC4csWjCYqerFGEe1ZgONUzULulIlWPXkPsXQlUBR4G7NY SXZ+beXI2yDGmbqfbMLPogLaG63k7dmkfggbu1UxRfOECu9jntkJyQiDyb/tdYRZ l++ss9T/HMPti2q5RXb1bljRP9db+Nu3cZqJYhyo3EVRk34D7SxDUMa3MDtvzM2Q zrOfKQAOaNoXMbsw6u8wyF8yT3xqTzYd8OtB7jyQKF1bMM13aXNLVNEW23RxCAot 8fdkD2ajtr1TeCv4MNbiICeNw+9i0+G2b4xE7pT7k4F0K4hWEiCtlI47goKVmtZW /2HsNetjPc7d+Ze+Ohv9Emp1HSh+lw5zzW6NHOXUTU5vdMYHO52voiNYZeUtYuLX wZt7+XJNLFkD6EqPETM5QtFtCSK2tVJkYAlF1mEYFk/IQjh0azXsbAso2dwMRQV4 vhl6Oeb+el4DyMDk4AkUcaTo57Szj+k2+Db7sClUpnkPJ93asbEfwv9hAHRYW5Kv XGhWwqyjbIAxcl6poV/Lev2CrQQIdhZnPGwVvzqjziKYXO/Cef0= =nvHM -----END PGP SIGNATURE-----
