* [Buildroot] [PATCH 0/3] Update a few packages, some for for security
@ 2026-09-21 6:18 yann.morin
2026-09-21 6:18 ` [Buildroot] [PATCH 1/3] package/distribution-registry: security bump yann.morin
` (2 more replies)
0 siblings, 3 replies; 8+ messages in thread
From: yann.morin @ 2026-09-21 6:18 UTC (permalink / raw)
To: buildroot; +Cc: Yann E . MORIN
From: "Yann E. MORIN" <yann.morin@orange.com>
Hello All!
This small series bumps three packages, two of which with security
fixes.
Regards,
Yann E. MORIN.
The following changes since commit 43de288bd1e11149068fe52595f56f33523e0159
package/qt6: security bump version to 6.11.2 (2026-09-20 16:56:55 +0200)
are available as patches in this mail series,
for you to apply patches up to e08ef449d915444978f2bc784c9fdb7438d11c98
package/skopeo: security bump (2026-09-21 08:14:50 +0200)
----------------------------------------------------------------
Yann E. MORIN (3):
package/distribution-registry: security bump
package/docker-credential-gcr: bump version
package/skopeo: security bump
.../0001-s3-aws-fix-build-for-386.patch | 45 ----------------------
.../distribution-registry.hash | 2 +-
.../distribution-registry/distribution-registry.mk | 2 +-
.../docker-credential-gcr.hash | 2 +-
.../docker-credential-gcr/docker-credential-gcr.mk | 2 +-
package/skopeo/skopeo.hash | 2 +-
package/skopeo/skopeo.mk | 2 +-
7 files changed, 6 insertions(+), 51 deletions(-)
delete mode 100644 package/distribution-registry/0001-s3-aws-fix-build-for-386.patch
--
____________
.-----------------.--------------------: _ :------------------.
| Yann E. MORIN | Real-Time Embedded | __/ ) | /"\ ASCII RIBBON |
| | Software Designer | _/ - /' | \ / CAMPAIGN |
| +33 638.411.245 '--------------------: (_ `--, | X AGAINST |
| yann.morin (at) orange.com |_=" ,--' | / \ HTML MAIL |
'--------------------------------------:______/_____:------------------'
____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH 1/3] package/distribution-registry: security bump
2026-09-21 6:18 [Buildroot] [PATCH 0/3] Update a few packages, some for for security yann.morin
@ 2026-09-21 6:18 ` yann.morin
2026-09-21 18:45 ` Julien Olivain via buildroot
2026-10-02 10:33 ` Raphaël Mélotte via buildroot
2026-09-21 6:18 ` [Buildroot] [PATCH 2/3] package/docker-credential-gcr: bump version yann.morin
2026-09-21 6:18 ` [Buildroot] [PATCH 3/3] package/skopeo: security bump yann.morin
2 siblings, 2 replies; 8+ messages in thread
From: yann.morin @ 2026-09-21 6:18 UTC (permalink / raw)
To: buildroot; +Cc: yann.morin
From: "Yann E. MORIN" <yann.morin@orange.com>
This feature-release also congtains security fixes:
* CVE-2026-35172
* CVE-2026-33540
* CVE-2026-41888
Drop our backported patch, included since 3.1.0
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
---
.../0001-s3-aws-fix-build-for-386.patch | 45 -------------------
.../distribution-registry.hash | 2 +-
.../distribution-registry.mk | 2 +-
3 files changed, 2 insertions(+), 47 deletions(-)
delete mode 100644 package/distribution-registry/0001-s3-aws-fix-build-for-386.patch
diff --git a/package/distribution-registry/0001-s3-aws-fix-build-for-386.patch b/package/distribution-registry/0001-s3-aws-fix-build-for-386.patch
deleted file mode 100644
index a725ab8e92..0000000000
--- a/package/distribution-registry/0001-s3-aws-fix-build-for-386.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-From 6970080b10a53d858dd444a643a2bd911de12940 Mon Sep 17 00:00:00 2001
-From: Chen Qi <Qi.Chen@windriver.com>
-Date: Thu, 29 May 2025 11:28:38 +0800
-Subject: [PATCH] s3-aws: fix build for 386
-
-When building for 386, we got the following build error:
-
- registry/storage/driver/s3-aws/s3.go:312:99: cannot use
- maxChunkSize (untyped int constant 5368709120) as int value
- in argument to getParameterAsInteger (overflows)
-
-This is because the s3_64bit.go is used. Adjust the build tag matching
-in s3_32bit.go and s3_64bit.go to fix this issue.
