diff mbox series

[meta-oe] ostree: upgrade 2026.4 -> 2026.5

Message ID 20261025023613.3249118-1-ricardo.salveti@oss.qualcomm.com
State New
Headers show
Series [meta-oe] ostree: upgrade 2026.4 -> 2026.5 | expand

Commit Message

Ricardo Salveti Oct. 25, 2026, 2:36 a.m. UTC 
This release is mostly hardening against untrusted repository content.
It fixes two checkout issues: a crafted whiteout name that strips to
".." and makes a --whiteouts checkout delete the destination's parent
(GHSA-cp2j-qv7x-wcw4), and union checkouts following a symlink planted
at a directory name and writing outside the destination
(GHSA-7pq7-3pmj-9wp6). Composefs and commit signature checks with the
OpenSSL ed25519/SPKI backends now accept only EVP_DigestVerify() == 1,
where error returns used to count as a valid signature. Static delta,
content header, commit and curl header parsing gain bounds checks.

Behaviour changes: the default min-free-space is now min(3%, 1GB), and
the systemd generator leaves boot.mount to systemd-fstab-generator when
/etc/fstab has a /boot entry.

https://github.com/ostreedev/ostree/releases/tag/v2026.5

AI-Generated: Uses Claude Code (Claude Opus 5.5)
Signed-off-by: Ricardo Salveti <ricardo.salveti@oss.qualcomm.com>
---
 .../ostree/{ostree_2026.4.bb => ostree_2026.5.bb}               | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta-oe/recipes-extended/ostree/{ostree_2026.4.bb => ostree_2026.5.bb} (98%)
diff mbox series

Patch

diff --git a/meta-oe/recipes-extended/ostree/ostree_2026.4.bb b/meta-oe/recipes-extended/ostree/ostree_2026.5.bb
similarity index 98%
rename from meta-oe/recipes-extended/ostree/ostree_2026.4.bb
rename to meta-oe/recipes-extended/ostree/ostree_2026.5.bb
index 05a514c262..adce310189 100644
--- a/meta-oe/recipes-extended/ostree/ostree_2026.4.bb
+++ b/meta-oe/recipes-extended/ostree/ostree_2026.5.bb
@@ -22,7 +22,7 @@  GITHUB_BASE_URI = "https://github.com/ostreedev/ostree/releases"
 SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/libostree-${PV}.tar.xz \
            file://run-ptest \
            "
-SRC_URI[sha256sum] = "b26c9016eb03bb4ee52cc00c642d56e00fc79ae7faac6bf4aa317d7451339ef7"
+SRC_URI[sha256sum] = "1829428ed2d982dc684211ff18525b57ea627056a68fa5b04f674f0ca6c9c19b"
 
 S = "${UNPACKDIR}/libostree-${PV}"