Debian Package Tracker
Register | Log in
Subscribe

golang-github-containers-buildah

Choose email to subscribe with

general
  • source: golang-github-containers-buildah (main)
  • version: 1.43.2+ds1-3
  • maintainer: Debian Go Packaging Team (DMD)
  • uploaders: Reinhard Tartler (DMD) – Dmitry Smirnov (DMD)
  • arch: all any
  • std-ver: 4.7.4
  • VCS: Git (Browse, QA)
versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]
[pool directory]
  • o-o-stable: 1.19.6+dfsg1-1
  • oldstable: 1.28.2+ds1-3+deb12u1
  • stable: 1.39.3+ds1-1
  • testing: 1.43.2+ds1-3
  • unstable: 1.43.2+ds1-3
  • exp: 1.45.0+ds1-2
versioned links
  • 1.19.6+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.28.2+ds1-3+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.39.3+ds1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.43.2+ds1-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
  • 1.45.0+ds1-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
binaries
  • buildah (2 bugs: 0, 2, 0, 0)
  • golang-github-containers-buildah-dev
action needed
Marked for autoremoval on 15 December due to golang-github-google-go-pkcs11, golang-gopkg-square-go-jose.v2: #1152786, #1153090 high
Version 1.43.2+ds1-3 of golang-github-containers-buildah is marked for autoremoval from testing on Tue 15 Dec 2026. It depends (transitively) on golang-github-google-go-pkcs11, golang-gopkg-square-go-jose.v2, affected by #1152786, #1153090. You should try to prevent the removal by fixing these RC bugs.
Created: 2026-11-08 Last update: 2026-11-13 11:02
A new upstream version is available: 1.46.1 high
A new upstream version 1.46.1 is available, you should consider packaging it.
Created: 2026-08-12 Last update: 2026-11-13 08:02
Failed to analyze the VCS repository. Please troubleshoot and fix the issue. high
vcswatch reports that there is an error with this package's VCS, or the debian/changelog file inside it. Please check the error shown below and try to fix it. You might have to update the VCS URL in the debian/control file to point to the correct repository.

fatal: https://salsa.debian.org/go-team/packages/golang-github-containers-buildah.git/info/refs not valid: is this a git repository?
Created: 2026-09-07 Last update: 2026-11-13 07:01
1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:
  • CVE-2026-79705: A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
Created: 2026-09-16 Last update: 2026-09-17 03:30
1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:
  • CVE-2026-79705: A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.
Created: 2026-09-16 Last update: 2026-09-17 03:30
1 open merge request in Salsa normal
There is 1 open merge request for this package on Salsa. You should consider reviewing and/or merging these merge requests.
Created: 2026-11-04 Last update: 2026-11-04 21:02
1 low-priority security issue in trixie low

There is 1 open security issue in trixie.

1 issue left for the package maintainer to handle:
  • CVE-2026-79705: (needs triaging) A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

You can find information about how to handle this issue in the security team's documentation.

1 issue that should be fixed with the next stable update:
  • CVE-2026-44517: Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build. This issue is fixed in versions 1.43.2 and 1.44.0.
Created: 2026-09-16 Last update: 2026-09-17 03:30
debian/patches: 4 patches to forward upstream low

Among the 6 debian patches available in version 1.43.2+ds1-3 of the package, we noticed the following issues:

