Skip to contentSkip to conversation

Update a few packages, some for for security

PATCH Applied [email protected] 2 participants 8 messages Sep 21 – Oct 2

lore
Share & tools
lore

[email protected]

author
#0 lore raw

cover Update a few packages, some for for security

From: "Yann E. MORIN" <[email protected]>

Hello All!

This small series bumps three packages, two of which with security fixes.

Regards,
Yann E. MORIN.

The following changes since commit 43de288bd1e11149068fe52595f56f33523e0159

package/qt6: security bump version to 6.11.2 (2026-09-20 16:56:55 +0200)

are available as patches in this mail series,

for you to apply patches up to e08ef449d915444978f2bc784c9fdb7438d11c98

package/skopeo: security bump (2026-09-21 08:14:50 +0200)

----------------------------------------------------------------
Yann E. MORIN (3):
package/distribution-registry: security bump package/docker-credential-gcr: bump version package/skopeo: security bump

 .../0001-s3-aws-fix-build-for-386.patch            | 45 ----------------------
 .../distribution-registry.hash                     |  2 +-
 .../distribution-registry/distribution-registry.mk |  2 +-
 .../docker-credential-gcr.hash                     |  2 +-
 .../docker-credential-gcr/docker-credential-gcr.mk |  2 +-
 package/skopeo/skopeo.hash                         |  2 +-
 package/skopeo/skopeo.mk                           |  2 +-
 7 files changed, 6 insertions(+), 51 deletions(-)
 delete mode 100644 package/distribution-registry/0001-s3-aws-fix-build-for-386.patch

--

                                        ____________
.-----------------.--------------------:       _    :------------------.
|  Yann E. MORIN  | Real-Time Embedded |    __/ )   | /"\ ASCII RIBBON |
|                 | Software  Designer |  _/ - /'   | \ / CAMPAIGN     |
| +33 638.411.245 '--------------------: (_    `--, |  X  AGAINST      |
| yann.morin (at) orange.com           |_="    ,--' | / \ HTML MAIL    |

'--------------------------------------:______/_____:------------------'

____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law; they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments. As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified. Thank you.

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

author
#1 lore raw

PATCH 1/3 package/distribution-registry: security bump

From: "Yann E. MORIN" <[email protected]>

This feature-release also congtains security fixes:
* CVE-2026-35172
* CVE-2026-33540
* CVE-2026-41888

Drop our backported patch, included since 3.1.0

Signed-off-by Yann E. MORIN <[email protected]>
---
 .../0001-s3-aws-fix-build-for-386.patch       | 45 -------------------
 .../distribution-registry.hash                |  2 +-
 .../distribution-registry.mk                  |  2 +-
 3 files changed, 2 insertions(+), 47 deletions(-)
 delete mode 100644 package/distribution-registry/0001-s3-aws-fix-build-for-386.patch
package/distribution-registry/0001-s3-aws-fix-build-for-386.patch deleted +0 -45
deleted file mode 100644
index a725ab8e92..0000000000
@@ -1,45 +0,0 @@
-From 6970080b10a53d858dd444a643a2bd911de12940 Mon Sep 17 00:00:00 2001
-From: Chen Qi <[email protected]>
-Date: Thu, 29 May 2025 11:28:38 +0800
-Subject: [PATCH] s3-aws: fix build for 386
-
-When building for 386, we got the following build error:
-
-  registry/storage/driver/s3-aws/s3.go:312:99: cannot use
-  maxChunkSize (untyped int constant 5368709120) as int value
-  in argument to getParameterAsInteger (overflows)
-
-This is because the s3_64bit.go is used. Adjust the build tag matching
-in s3_32bit.go and s3_64bit.go to fix this issue.
-
-Signed-off-by: Chen Qi <[email protected]>
-Upstream: https://github.com/distribution/distribution/commit/6970080b10a53d858dd444a643a2bd911de12940
-Signed-off-by: Yann E. MORIN <[email protected]>
----
- registry/storage/driver/s3-aws/s3_32bit.go | 2 +-
- registry/storage/driver/s3-aws/s3_64bit.go | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/registry/storage/driver/s3-aws/s3_32bit.go b/registry/storage/driver/s3-aws/s3_32bit.go
-index 218e3eab..84161fcb 100644
---- a/registry/storage/driver/s3-aws/s3_32bit.go
-+++ b/registry/storage/driver/s3-aws/s3_32bit.go
-@@ -1,4 +1,4 @@
--//go:build arm
-+//go:build arm || 386
- 
- package s3
- 
-diff --git a/registry/storage/driver/s3-aws/s3_64bit.go b/registry/storage/driver/s3-aws/s3_64bit.go
-index 55254e49..2ed1f92f 100644
---- a/registry/storage/driver/s3-aws/s3_64bit.go
-+++ b/registry/storage/driver/s3-aws/s3_64bit.go
-@@ -1,4 +1,4 @@
--//go:build !arm
-+//go:build !arm && !386
- 
- package s3
- 
--- 
-2.51.1
-
package/distribution-registry/distribution-registry.hash +1 -1
index 38d7b5a487..9c2fa922ee 100644
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  6330e6b625c0232b43cee8ea32800a660a7d7a0c79f4f53e4d9a8a6707138d46  distribution-registry-v3.0.0-git4-go2.tar.gz
+sha256  5ed3891ed90c7d097304f49aec2e1f16299770309e2f424b5ee9531b1da2429a  distribution-registry-v3.1.1-git4-go2.tar.gz
 sha256  cb5e8e7e5f4a3988e1063c142c60dc2df75605f4c46515e776e3aca6df976e14  LICENSE
package/distribution-registry/distribution-registry.mk +1 -1
index a01a3c1710..1119132b48 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-DISTRIBUTION_REGISTRY_VERSION = v3.0.0
+DISTRIBUTION_REGISTRY_VERSION = v3.1.1
 DISTRIBUTION_REGISTRY_SITE = https://github.com/distribution/distribution
 DISTRIBUTION_REGISTRY_SITE_METHOD = git
Signature · 18 lines
2.43.0