-
-Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
-Upstream: https://github.com/distribution/distribution/commit/6970080b10a53d858dd444a643a2bd911de12940
-Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
----
- registry/storage/driver/s3-aws/s3_32bit.go | 2 +-
- registry/storage/driver/s3-aws/s3_64bit.go | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/registry/storage/driver/s3-aws/s3_32bit.go b/registry/storage/driver/s3-aws/s3_32bit.go
-index 218e3eab..84161fcb 100644
---- a/registry/storage/driver/s3-aws/s3_32bit.go
-+++ b/registry/storage/driver/s3-aws/s3_32bit.go
-@@ -1,4 +1,4 @@
--//go:build arm
-+//go:build arm || 386
-
- package s3
-
-diff --git a/registry/storage/driver/s3-aws/s3_64bit.go b/registry/storage/driver/s3-aws/s3_64bit.go
-index 55254e49..2ed1f92f 100644
---- a/registry/storage/driver/s3-aws/s3_64bit.go
-+++ b/registry/storage/driver/s3-aws/s3_64bit.go
-@@ -1,4 +1,4 @@
--//go:build !arm
-+//go:build !arm && !386
-
- package s3
-
---
-2.51.1
-
diff --git a/package/distribution-registry/distribution-registry.hash b/package/distribution-registry/distribution-registry.hash
index 38d7b5a487..9c2fa922ee 100644
--- a/package/distribution-registry/distribution-registry.hash
+++ b/package/distribution-registry/distribution-registry.hash
@@ -1,3 +1,3 @@
# Locally computed
-sha256 6330e6b625c0232b43cee8ea32800a660a7d7a0c79f4f53e4d9a8a6707138d46 distribution-registry-v3.0.0-git4-go2.tar.gz
+sha256 5ed3891ed90c7d097304f49aec2e1f16299770309e2f424b5ee9531b1da2429a distribution-registry-v3.1.1-git4-go2.tar.gz
sha256 cb5e8e7e5f4a3988e1063c142c60dc2df75605f4c46515e776e3aca6df976e14 LICENSE
diff --git a/package/distribution-registry/distribution-registry.mk b/package/distribution-registry/distribution-registry.mk
index a01a3c1710..1119132b48 100644
--- a/package/distribution-registry/distribution-registry.mk
+++ b/package/distribution-registry/distribution-registry.mk
@@ -4,7 +4,7 @@
#
################################################################################
-DISTRIBUTION_REGISTRY_VERSION = v3.0.0
+DISTRIBUTION_REGISTRY_VERSION = v3.1.1
DISTRIBUTION_REGISTRY_SITE = https://github.com/distribution/distribution
DISTRIBUTION_REGISTRY_SITE_METHOD = git
--
2.43.0
____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH 2/3] package/docker-credential-gcr: bump version
2026-09-21 6:18 [Buildroot] [PATCH 0/3] Update a few packages, some for for security yann.morin
2026-09-21 6:18 ` [Buildroot] [PATCH 1/3] package/distribution-registry: security bump yann.morin
@ 2026-09-21 6:18 ` yann.morin
2026-09-21 6:18 ` [Buildroot] [PATCH 3/3] package/skopeo: security bump yann.morin
2 siblings, 0 replies; 8+ messages in thread
From: yann.morin @ 2026-09-21 6:18 UTC (permalink / raw)
To: buildroot; +Cc: yann.morin
From: "Yann E. MORIN" <yann.morin@orange.com>
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
---
package/docker-credential-gcr/docker-credential-gcr.hash | 2 +-
