golang-github-theupdateframework-go-tuf

general

source: golang-github-theupdateframework-go-tuf (main)
version: 2.4.2+0.7.0-3
maintainer: Debian Go Packaging Team (DMD)
uploaders: Reinhard Tartler (DMD) – Simon Josefsson (DMD)
arch: all any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

old-bpo: 0.5.2-5~bpo12+1
stable: 2.0.2+0.7.0-1
testing: 2.4.2+0.7.0-3
unstable: 2.4.2+0.7.0-3

versioned links

0.5.2-5~bpo12+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.0.2+0.7.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.2+0.7.0-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

go-tuf
golang-github-theupdateframework-go-tuf-dev
golang-github-theupdateframework-go-tuf-v2-dev

action needed

2 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 1b0b2ce3ac977af18e317ee646321f4c09bfe613
Author: Simon Quigley <tsimonq2@debian.org>
Date:   Sun Oct 25 19:58:21 2026 -0500

    release

commit aca4c7136ae4dca8619ad45738c69822d05bbc88
Author: Juan Manuel Méndez Rey <juan.mendezr@proton.me>
Date:   Fri Oct 23 17:42:39 2026 +0200

    Do not install the go.mod of v0
    
    It names the module github.com/theupdateframework/go-tuf/v0. Go rejects
    /v0 as a major version suffix, and dh-go copies the name into a replace
    directive in go.work, so every dh-go build with this package installed
    fails.
    
    Closes: #1151720

Created: 2026-10-26 Last update: 2026-11-01 04:50

lintian reports 1 warning normal

Lintian reports 1 warning about this package. You should make the package lintian clean getting rid of them.

Created: 2026-10-26 Last update: 2026-10-26 12:01

3 low-priority security issues in trixie low

There are 3 open security issues in trixie.

3 issues left for the package maintainer to handle:

CVE-2026-23991: (needs triaging) go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, if the TUF repository (or any of its mirrors) returns invalid TUF metadata JSON (valid JSON but not well formed TUF metadata), the client will panic during parsing, causing a denial of service. The panic happens before any signature is validated. This means that a compromised repository/mirror/cache can DoS clients without having access to any signing key. Version 2.3.1 fixes the issue. No known workarounds are available.
CVE-2026-23992: (needs triaging) go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification to TUF metadata files is possible at rest, or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always make sure that the TUF metadata roles are configured with a threshold of at least 1.
CVE-2026-24686: (needs triaging) go-tuf is a Go implementation of The Update Framework (TUF). go-tuf's TAP 4 Multirepo Client uses the map file repository name string (`repoName`) as a filesystem path component when selecting the local metadata cache directory. Starting in version 2.0.0 and prior to version 2.4.1, if an application accepts a map file from an untrusted source, an attacker can supply a `repoName` containing traversal (e.g., `../escaped-repo`) and cause go-tuf to create directories and write the root metadata file outside the intended `LocalMetadataDir` cache base, within the running process's filesystem permissions. Version 2.4.1 contains a patch.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-01-23 Last update: 2026-10-30 00:30

news

[rss feed]

[2026-10-30] golang-github-theupdateframework-go-tuf 2.4.2+0.7.0-3 MIGRATED to testing (Debian testing watch)
[2026-10-26] Accepted golang-github-theupdateframework-go-tuf 2.4.2+0.7.0-3 (source) into unstable (Juan Manuel Méndez Rey) (signed by: Simon Quigley)
[2026-10-22] Accepted golang-github-theupdateframework-go-tuf 2.4.2+0.7.0-2 (source amd64 all) into unstable (Debian FTP Masters) (signed by: Otto Kekäläinen)
[2026-05-29] golang-github-theupdateframework-go-tuf 2.4.2+0.7.0-1 MIGRATED to testing (Debian testing watch)
[2026-05-25] Accepted golang-github-theupdateframework-go-tuf 2.4.2+0.7.0-1 (source) into unstable (Simon Josefsson)
[2026-03-24] golang-github-theupdateframework-go-tuf 2.4.1+0.7.0-2 MIGRATED to testing (Debian testing watch)
[2026-03-22] Accepted golang-github-theupdateframework-go-tuf 2.4.1+0.7.0-2 (source) into unstable (Simon Josefsson)
[2026-03-22] golang-github-theupdateframework-go-tuf 2.4.1+0.7.0-1 MIGRATED to testing (Debian testing watch)
[2026-03-21] Accepted golang-github-theupdateframework-go-tuf 2.4.1+0.7.0-2~exp (source amd64 all) into experimental (Debian FTP Masters) (signed by: Simon Josefsson)
[2026-03-19] Accepted golang-github-theupdateframework-go-tuf 2.4.1+0.7.0-1 (source) into unstable (Simon Josefsson)
[2026-01-06] golang-github-theupdateframework-go-tuf 2.3.0+0.7.0-1 MIGRATED to testing (Debian testing watch)
[2026-01-03] Accepted golang-github-theupdateframework-go-tuf 2.3.0+0.7.0-1 (source) into unstable (Simon Josefsson)
[2024-12-14] golang-github-theupdateframework-go-tuf 2.0.2+0.7.0-1 MIGRATED to testing (Debian testing watch)
[2024-12-12] Accepted golang-github-theupdateframework-go-tuf 2.0.2+0.7.0-1 (source) into unstable (Simon Josefsson)
[2024-12-01] Accepted golang-github-theupdateframework-go-tuf 2.0.2+0.7.0-1~exp0 (source) into experimental (Simon Josefsson)
[2024-10-27] golang-github-theupdateframework-go-tuf 2.0.2-1 MIGRATED to testing (Debian testing watch)
[2024-10-25] Accepted golang-github-theupdateframework-go-tuf 2.0.2-1 (source) into unstable (Simon Josefsson)
[2024-10-23] Accepted golang-github-theupdateframework-go-tuf 2.0.2-1~exp0 (source) into experimental (Simon Josefsson)
[2023-11-23] golang-github-theupdateframework-go-tuf 0.6.1-1 MIGRATED to testing (Debian testing watch)
[2023-11-21] Accepted golang-github-theupdateframework-go-tuf 0.6.1-1 (source) into unstable (Reinhard Tartler)
[2023-11-01] Accepted golang-github-theupdateframework-go-tuf 0.5.2-5~bpo12+1 (source all) into stable-backports (Debian FTP Masters) (signed by: Nilesh Patra)
[2023-09-15] golang-github-theupdateframework-go-tuf 0.5.2-5 MIGRATED to testing (Debian testing watch)
[2023-09-15] golang-github-theupdateframework-go-tuf 0.5.2-5 MIGRATED to testing (Debian testing watch)
[2023-09-12] Accepted golang-github-theupdateframework-go-tuf 0.5.2-5 (source) into unstable (Reinhard Tartler)
[2023-08-23] Accepted golang-github-theupdateframework-go-tuf 0.5.2-3 (source) into unstable (Reinhard Tartler)
[2023-07-15] Accepted golang-github-theupdateframework-go-tuf 0.5.2-2 (all source) into experimental (Debian FTP Masters) (signed by: Reinhard Tartler)

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 1)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.4.2+0.7.0-3