____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
#2 lore raw

Re: [Buildroot] [PATCH 1/3] package/distribution-registry: security bump

Quoted 10 lines · On 21/09/2026 08:18, [email protected] wrote:

From: "Yann E. MORIN" <[email protected]>

This feature-release also congtains security fixes:
* CVE-2026-35172
* CVE-2026-33540
* CVE-2026-41888

Drop our backported patch, included since 3.1.0

Signed-off-by Yann E. MORIN <[email protected]>

Series applied to master, thanks.
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Applied
#3 lore raw

Re: [Buildroot] [PATCH 1/3] package/distribution-registry: security bump

In reply to [email protected]

In reply of:

Quoted 8 lines

This feature-release also congtains security fixes:
* CVE-2026-35172
* CVE-2026-33540
* CVE-2026-41888

Drop our backported patch, included since 3.1.0

Signed-off-by Yann E. MORIN <[email protected]>

Applied to 2026.08.x. Thanks

Quoted 72 lines
---
 .../0001-s3-aws-fix-build-for-386.patch       | 45 -------------------
 .../distribution-registry.hash                |  2 +-
 .../distribution-registry.mk                  |  2 +-
 3 files changed, 2 insertions(+), 47 deletions(-)
 delete mode 100644 package/distribution-registry/0001-s3-aws-fix-build-for-386.patch
package/distribution-registry/0001-s3-aws-fix-build-for-386.patch deleted +0 -45
deleted file mode 100644
index a725ab8e92..0000000000
@@ -1,45 +0,0 @@
-From 6970080b10a53d858dd444a643a2bd911de12940 Mon Sep 17 00:00:00 2001
-From: Chen Qi <[email protected]>
-Date: Thu, 29 May 2025 11:28:38 +0800
-Subject: [PATCH] s3-aws: fix build for 386
-
-When building for 386, we got the following build error:
-
-  registry/storage/driver/s3-aws/s3.go:312:99: cannot use
-  maxChunkSize (untyped int constant 5368709120) as int value
-  in argument to getParameterAsInteger (overflows)
-
-This is because the s3_64bit.go is used. Adjust the build tag matching
-in s3_32bit.go and s3_64bit.go to fix this issue.
-
-Signed-off-by: Chen Qi <[email protected]>
-Upstream: https://github.com/distribution/distribution/commit/6970080b10a53d858dd444a643a2bd911de12940
-Signed-off-by: Yann E. MORIN <[email protected]>
----
- registry/storage/driver/s3-aws/s3_32bit.go | 2 +-
- registry/storage/driver/s3-aws/s3_64bit.go | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/registry/storage/driver/s3-aws/s3_32bit.go b/registry/storage/driver/s3-aws/s3_32bit.go
-index 218e3eab..84161fcb 100644
---- a/registry/storage/driver/s3-aws/s3_32bit.go
-+++ b/registry/storage/driver/s3-aws/s3_32bit.go
-@@ -1,4 +1,4 @@
--//go:build arm
-+//go:build arm || 386
- 
- package s3
- 