  • 4 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.
Created: 2023-02-26 Last update: 2026-08-11 18:31
news
[rss feed]
  • [2026-09-07] Accepted golang-github-containers-buildah 1.45.0+ds1-2 (source) into experimental (Reinhard Tartler)
  • [2026-09-07] Accepted golang-github-containers-buildah 1.45.0+ds1-1 (source) into experimental (Reinhard Tartler)
  • [2026-08-17] golang-github-containers-buildah 1.43.2+ds1-3 MIGRATED to testing (Debian testing watch)
  • [2026-08-11] Accepted golang-github-containers-buildah 1.43.2+ds1-3 (source) into unstable (Nilesh Patra)
  • [2026-08-11] Accepted golang-github-containers-buildah 1.43.2+ds1-2 (source) into unstable (Nilesh Patra)
  • [2026-07-01] golang-github-containers-buildah 1.43.2+ds1-1 MIGRATED to testing (Debian testing watch)
  • [2026-06-28] Accepted golang-github-containers-buildah 1.43.2+ds1-1 (source) into unstable (Reinhard Tartler)
  • [2026-06-28] Accepted golang-github-containers-buildah 1.43.1+ds1-3 (source) into unstable (Reinhard Tartler)
  • [2026-06-27] Accepted golang-github-containers-buildah 1.43.1+ds1-2 (source) into unstable (Reinhard Tartler)
  • [2026-04-13] golang-github-containers-buildah 1.43.1+ds1-1 MIGRATED to testing (Debian testing watch)
  • [2026-04-09] Accepted golang-github-containers-buildah 1.43.1+ds1-1 (source) into unstable (Reinhard Tartler)
  • [2026-03-29] golang-github-containers-buildah 1.43.0+ds1-2 MIGRATED to testing (Debian testing watch)
  • [2026-03-24] Accepted golang-github-containers-buildah 1.43.0+ds1-2 (source) into unstable (Reinhard Tartler)
  • [2026-03-05] Accepted golang-github-containers-buildah 1.43.0+ds1-1 (source) into experimental (Reinhard Tartler)
  • [2025-12-03] golang-github-containers-buildah 1.42.1+ds1-2 MIGRATED to testing (Debian testing watch)
  • [2025-11-27] Accepted golang-github-containers-buildah 1.42.1+ds1-2 (source) into unstable (Reinhard Tartler)
  • [2025-11-22] Accepted golang-github-containers-buildah 1.42.1+ds1-1 (source) into experimental (Reinhard Tartler)
  • [2025-11-04] golang-github-containers-buildah 1.41.5+ds1-4 MIGRATED to testing (Debian testing watch)
  • [2025-10-26] Accepted golang-github-containers-buildah 1.41.5+ds1-4 (source) into unstable (Reinhard Tartler)
  • [2025-10-24] golang-github-containers-buildah 1.41.5+ds1-1 MIGRATED to testing (Debian testing watch)
  • [2025-10-19] Accepted golang-github-containers-buildah 1.41.5+ds1-3 (source) into experimental (Reinhard Tartler)
  • [2025-10-17] Accepted golang-github-containers-buildah 1.41.5+ds1-2 (source) into experimental (Reinhard Tartler)
  • [2025-10-03] Accepted golang-github-containers-buildah 1.41.5+ds1-1 (source) into unstable (Reinhard Tartler)
  • [2025-09-25] golang-github-containers-buildah 1.41.4+ds1-3 MIGRATED to testing (Debian testing watch)
  • [2025-09-20] Accepted golang-github-containers-buildah 1.41.4+ds1-3 (source) into unstable (Reinhard Tartler)
  • [2025-09-18] Accepted golang-github-containers-buildah 1.41.4+ds1-2 (source) into experimental (Reinhard Tartler)
  • [2025-09-07] Accepted golang-github-containers-buildah 1.41.4+ds1-1 (source) into experimental (Reinhard Tartler)
  • [2025-03-27] golang-github-containers-buildah 1.39.3+ds1-1 MIGRATED to testing (Debian testing watch)
  • [2025-03-18] Accepted golang-github-containers-buildah 1.39.3+ds1-1 (source) into unstable (Reinhard Tartler)
  • [2025-02-15] golang-github-containers-buildah 1.39.0+ds1-1 MIGRATED to testing (Debian testing watch)
  • 1
  • 2
bugs [bug history graph]
  • all: 2
  • RC: 0
  • I&N: 2
  • M&W: 0
  • F&P: 0
  • patch: 0
links
  • homepage
  • lintian
  • buildd: logs, exp, reproducibility, cross
  • popcon
  • browse source code
  • other distros
  • security tracker
  • debian patches
  • debci
ubuntu Ubuntu logo [Information about Ubuntu for Debian Developers]
  • version: 1.43.2+ds1-3
  • 2 bugs

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers
Report problems to the tracker.debian.org pseudo-package in the Debian BTS.
Documentation — Bugs — Git Repository — Contributing