package/docker-credential-gcr/docker-credential-gcr.mk | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/package/docker-credential-gcr/docker-credential-gcr.hash b/package/docker-credential-gcr/docker-credential-gcr.hash
index 1269e239ad..fe022e4391 100644
--- a/package/docker-credential-gcr/docker-credential-gcr.hash
+++ b/package/docker-credential-gcr/docker-credential-gcr.hash
@@ -1,3 +1,3 @@
# Locally computed
-sha256 7dcb5b75650a49e181afdbd735d09f3289cb62d5b30cb6e3f681e64cf804cbf9 docker-credential-gcr-v2.1.32-git4-go2.tar.gz
+sha256 4f624eeab2923fc135b8d69211036b6fb04f3d62290cac63260d07d3f2f9eecf docker-credential-gcr-v2.2.1-git4-go2.tar.gz
sha256 c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4 LICENSE
diff --git a/package/docker-credential-gcr/docker-credential-gcr.mk b/package/docker-credential-gcr/docker-credential-gcr.mk
index 7419a47d4a..95c7af83a4 100644
--- a/package/docker-credential-gcr/docker-credential-gcr.mk
+++ b/package/docker-credential-gcr/docker-credential-gcr.mk
@@ -4,7 +4,7 @@
#
################################################################################
-DOCKER_CREDENTIAL_GCR_VERSION = v2.1.32
+DOCKER_CREDENTIAL_GCR_VERSION = v2.2.1
DOCKER_CREDENTIAL_GCR_SITE = https://github.com/GoogleCloudPlatform/docker-credential-gcr
DOCKER_CREDENTIAL_GCR_SITE_METHOD = git
--
2.43.0
____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 8+ messages in thread
* [Buildroot] [PATCH 3/3] package/skopeo: security bump
2026-09-21 6:18 [Buildroot] [PATCH 0/3] Update a few packages, some for for security yann.morin
2026-09-21 6:18 ` [Buildroot] [PATCH 1/3] package/distribution-registry: security bump yann.morin
2026-09-21 6:18 ` [Buildroot] [PATCH 2/3] package/docker-credential-gcr: bump version yann.morin
@ 2026-09-21 6:18 ` yann.morin
2026-09-21 18:49 ` Julien Olivain via buildroot
2026-10-02 10:34 ` Raphaël Mélotte via buildroot
2 siblings, 2 replies; 8+ messages in thread
From: yann.morin @ 2026-09-21 6:18 UTC (permalink / raw)
To: buildroot; +Cc: yann.morin
From: "Yann E. MORIN" <yann.morin@orange.com>
This releases brings in a fix for:
* CVE-2025-11395
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
---
package/skopeo/skopeo.hash | 2 +-
package/skopeo/skopeo.mk | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/package/skopeo/skopeo.hash b/package/skopeo/skopeo.hash
index 8a9fb22133..e496eb4410 100644
--- a/package/skopeo/skopeo.hash
+++ b/package/skopeo/skopeo.hash
@@ -1,3 +1,3 @@
# Locally calculated
-sha256 1eea9364e344c4d6cb398fac53bc387663d19690552003b43c75819e8bb55527 skopeo-1.24.0-go2.tar.gz
+sha256 6a3f342a327ec7684198eb0e15114940b6101506db48d9a96590f5942cb3b335 skopeo-1.24.1-go2.tar.gz
sha256 716a8b80635c394681e652823e1e42e411ad2d254e1f202403422d74f4b0b106 LICENSE
diff --git a/package/skopeo/skopeo.mk b/package/skopeo/skopeo.mk
index 354998b175..5a22658611 100644
--- a/package/skopeo/skopeo.mk
+++ b/package/skopeo/skopeo.mk
@@ -4,7 +4,7 @@
#
################################################################################
-SKOPEO_VERSION = 1.24.0
+SKOPEO_VERSION = 1.24.1