-diff --git a/registry/storage/driver/s3-aws/s3_64bit.go b/registry/storage/driver/s3-aws/s3_64bit.go
-index 55254e49..2ed1f92f 100644
---- a/registry/storage/driver/s3-aws/s3_64bit.go
-+++ b/registry/storage/driver/s3-aws/s3_64bit.go
-@@ -1,4 +1,4 @@
--//go:build !arm
-+//go:build !arm && !386
- 
- package s3
- 
--- 
-2.51.1
-
package/distribution-registry/distribution-registry.hash +1 -1
index 38d7b5a487..9c2fa922ee 100644
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  6330e6b625c0232b43cee8ea32800a660a7d7a0c79f4f53e4d9a8a6707138d46  distribution-registry-v3.0.0-git4-go2.tar.gz
+sha256  5ed3891ed90c7d097304f49aec2e1f16299770309e2f424b5ee9531b1da2429a  distribution-registry-v3.1.1-git4-go2.tar.gz
 sha256  cb5e8e7e5f4a3988e1063c142c60dc2df75605f4c46515e776e3aca6df976e14  LICENSE
package/distribution-registry/distribution-registry.mk +0 -0
index a01a3c1710..1119132b48 100644

package/distribution-registry/distribution-registry.mk line 10

Quoted 8 lines
package/distribution-registry/distribution-registry.mk +1 -1
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-DISTRIBUTION_REGISTRY_VERSION = v3.0.0
+DISTRIBUTION_REGISTRY_VERSION = v3.1.1
 DISTRIBUTION_REGISTRY_SITE = https://github.com/distribution/distribution
 DISTRIBUTION_REGISTRY_SITE_METHOD = git

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

author
#4 lore raw

PATCH 2/3 package/docker-credential-gcr: bump version

In reply to [email protected]

From: "Yann E. MORIN" <[email protected]>

Signed-off-by Yann E. MORIN <[email protected]>
---
 package/docker-credential-gcr/docker-credential-gcr.hash | 2 +-
 package/docker-credential-gcr/docker-credential-gcr.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
package/docker-credential-gcr/docker-credential-gcr.hash +1 -1
index 1269e239ad..fe022e4391 100644
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  7dcb5b75650a49e181afdbd735d09f3289cb62d5b30cb6e3f681e64cf804cbf9  docker-credential-gcr-v2.1.32-git4-go2.tar.gz
+sha256  4f624eeab2923fc135b8d69211036b6fb04f3d62290cac63260d07d3f2f9eecf  docker-credential-gcr-v2.2.1-git4-go2.tar.gz
 sha256  c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4  LICENSE
package/docker-credential-gcr/docker-credential-gcr.mk +1 -1
index 7419a47d4a..95c7af83a4 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-DOCKER_CREDENTIAL_GCR_VERSION = v2.1.32
+DOCKER_CREDENTIAL_GCR_VERSION = v2.2.1
 DOCKER_CREDENTIAL_GCR_SITE = https://github.com/GoogleCloudPlatform/docker-credential-gcr
 DOCKER_CREDENTIAL_GCR_SITE_METHOD = git
Signature · 18 lines
2.43.0

____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
author
#5 lore raw

PATCH 3/3 package/skopeo: security bump

In reply to [email protected]

