ostree v2022.5 and ostree-ext 0.8.1



https://github.com/ostreedev/ostree/releases/tag/v2022.5

This release fixes a denial of service security issue: 
https://github.com/ostreedev/ostree/security/advisories/GHSA-gqf4-p3gv-g8vw
The core fix is in `sign/ed25519: Verify signatures are minimum length` in 
83e6357186be11fb8f2a6b66fab3730c44ee59dd which should be an easily backportable commit.  (There's some 
further changes to add test coverage for this that can be ignored)
This only affects builds that use libsodium; it is however remotely reachable (assuming that the client is 
talking to a compromised server; ordinarily exploiting this would require that or breaking TLS/https).  
Thanks to @DemiMarie for the report!

Additional highlights are:

* Greatly improved performance for `ostree prune` on large repositories
* Support for in-place kargs changes

Thanks to everyone who contributed!


https://crates.io/crates/ostree-ext/0.8.1

This (along with the 0.8.0 release which I forgot to mention here) has changed the exported container stream 
model; for more information on this, see https://github.com/ostreedev/ostree-rs-ext/pull/331

If you're using the container support, you should upgrade.  As of right now, the new code still understands 
the "v0" format; https://github.com/ostreedev/ostree-rs-ext/issues/332 tracks dropping that.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]