SKOPEO_SITE = $(call github,containers,skopeo,v$(SKOPEO_VERSION))
SKOPEO_LICENSE = Apache-2.0
--
2.43.0
____________________________________________________________________________________________________________
Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [Buildroot] [PATCH 1/3] package/distribution-registry: security bump
2026-09-21 6:18 ` [Buildroot] [PATCH 1/3] package/distribution-registry: security bump yann.morin
@ 2026-09-21 18:45 ` Julien Olivain via buildroot
2026-10-02 10:33 ` Raphaël Mélotte via buildroot
1 sibling, 0 replies; 8+ messages in thread
From: Julien Olivain via buildroot @ 2026-09-21 18:45 UTC (permalink / raw)
To: yann.morin; +Cc: buildroot
On 21/09/2026 08:18, yann.morin@orange.com wrote:
> From: "Yann E. MORIN" <yann.morin@orange.com>
>
> This feature-release also congtains security fixes:
> * CVE-2026-35172
> * CVE-2026-33540
> * CVE-2026-41888
>
> Drop our backported patch, included since 3.1.0
>
> Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Series applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Buildroot] [PATCH 3/3] package/skopeo: security bump
2026-09-21 6:18 ` [Buildroot] [PATCH 3/3] package/skopeo: security bump yann.morin
@ 2026-09-21 18:49 ` Julien Olivain via buildroot
2026-10-02 10:34 ` Raphaël Mélotte via buildroot
1 sibling, 0 replies; 8+ messages in thread
From: Julien Olivain via buildroot @ 2026-09-21 18:49 UTC (permalink / raw)
To: yann.morin; +Cc: buildroot
Hi Yann,
On 21/09/2026 08:18, yann.morin@orange.com wrote:
> From: "Yann E. MORIN" <yann.morin@orange.com>
>
> This releases brings in a fix for:
> * CVE-2025-11395
>
> Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
> ---
> package/skopeo/skopeo.hash | 2 +-
> package/skopeo/skopeo.mk | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/package/skopeo/skopeo.hash b/package/skopeo/skopeo.hash
> index 8a9fb22133..e496eb4410 100644
> --- a/package/skopeo/skopeo.hash
> +++ b/package/skopeo/skopeo.hash
> @@ -1,3 +1,3 @@
> # Locally calculated
> -sha256
> 1eea9364e344c4d6cb398fac53bc387663d19690552003b43c75819e8bb55527
> skopeo-1.24.0-go2.tar.gz
> +sha256
> 6a3f342a327ec7684198eb0e15114940b6101506db48d9a96590f5942cb3b335
> skopeo-1.24.1-go2.tar.gz
> sha256
> 716a8b80635c394681e652823e1e42e411ad2d254e1f202403422d74f4b0b106
> LICENSE
> diff --git a/package/skopeo/skopeo.mk b/package/skopeo/skopeo.mk
> index 354998b175..5a22658611 100644
> --- a/package/skopeo/skopeo.mk
> +++ b/package/skopeo/skopeo.mk
> @@ -4,7 +4,7 @@
> #
>
> ################################################################################
>
> -SKOPEO_VERSION = 1.24.0
> +SKOPEO_VERSION = 1.24.1
> SKOPEO_SITE = $(call github,containers,skopeo,v$(SKOPEO_VERSION))
While applying this patch, I noticed that:
https://github.com/containers/skopeo
was redirecting to:
https://github.com/podman-container-tools/skopeo
See also:
https://github.com/podman-container-tools/skopeo/commit/69ae01c7c6759d33fbe364ec7dff63e7c876e44c
Could you send a patch updating _SITE and the homepage
in Config.in please?
