-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 01 Nov 2026 17:32:24 +0000
Source: ostree
Architecture: source
Version: 2026.6-1
Distribution: unstable
Urgency: medium
Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.alioth.debian.org>
Changed-By: Simon McVittie <smcv@debian.org>
Changes:
ostree (2026.6-1) unstable; urgency=medium
.
* New upstream release
- Prevent symlink traversal if applying a malicious union-mode checkout
(GHSA-7pq7-3pmj-9wp6; not believed to be exploitable via Flatpak which
does not use layered union checkouts; also not believed to be
relevant to OS deployments such as bootc and "plain ostree", because
applying a malicious OS update would be a vulnerabilty anyway)
- Prevent deletion outside deployment root via crafted whiteouts
(GHSA-cp2j-qv7x-wcw4; same mitigations as above)
* d/p/static-delta-validate-bspatch-payload-offset-and-length.patch:
Drop patch that was applied upstream
* d/control: Remove Build-Depends-Indep: libglib2.0-doc.
GLib documentation is no longer built with gtk-doc, so it doesn't
provide link-rewriting for cross-references.
* d/salsa-ci.yml: Exercise arm64 cross-compilation
* d/salsa-ci.yml: Exercise nocheck and nodoc builds
* d/ostree-boot.lintian-overrides: Silence a false positive
Checksums-Sha1:
630980c6e7bf6b79d8020cf61ffc2949e87e3b60 3623 ostree_2026.6-1.dsc
07d3a08a5335f601f24ebbe6d7bc1cdece50d69b 2155004 ostree_2026.6.orig.tar.xz
571dbe8be9cfcf6534af437fd1c73c840acfbdd8 32432 ostree_2026.6-1.debian.tar.xz
f870d67d7b6aa04338a848b6da04b4077fae07dc 4096248 ostree_2026.6-1.git.tar.xz
8dfdc52846fa25000378c3ee8826951ceb41aa3a 17737 ostree_2026.6-1_source.buildinfo
Checksums-Sha256:
1970879584019da74931e045ad603512452829ae5f3d49891ccf8be240381a77 3623 ostree_2026.6-1.dsc
164b8226aea6a0e6601036de02a5e3b62307bae25890ed557fb4e19020bd5974 2155004 ostree_2026.6.orig.tar.xz
b872a8c03a5ea700ddcf000a75db994a18530e895adb83f32ea3b1652f966fc2 32432 ostree_2026.6-1.debian.tar.xz
03b566375113ae11f4083a9bda9e47840f7af3fbdced70803a4717e6377022e9 4096248 ostree_2026.6-1.git.tar.xz
231fb9755cc3b3f9f38df15ef7033baf784700f381ff948f72b0d5aef194bc7a 17737 ostree_2026.6-1_source.buildinfo
Files:
dd8c129a7a4ed9b5a5327d6155a5fa36 3623 admin optional ostree_2026.6-1.dsc
72c758864b69639a8853b05c1e79037f 2155004 admin optional ostree_2026.6.orig.tar.xz
dd3f223bc80e161ed1e388439adedde3 32432 admin optional ostree_2026.6-1.debian.tar.xz
94c2ab2260f1184a92999fdbe7adeb7f 4096248 admin None ostree_2026.6-1.git.tar.xz
3f11ecf7503a710b55d4f173aced24ba 17737 admin optional ostree_2026.6-1_source.buildinfo
Git-Tag-Info: tag=508680c2594e1a312b872b713da435d9fd3689ac fp=7a073ad1ae694fa25bff62e5235c099d3eb33076
Git-Tag-Tagger: Simon McVittie <smcv@debian.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrneHQACgkQYG0ITkaD
wHn3RxAAy2IEViDy2fJJFGmaodJbUvk+T+BwZxOGEaSq9nFzo7UjHm/2hf07T22p
qESBCcXKOAA+vuZsDemwQ3uHpIMoJFzrbrFiunr2Yll/xVxUZAfDdyFE4ea1f26W
XZtqoC6S5beAOl5wKQtg4cuqt0Vel6AuF2YETjgug0Ez8o0jYCCF8V4pvSrFPRWz
XrBurjo3XmZGRJ2kJhI7GBuIFXbGQkZoaLK0R9V1Ww9qVxm1N2ARzat14uhDduxG
KR1q7qo7woflNkjNFaO+8XePpYmjPfO5pbdHBkkAwMata35RbDFs07GgQj5SuNkb
IB5D/ydVCjviQPxhM+l2PjSdmMzH/Pk1oNNHvIDr+2GExhQ+kG2gHK15BJy4bCzw
u8Qn7Gd0BhUjnQfo/yKV2teJQlA5kLYku1VZGMG1zYiuvLNFQ1qdesNTld8c9v57
yqBbcVL/eiK6m2suzb6DbuC0QkejKRGZKyGTenhNBDhmj+F6maVm1piQE0GrjcCg
5v5wGvbtLyZjypnLHtvE7m+eryR/Ot4E+x2PIQh2A2rCERs731pegpxj9A6I3Lkn
wETfr9ggXhV0HcxShAduZIxqnMUor4lfjFlz1X231GfCYJGK0brvr0QixZMf/c0B
x5A3l27uH6yxX8pwjZqTMTzpSkEb3O9DPvuY+Pe4dTdILpsEXFc=
=ohch
-----END PGP SIGNATURE-----
