-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 23 Sep 2026 08:25:08 +0100
Source: buildstream
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 2.8.1-1
Distribution: unstable
Urgency: high
Maintainer: Debian GNOME Maintainers <pkg-gnome-maintainers@lists.alioth.debian.org>
Changed-By: Theodore Tucker <theodore@tti0.net>
Changes:
buildstream (2.8.1-1) unstable; urgency=high
.
* New upstream release
- SECURITY UPDATE: Improper link resolution before file access
('link following') vulnerability in the `tar` source plugin
when running on Python < 3.12
- CVE-2026-82331
* d/copyright: update for upstream 2.8.1
Checksums-Sha1:
ce6eff02c02b44c4f8cf54eb8de786c8f6c9c870 2957 buildstream_2.8.1-1.dsc
d073c9748e035432ca20528e238ea8be55db66c1 1701491 buildstream_2.8.1.orig.tar.gz
764baf9e481f4207fd5370250d87c4a7c328e243 7764 buildstream_2.8.1-1.debian.tar.xz
03cf8f999890a2830e0729bbce40cd75970fa530 8014 buildstream_2.8.1-1_source.buildinfo
Checksums-Sha256:
b2b4434be31261401ba021abe9f933ff70f1ebd28b2144c6cb0011fdb7bf5c01 2957 buildstream_2.8.1-1.dsc
7dc48b4a3195a76079951fd15c6fb7be1f2e9a946f079d22a77ede4c022540cd 1701491 buildstream_2.8.1.orig.tar.gz
58da7f06f03c051e1e8ca723c738953ceade48ebcf12f8d08ec40beaf43ca49e 7764 buildstream_2.8.1-1.debian.tar.xz
8ef655532cf5e348de7fd043509d4313319fbf421687aa8fe40d4c46bc63147c 8014 buildstream_2.8.1-1_source.buildinfo
Files:
31e3fb5f8f2ff3b46fcdac27845d7639 2957 gnome optional buildstream_2.8.1-1.dsc
729d87ba9eff6a6084f5a6150ad7ecd9 1701491 gnome optional buildstream_2.8.1.orig.tar.gz
ed13dd830cabeb1a24be43557ae74d6d 7764 gnome optional buildstream_2.8.1-1.debian.tar.xz
04cb73dfdfeb4afa50261c167a398bdf 8014 gnome optional buildstream_2.8.1-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmqz5rgACgkQ5mx3Wuv+
bH1l5g//Qx0ELgT0M0bIvoqino+OOJwGapnb8KRkjepI+wTNofT6wMse9qKzy6EQ
FtVXTn8yNhWtkVX6N349MLVX6r4h0cXvTsbkku3BE7PLOQaRImtXZNr1QnBaztBt
M0kH6uuF4USRUIh3bqIBAgoyCeqtXgwkChpL3GoLtBjFUG5kCYdrS2iLpS6aGsPS
axePF+lqP/j3sm0BFeVYmkzXB/ETen2nf+elrpIJClV7/zOVH1YRBr6JdCrVCG0Y
dzl5kQGG60HoSXGA4Vwy1b12MHPGgHdSAl/wj7wMPtUG4rYetb43gtfWm3yxkqSQ
biggzhMnuvByVSGv/4h8E8dz5kv0NJGY6O0/Lr9wAcjiAnBAbjzRG6SdXwbW/6oT
RjVm6745kvEfmgjPTxyGp1m3FBeULUsC4bAC1iugFpRJ5S6WJKfaekXCszID8Jpo
J2bFSO4jpwvg+dxjO0AZxRxe0KBn7U+g0nFGLhxsAGltua8YTdArHVUxA697kO1k
n417kzzhhgcHTWaOAJFpFlof3/ljBHJZuY5TOGQFAPB4Ed6ZM3XUJeG8UbHNB1DJ
TVxbMl3AnjHeCE0GI8J8qLgsi2umPa3COSvO8+RApIKFkyauug8DnrtpqzW/CwQ9
2xQHSCF0/zlEp/tbWG2La6jZnFlLmMLWWTdYGODrgtvr7KjbKXU=
=bZeY
-----END PGP SIGNATURE-----