>
> SKOPEO_LICENSE = Apache-2.0
> --
> 2.43.0
Best regards,
Julien.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Buildroot] [PATCH 1/3] package/distribution-registry: security bump
2026-09-21 6:18 ` [Buildroot] [PATCH 1/3] package/distribution-registry: security bump yann.morin
2026-09-21 18:45 ` Julien Olivain via buildroot
@ 2026-10-02 10:33 ` Raphaël Mélotte via buildroot
1 sibling, 0 replies; 8+ messages in thread
From: Raphaël Mélotte via buildroot @ 2026-10-02 10:33 UTC (permalink / raw)
To: buildroot, yann.morin; +Cc: Raphaël Mélotte
In reply of:
> This feature-release also congtains security fixes:
> * CVE-2026-35172
> * CVE-2026-33540
> * CVE-2026-41888
>
> Drop our backported patch, included since 3.1.0
>
> Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Applied to 2026.08.x. Thanks
> ---
> .../0001-s3-aws-fix-build-for-386.patch | 45 -------------------
> .../distribution-registry.hash | 2 +-
> .../distribution-registry.mk | 2 +-
> 3 files changed, 2 insertions(+), 47 deletions(-)
> delete mode 100644 package/distribution-registry/0001-s3-aws-fix-build-for-386.patch
>
> diff --git a/package/distribution-registry/0001-s3-aws-fix-build-for-386.patch b/package/distribution-registry/0001-s3-aws-fix-build-for-386.patch
> deleted file mode 100644
> index a725ab8e92..0000000000
> --- a/package/distribution-registry/0001-s3-aws-fix-build-for-386.patch
> +++ /dev/null
> @@ -1,45 +0,0 @@
> -From 6970080b10a53d858dd444a643a2bd911de12940 Mon Sep 17 00:00:00 2001
> -From: Chen Qi <Qi.Chen@windriver.com>
> -Date: Thu, 29 May 2025 11:28:38 +0800
> -Subject: [PATCH] s3-aws: fix build for 386
> -
> -When building for 386, we got the following build error:
> -
> - registry/storage/driver/s3-aws/s3.go:312:99: cannot use
> - maxChunkSize (untyped int constant 5368709120) as int value
> - in argument to getParameterAsInteger (overflows)
> -
> -This is because the s3_64bit.go is used. Adjust the build tag matching
> -in s3_32bit.go and s3_64bit.go to fix this issue.
> -
> -Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
> -Upstream: https://github.com/distribution/distribution/commit/6970080b10a53d858dd444a643a2bd911de12940
> -Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
> ----
> - registry/storage/driver/s3-aws/s3_32bit.go | 2 +-
> - registry/storage/driver/s3-aws/s3_64bit.go | 2 +-
> - 2 files changed, 2 insertions(+), 2 deletions(-)
> -
> -diff --git a/registry/storage/driver/s3-aws/s3_32bit.go b/registry/storage/driver/s3-aws/s3_32bit.go
> -index 218e3eab..84161fcb 100644
> ---- a/registry/storage/driver/s3-aws/s3_32bit.go
> -+++ b/registry/storage/driver/s3-aws/s3_32bit.go
> -@@ -1,4 +1,4 @@
> --//go:build arm
> -+//go:build arm || 386
> -
> - package s3
> -
> -diff --git a/registry/storage/driver/s3-aws/s3_64bit.go b/registry/storage/driver/s3-aws/s3_64bit.go
> -index 55254e49..2ed1f92f 100644
> ---- a/registry/storage/driver/s3-aws/s3_64bit.go
> -+++ b/registry/storage/driver/s3-aws/s3_64bit.go
> -@@ -1,4 +1,4 @@
> --//go:build !arm
> -+//go:build !arm && !386
> -
> - package s3
> -
> ---
> -2.51.1
> -
> diff --git a/package/distribution-registry/distribution-registry.hash b/package/distribution-registry/distribution-registry.hash
> index 38d7b5a487..9c2fa922ee 100644
> --- a/package/distribution-registry/distribution-registry.hash
> +++ b/package/distribution-registry/distribution-registry.hash