From: "Yann E. MORIN" <[email protected]>

This releases brings in a fix for:
* CVE-2025-11395

Signed-off-by Yann E. MORIN <[email protected]>
---
 package/skopeo/skopeo.hash | 2 +-
 package/skopeo/skopeo.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
package/skopeo/skopeo.hash +1 -1
index 8a9fb22133..e496eb4410 100644
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  1eea9364e344c4d6cb398fac53bc387663d19690552003b43c75819e8bb55527  skopeo-1.24.0-go2.tar.gz
+sha256  6a3f342a327ec7684198eb0e15114940b6101506db48d9a96590f5942cb3b335  skopeo-1.24.1-go2.tar.gz
 sha256  716a8b80635c394681e652823e1e42e411ad2d254e1f202403422d74f4b0b106  LICENSE
package/skopeo/skopeo.mk +1 -1
index 354998b175..5a22658611 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-SKOPEO_VERSION = 1.24.0
+SKOPEO_VERSION = 1.24.1
 SKOPEO_SITE = $(call github,containers,skopeo,v$(SKOPEO_VERSION))
 
 SKOPEO_LICENSE = Apache-2.0
Signature · 18 lines
2.43.0

____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot
#6 lore raw

Re: [Buildroot] [PATCH 3/3] package/skopeo: security bump

Hi Yann,

Quoted 28 lines · On 21/09/2026 08:18, [email protected] wrote:

From: "Yann E. MORIN" <[email protected]>

This releases brings in a fix for:
* CVE-2025-11395

Signed-off-by Yann E. MORIN <[email protected]>
---
 package/skopeo/skopeo.hash | 2 +-
 package/skopeo/skopeo.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
package/skopeo/skopeo.hash +0 -1
index 8a9fb22133..e496eb4410 100644
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256

1eea9364e344c4d6cb398fac53bc387663d19690552003b43c75819e8bb55527 skopeo-1.24.0-go2.tar.gz +sha256
6a3f342a327ec7684198eb0e15114940b6101506db48d9a96590f5942cb3b335 skopeo-1.24.1-go2.tar.gz
sha256
716a8b80635c394681e652823e1e42e411ad2d254e1f202403422d74f4b0b106 LICENSE

package/skopeo/skopeo.mk +0 -0
index 354998b175..5a22658611 100644

package/skopeo/skopeo.mk line 9

Quoted 7 lines
package/skopeo/skopeo.mk +1 -1
@@ -4,7 +4,7 @@
 #
 
 ################################################################################
 
-SKOPEO_VERSION = 1.24.0
+SKOPEO_VERSION = 1.24.1
 SKOPEO_SITE = $(call github,containers,skopeo,v$(SKOPEO_VERSION))

While applying this patch, I noticed that:
https://github.com/containers/skopeo
was redirecting to:
https://github.com/podman-container-tools/skopeo

See also:
https://github.com/podman-container-tools/skopeo/commit/69ae01c7c6759d33fbe364ec7dff63e7c876e44c

Could you send a patch updating _SITE and the homepage in Config.in please?

Quoted 4 lines
package/skopeo/skopeo.mk +0 -1
 SKOPEO_LICENSE = Apache-2.0
--

2.43.0

Best regards,

Julien.
_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot

Applied
#7 lore raw

Re: [Buildroot] [PATCH 3/3] package/skopeo: security bump

In reply to [email protected]

In reply of:

Quoted 4 lines

This releases brings in a fix for:
* CVE-2025-11395

Signed-off-by Yann E. MORIN <[email protected]>

Applied to 2026.08.x. Thanks

Quoted 19 lines
---
 package/skopeo/skopeo.hash | 2 +-
 package/skopeo/skopeo.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
package/skopeo/skopeo.hash +1 -1
index 8a9fb22133..e496eb4410 100644
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  1eea9364e344c4d6cb398fac53bc387663d19690552003b43c75819e8bb55527  skopeo-1.24.0-go2.tar.gz
+sha256  6a3f342a327ec7684198eb0e15114940b6101506db48d9a96590f5942cb3b335  skopeo-1.24.1-go2.tar.gz
 sha256  716a8b80635c394681e652823e1e42e411ad2d254e1f202403422d74f4b0b106  LICENSE
package/skopeo/skopeo.mk +0 -0
index 354998b175..5a22658611 100644

package/skopeo/skopeo.mk line 10

Quoted 8 lines
package/skopeo/skopeo.mk +1 -1
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-SKOPEO_VERSION = 1.24.0
+SKOPEO_VERSION = 1.24.1
 SKOPEO_SITE = $(call github,containers,skopeo,v$(SKOPEO_VERSION))
 
 SKOPEO_LICENSE = Apache-2.0

_______________________________________________
buildroot mailing list
[email protected]
https://lists.buildroot.org/mailman/listinfo/buildroot