From 4bf39904e4cd7e7449b249c38bc2700e19bd344c Mon Sep 17 00:00:00 2001 From: Leon Anavi Date: Tue, 8 Sep 2026 12:30:43 +0300 Subject: [PATCH] ostree: Upgrade 2026.3 -> 2026.4 Upgrade to release 2026.4: - This release reverts the static delta decompression-size safety margin introduced in 2026.3, which turned out to reject legitimate large deltas at apply time -- most visibly, Flathub Firefox updates were failing with Decompressed delta part exceeds configured limit Both the margin heuristic and the flat 512 MiB per-part decompression cap it fed into have been dropped for now. This deliberately reopens GHSA-7cgc-gp99-6jmm (unbounded decompression of a given delta part) until a precise, per-part exact-size-based replacement lands in a future release. The LZMA decoder memory limit (100 MiB) from that same advisory's fix is unaffected and remains in place. - core: fixed a double-increment bug in _ostree_validate_structureof_xattrs that caused every other xattr entry to be skipped during validation, letting a crafted xattr array hide unsorted or duplicate entries in odd-indexed slots. Signed-off-by: Leon Anavi Signed-off-by: Khem Raj --- .../ostree/{ostree_2026.3.bb => ostree_2026.4.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta-oe/recipes-extended/ostree/{ostree_2026.3.bb => ostree_2026.4.bb} (98%) diff --git a/meta-oe/recipes-extended/ostree/ostree_2026.3.bb b/meta-oe/recipes-extended/ostree/ostree_2026.4.bb similarity index 98% rename from meta-oe/recipes-extended/ostree/ostree_2026.3.bb rename to meta-oe/recipes-extended/ostree/ostree_2026.4.bb index 5e2e9ee078..b48fbb0a62 100644 --- a/meta-oe/recipes-extended/ostree/ostree_2026.3.bb +++ b/meta-oe/recipes-extended/ostree/ostree_2026.4.bb @@ -22,7 +22,7 @@ GITHUB_BASE_URI = "https://github.com/ostreedev/ostree/releases" SRC_URI = "${GITHUB_BASE_URI}/download/v${PV}/libostree-${PV}.tar.xz \ file://run-ptest \ " -SRC_URI[sha256sum] = "e560e47631d1f703e9ed3425e8909ccd87fa2992422c07348ca88ec98943c8fb" +SRC_URI[sha256sum] = "b26c9016eb03bb4ee52cc00c642d56e00fc79ae7faac6bf4aa317d7451339ef7" S = "${UNPACKDIR}/libostree-${PV}"