> @@ -1,3 +1,3 @@
> # Locally computed
> -sha256 6330e6b625c0232b43cee8ea32800a660a7d7a0c79f4f53e4d9a8a6707138d46 distribution-registry-v3.0.0-git4-go2.tar.gz
> +sha256 5ed3891ed90c7d097304f49aec2e1f16299770309e2f424b5ee9531b1da2429a distribution-registry-v3.1.1-git4-go2.tar.gz
> sha256 cb5e8e7e5f4a3988e1063c142c60dc2df75605f4c46515e776e3aca6df976e14 LICENSE
> diff --git a/package/distribution-registry/distribution-registry.mk b/package/distribution-registry/distribution-registry.mk
> index a01a3c1710..1119132b48 100644
> --- a/package/distribution-registry/distribution-registry.mk
> +++ b/package/distribution-registry/distribution-registry.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -DISTRIBUTION_REGISTRY_VERSION = v3.0.0
> +DISTRIBUTION_REGISTRY_VERSION = v3.1.1
> DISTRIBUTION_REGISTRY_SITE = https://github.com/distribution/distribution
> DISTRIBUTION_REGISTRY_SITE_METHOD = git
>
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [Buildroot] [PATCH 3/3] package/skopeo: security bump
2026-09-21 6:18 ` [Buildroot] [PATCH 3/3] package/skopeo: security bump yann.morin
2026-09-21 18:49 ` Julien Olivain via buildroot
@ 2026-10-02 10:34 ` Raphaël Mélotte via buildroot
1 sibling, 0 replies; 8+ messages in thread
From: Raphaël Mélotte via buildroot @ 2026-10-02 10:34 UTC (permalink / raw)
To: buildroot, yann.morin; +Cc: Raphaël Mélotte
In reply of:
> This releases brings in a fix for:
> * CVE-2025-11395
>
> Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Applied to 2026.08.x. Thanks
> ---
> package/skopeo/skopeo.hash | 2 +-
> package/skopeo/skopeo.mk | 2 +-
> 2 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/package/skopeo/skopeo.hash b/package/skopeo/skopeo.hash
> index 8a9fb22133..e496eb4410 100644
> --- a/package/skopeo/skopeo.hash
> +++ b/package/skopeo/skopeo.hash
> @@ -1,3 +1,3 @@
> # Locally calculated
> -sha256 1eea9364e344c4d6cb398fac53bc387663d19690552003b43c75819e8bb55527 skopeo-1.24.0-go2.tar.gz
> +sha256 6a3f342a327ec7684198eb0e15114940b6101506db48d9a96590f5942cb3b335 skopeo-1.24.1-go2.tar.gz
> sha256 716a8b80635c394681e652823e1e42e411ad2d254e1f202403422d74f4b0b106 LICENSE
> diff --git a/package/skopeo/skopeo.mk b/package/skopeo/skopeo.mk
> index 354998b175..5a22658611 100644
> --- a/package/skopeo/skopeo.mk
> +++ b/package/skopeo/skopeo.mk
> @@ -4,7 +4,7 @@
> #
> ################################################################################
>
> -SKOPEO_VERSION = 1.24.0
> +SKOPEO_VERSION = 1.24.1
> SKOPEO_SITE = $(call github,containers,skopeo,v$(SKOPEO_VERSION))
>
> SKOPEO_LICENSE = Apache-2.0
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot
^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-10-02 10:34 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-21 6:18 [Buildroot] [PATCH 0/3] Update a few packages, some for for security yann.morin
2026-09-21 6:18 ` [Buildroot] [PATCH 1/3] package/distribution-registry: security bump yann.morin
2026-09-21 18:45 ` Julien Olivain via buildroot
2026-10-02 10:33 ` Raphaël Mélotte via buildroot
2026-09-21 6:18 ` [Buildroot] [PATCH 2/3] package/docker-credential-gcr: bump version yann.morin
2026-09-21 6:18 ` [Buildroot] [PATCH 3/3] package/skopeo: security bump yann.morin
2026-09-21 18:49 ` Julien Olivain via buildroot
2026-10-02 10:34 ` Raphaël Mélotte via buildroot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.