OSTree - Browse /v2026.5 at SourceForge.net

The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
libostree-2026.5.tar.xz	2026-10-23	2.2 MB	0
README.md	2026-10-23	4.2 kB	0
v2026.5 source code.tar.gz	2026-10-23	2.3 MB	0
v2026.5 source code.zip	2026-10-23	2.9 MB	0
Totals: 4 Items		7.4 MB	0

The clearly LLM-assisted security related stream of findings continues; overall I would say we haven't fared too badly - basically most things are mitigated because for operating system (bootable) content you need to ultimately trust your host system, and signatures cover the commit which cover everything else. For other content (like Flatpak) the same is true in that you have to have a malicious ostree commit to hit any of this at all - and further, flatpak doesn't use some of the features (like the Calif.io reported ones).

Of these, I would call out

otcore: Treat only 1 from EVP_DigestVerify as valid by @Usamak06 in https://github.com/ostreedev/ostree/pull/3665

As by far the most embarrassing, but thankfully I don't think it's a problem for most deployments.

What's Changed

static-delta: validate bspatch payload offset and length by @kali834x in https://github.com/ostreedev/ostree/pull/3647
Release 2026.4 by @cgwalters in https://github.com/ostreedev/ostree/pull/3646
min-free-space: Use min(3%, 1GB) as default by @lzwind in https://github.com/ostreedev/ostree/pull/3640
docs: drop parameters that are no longer in the signatures by @darkdi in https://github.com/ostreedev/ostree/pull/3653
ostree-repo: Change argument name in header to match implementation by @pwithnall in https://github.com/ostreedev/ostree/pull/3632
generator: Skip boot.mount if /etc/fstab has a /boot entry by @babariviere in https://github.com/ostreedev/ostree/pull/3654
static-delta: validate on-disk checksum names when listing deltas by @kali834x in https://github.com/ostreedev/ostree/pull/3648
static-delta: bound mode and xattr dict offsets by @kali834x in https://github.com/ostreedev/ostree/pull/3655
ci: Install built bits into the cosa pod with cp instead of rsync by @jmarrero in https://github.com/ostreedev/ostree/pull/3656
bin/prune: Keep recent unreferenced commits by @cgwalters-bot in https://github.com/ostreedev/ostree/pull/3658
prepare-root: Tolerate an existing /sysroot.tmp in the static path by @Altair-Bueno in https://github.com/ostreedev/ostree/pull/3660
prepare-root: Guard against short digest in load_variant by @Usamak06 in https://github.com/ostreedev/ostree/pull/3661
lib: Validate commit tree checksum length on read by @Usamak06 in https://github.com/ostreedev/ostree/pull/3663
fetcher-curl: Bound header value copies to buffer length by @Usamak06 in https://github.com/ostreedev/ostree/pull/3662
ostree-gpg-verify-result: Strictly match subkeys if suffixed with ! by @pwithnall in https://github.com/ostreedev/ostree/pull/3633
otcore: Treat only 1 from EVP_DigestVerify as valid by @Usamak06 in https://github.com/ostreedev/ostree/pull/3665
lib: Parse content object header as untrusted by @Usamak06 in https://github.com/ostreedev/ostree/pull/3666
man: Document signed-delta and sign-verify behaviour by @parkingmeter in https://github.com/ostreedev/ostree/pull/3652
core: Throw an error for short ostree.sizes entries by @Usamak06 in https://github.com/ostreedev/ostree/pull/3667
static-delta: Avoid copying bspatch output by @razzeee in https://github.com/ostreedev/ostree/pull/3554
static-delta: Simplify mapped content allocation by @razzeee in https://github.com/ostreedev/ostree/pull/3669
Two security-related fixes reported by calif.io by @cgwalters in https://github.com/ostreedev/ostree/pull/3675