Version in base suite: 1.6.9-2 Base version: buildstream_1.6.9-2 Target version: buildstream_1.6.9-2+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/b/buildstream/buildstream_1.6.9-2.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/b/buildstream/buildstream_1.6.9-2+deb13u1.dsc changelog | 8 ++ gbp.conf | 2 patches/series | 1 patches/tar.py-Use-custom-extraction-filter.patch | 67 ++++++++++++++++++++++ 4 files changed, 77 insertions(+), 1 deletion(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpa9ygo42l/buildstream_1.6.9-2.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpa9ygo42l/buildstream_1.6.9-2+deb13u1.dsc: no acceptable signature found diff: /srv/release.debian.org/tmp/oacWfdPmRQ/buildstream-1.6.9/doc/examples/flatpak-autotools/files/links/bin: No such file or directory diff: /srv/release.debian.org/tmp/tmfj9kTcUe/buildstream-1.6.9/doc/examples/flatpak-autotools/files/links/bin: No such file or directory diff: /srv/release.debian.org/tmp/oacWfdPmRQ/buildstream-1.6.9/doc/examples/flatpak-autotools/files/links/etc: No such file or directory diff: /srv/release.debian.org/tmp/tmfj9kTcUe/buildstream-1.6.9/doc/examples/flatpak-autotools/files/links/etc: No such file or directory diff: /srv/release.debian.org/tmp/oacWfdPmRQ/buildstream-1.6.9/doc/examples/flatpak-autotools/files/links/lib: No such file or directory diff: /srv/release.debian.org/tmp/tmfj9kTcUe/buildstream-1.6.9/doc/examples/flatpak-autotools/files/links/lib: No such file or directory diff -Nru buildstream-1.6.9/debian/changelog buildstream-1.6.9/debian/changelog --- buildstream-1.6.9/debian/changelog 2025-04-18 15:26:10.000000000 +0000 +++ buildstream-1.6.9/debian/changelog 2026-09-24 07:01:40.000000000 +0000 @@ -1,3 +1,11 @@ +buildstream (1.6.9-2+deb13u1) trixie-security; urgency=high + + * Team upload + * d/gbp.conf: set debian-branch=debian/trixie + * Backport upstream patch for CVE-2026-82331 + + -- Theodore Tucker Thu, 24 Sep 2026 08:01:40 +0100 + buildstream (1.6.9-2) unstable; urgency=medium * Stop using debian/control.in and dh-sequence-gnome diff -Nru buildstream-1.6.9/debian/gbp.conf buildstream-1.6.9/debian/gbp.conf --- buildstream-1.6.9/debian/gbp.conf 2025-04-18 15:26:10.000000000 +0000 +++ buildstream-1.6.9/debian/gbp.conf 2026-09-24 07:01:40.000000000 +0000 @@ -1,6 +1,6 @@ [DEFAULT] pristine-tar = True -debian-branch = debian/latest +debian-branch = debian/trixie upstream-branch = upstream/latest [buildpackage] diff -Nru buildstream-1.6.9/debian/patches/series buildstream-1.6.9/debian/patches/series --- buildstream-1.6.9/debian/patches/series 2025-04-18 15:26:10.000000000 +0000 +++ buildstream-1.6.9/debian/patches/series 2026-09-24 07:01:40.000000000 +0000 @@ -1 +1,2 @@ adjust-test-dependencies.patch +tar.py-Use-custom-extraction-filter.patch diff -Nru buildstream-1.6.9/debian/patches/tar.py-Use-custom-extraction-filter.patch buildstream-1.6.9/debian/patches/tar.py-Use-custom-extraction-filter.patch --- buildstream-1.6.9/debian/patches/tar.py-Use-custom-extraction-filter.patch 1970-01-01 00:00:00.000000000 +0000 +++ buildstream-1.6.9/debian/patches/tar.py-Use-custom-extraction-filter.patch 2026-09-24 07:01:40.000000000 +0000 @@ -0,0 +1,67 @@ +From cf64a016b85b1e64446addfc6990553f076de982 Mon Sep 17 00:00:00 2001 +From: Theodore Tucker +Date: Wed, 23 Sep 2026 11:55:41 +0100 +Subject: [PATCH] tar.py: Use custom extraction filter +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit +Forwarded: https://github.com/apache/buildstream/pull/2192 + +The `tar` filter catches attempts to extract files outside the +destination directory but does not catch hardlink targets outside the +destination directory. The `data` filter catches both but doesn't +preserve symlinks, which may break, e.g., rootfs tarball extraction. + +Define a custom extraction filter that uses the `data` filter except for +symlinks where the `tar` filter is used. + +This backports an upstream patch (to the 2.x branch) to resolve +CVE-2026-82331: https://github.com/apache/buildstream/pull/2192/changes/12b1f007b875b94d5b34ceeaf4dceb908a2a2a4b + +Co-authored-by: Jürg Billeter +--- + buildstream/plugins/sources/tar.py | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/buildstream/plugins/sources/tar.py b/buildstream/plugins/sources/tar.py +index e32cc3dc8..cf7c8ed07 100644 +--- a/buildstream/plugins/sources/tar.py ++++ b/buildstream/plugins/sources/tar.py +@@ -59,6 +59,7 @@ import os + import tarfile + from contextlib import contextmanager, ExitStack + from tempfile import TemporaryFile ++from typing import Optional + + from buildstream import SourceError + from buildstream import utils +@@ -115,9 +116,9 @@ class TarSource(DownloadableFileSource): + base_dir = self._find_base_dir(tar, self.base_dir) + + if base_dir: +- tar.extractall(path=directory, members=self._extract_members(tar, base_dir)) ++ tar.extractall(path=directory, members=self._extract_members(tar, base_dir), filter=self._extract_filter) + else: +- tar.extractall(path=directory) ++ tar.extractall(path=directory, filter=self._extract_filter) + + except (tarfile.TarError, OSError) as e: + raise SourceError("{}: Error staging source: {}".format(self, e)) from e +@@ -150,6 +151,14 @@ class TarSource(DownloadableFileSource): + member.path = member.path[l:] + yield member + ++ def _extract_filter(self, member: tarfile.TarInfo, target_dir: str) -> Optional[tarfile.TarInfo]: ++ if member.issym(): ++ # `data_filter` is too restrictive as we need to preserve, e.g., absolute symbolic links. ++ # `tar_filter` still makes sure that symlinks aren't followed if they escape the target directory. ++ return tarfile.tar_filter(member, target_dir) ++ else: ++ return tarfile.data_filter(member, target_dir) ++ + # We want to iterate over all paths of a tarball, but getmembers() + # is not enough because some tarballs simply do not contain the leading + # directory paths for the archived files. +-- +2.47.3 +