[Pkg-utopia-maintainers] bubblewrap_0.12.0-1_source.changes ACCEPTED into unstable

[Debian FTP Masters]

Thank you for your contribution to Debian.



Accepted:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 26 Aug 2026 11:32:16 +0100
Source: bubblewrap
Architecture: source
Version: 0.12.0-1
Distribution: unstable
Urgency: high
Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers at lists.alioth.debian.org>
Changed-By: Simon McVittie <smcv at debian.org>
Closes: 1145655
Changes:
 bubblewrap (0.12.0-1) unstable; urgency=high
 .
   * New upstream release
     - Prevent sandbox escape via symlink traversal.
       If an app framework such as Flatpak mounts subdirectories into a
       directory controlled by the sandboxed app, a malicious or compromised
       sandboxed app could create symlinks in that directory to arrange for
       files/directories to be created on the host system.
       (GHSA-pxhw-h44j-8pfx, no known CVE ID; Closes: #1145655)
     - d/rules: Stop passing -Dsupport_setuid=false.
       The option no longer exists, and the new version of bubblewrap always
       behaves as though its value was false.
     - d/copyright: Update license from LGPL-2+ to LGPL-2.1+, matching upstream
     - d/p/debian/Change-EPERM-error-message-to-show-Debian-specific-inform.patch:
       Adjust patch to apply to the new upstream release
   * d/rules: Don't compile fallback code paths for kernel older than 5.10.
     This ensures that we're using the safest available mechanisms,
     using the openat2() syscall rather than emulating it in user-space.
     As a result, this version will not work on kernels older than the
     one found in Debian 11.
Checksums-Sha1:
 4ee70163fd95377cf5737e87729bc448401abacb 2427 bubblewrap_0.12.0-1.dsc
 183eaff6b078c1ea5ad55271e7d1fa5c8c0d339e 126452 bubblewrap_0.12.0.orig.tar.xz
 5a2bfd116f752cadb6c21ca2e48646bb97dcfb2c 13092 bubblewrap_0.12.0-1.debian.tar.xz
 5dfd9cab67a11e66f92a1316510eee7599591f67 7139 bubblewrap_0.12.0-1_source.buildinfo
Checksums-Sha256:
 e81987f8d90b30b581299870592affaa8d9a17caf05112d303916312b7afd60a 2427 bubblewrap_0.12.0-1.dsc
 9760d007363e3abba7c747489910f9f82d9fca53ba3bd3282e396fa3c97a3314 126452 bubblewrap_0.12.0.orig.tar.xz
 60691fa8488db2de4dd19d59fb0b084e692695c38616dcf8e20b08a4d372ab93 13092 bubblewrap_0.12.0-1.debian.tar.xz
 65322f643cfcd5b05b63231055655f62f860b2e84d4e4eb681a9d2047cb4aef6 7139 bubblewrap_0.12.0-1_source.buildinfo
Files:
 9652e93e58dd3c2c5a9a631d6f4775fe 2427 admin optional bubblewrap_0.12.0-1.dsc
 323b059c9599b60b456bcf9e9800ff44 126452 admin optional bubblewrap_0.12.0.orig.tar.xz
 255ccb24268c5460325edced14f15c9d 13092 admin optional bubblewrap_0.12.0-1.debian.tar.xz
 32130cf24c6258998317dbc4e3b634c4 7139 admin optional bubblewrap_0.12.0-1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEegc60a5pT6Jb/2LlI1wJnT6zMHYFAmqOyVAACgkQI1wJnT6z
MHZl0RAAoIZj+59Kvx30Qvy7LFAJkH8YidqCQARbviv189MQ64/3F+p3tA1+p/g+
wGT/CbcrOe+Iak51pAdUHcAd3Dudd6Dta4vejkHvg3JbYON1DoigEcclYbxNdGG3
eignRxihI/E7Wlu2W3cOTNL12JGfWKTjJeTJxG2L58gxi7jXnJ2sQkANtu7t1WRh
dcq4tJvX2rwiSMMzr9cYWlCm5MFYJ7E0jkCEuHVvtMcgisjf2bahlgADcSyazPKJ
nSkW2JyvfIKuyB4kgsjT1YVwhSzKlp06fhsoDBxmtnRB2ZnGq8V0srA7K/Zo97zw
+MCh7cMus7jXwjgK/PJ3pZbwYnjGpfiMc7Lpaljiue64UXnfRNlSqDdBfjC9lQfU
JQWs5phmLoP/DrAxguKNa6m+YSPvK4BTpHjHnu8hHKftIorB3207TXjiZyLSx0wR
DBvI2W2YYoV8ibk4bC32G6Nvcs9+GcC5oTEVJFw/RlYqUugOFD3d8HlFQVVSSRbu
mhkp8VvKOJAwaRHoB4asdRIvtZ0WzQ3hrj2y4ps1iiH1UyTNmatD/XhWRJuDWv7k
Ar4DDsUa3osAuwfYX7/8mBi24YO6oWOk0gLZOtAWQtfupkVTIV0Zgl2st6fjZ2Mo
S7qn2j1YMwtjUncogR1WavqH8pa2eNr5pCJ+q/q1cty8yxA8Svo=
=fE3x
-----END PGP SIGNATURE-----

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-utopia-maintainers/attachments/20260826/306d6daa/attachment.sig>