Go modules · #1771

github.com/opencontainers/umoci

v0.6.0opencontainers/umoci ↗

Last release 5 months ago
15 Mar 2026
Release timing varies
gaps range from 8 days to 3 months
Nearly every release is documented
notes for 14 of 14 stable releases
Nothing withdrawn
no release was ever pulled
10 years old
905 releases · first in 2016

Release timeline

905 releases since 2016

20182020202220242026

Releases

v0.4.8-0.20210920192315-01d1f2bdc33820 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210920143109-26e57a24726020 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210920135131-27e655d46e9820 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210920013043-65932cd5f4fe20 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210920013038-17111a622d6e20 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210903050032-f6c2e79124d83 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210902134818-a737519f20962 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210902134736-56f6b190a0732 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210902115553-f80d8e239b6c2 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210902084911-d5b264299e702 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210901212216-785ed73be5761 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210901134141-97099f1f8b4e1 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210901133916-8a1c8e7580351 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210901092813-5adbd995a49e1 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210901092811-aad89ed2eddb1 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210901075204-7091cd1e11541 Sept 2021pre-release
Nothing published for this version
v0.4.8-0.20210422230737-758044fc26ad22 Apr 2021pre-release
Nothing published for this version
v0.4.8-0.20210422221510-3ceb144d1d1322 Apr 2021pre-release
Nothing published for this version
v0.4.8-0.20210420234344-089592e6ba6220 Apr 2021pre-release
Nothing published for this version
v0.4.8-0.20210419173441-acbacd44edde19 Apr 2021pre-release
Nothing published for this version
v0.4.8-0.20210419163422-e20a94a87a7e19 Apr 2021pre-release
Nothing published for this version
v0.4.8-0.20210413005047-ca21d934a89c13 Apr 2021pre-release
Nothing published for this version
v0.4.8-0.20210412123716-a5d1ee156b7612 Apr 2021pre-release
Nothing published for this version
v0.4.8-0.20210405120001-ea57e3b684575 Apr 2021pre-release
Nothing published for this version
v0.4.8-0.20210405115912-be261b916fa35 Apr 2021pre-release
Nothing published for this version
v0.4.75 Apr 2021
Release notes
NOTE This release has a minor bug -- umoci --version will tell you that the version is "unknown". This was fixed in #369.

A security flaw was found in umoci, and has been fixed in this release.
If umoci was used to unpack a malicious image (using either
umoci unpack or umoci raw unpack) that contained a symlink entry for /.,
umoci would apply subsequent layers to the target of the symlink
(resolved on the host filesystem). This means that if you ran umoci as
root, a malicious image could overwrite any file on the system (assuming
you didn't have any other access control restrictions). Thanks to Robin
Peraglie from Cure53 for discovering this bug. CVE-2021-29136

Other changes in this release:
- umoci now compiles on FreeBSD and appears to work, with the notable
  limitation that it currently refuses to extract non-Linux images on any
  platform (this will be fixed in a future release -- see #364). #357
- Initial fuzzer implementations for oss-fuzz. #365
- umoci will now read all trailing data from image layers, to combat the
  existence of some image generators that appear to append NUL bytes to the end
  of the gzip stream (which would previously cause checksum failures because we
  didn't read nor checksum the trailing junk bytes). However, umoci will still
  not read past the descriptor length. #360
- umoci now ignores all overlayfs xattrs during unpack and repack operations,
  to avoid causing issues when packing a raw overlayfs directory. #354
- Changes to the (still-internal) APIs to allow for users to use umoci more
  effectively as a library.
  - The garbage collection API now supports custom GC policies. #338
  - The mutate API now returns information about what layers were added by the
    operation. #344
  - The mutate API now supports custom compression, and has in-tree support for
    zstd. #348 #350
  - Support overlayfs-style whiteouts during unpack and repack. #342
Thanks to all of the people who made this release possible:
- Adam Korcz [email protected]
- Aleksa Sarai [email protected]
- Mateusz Kwiatkowski [email protected]
- Nisha K [email protected]
- Ramkumar Chinchani [email protected]
- Shengjing Zhu [email protected]
- Tycho Andersen [email protected]
LGTMs: @cyphar
Signed-off-by: Aleksa Sarai [email protected]
Open source →
Release notes
Security
- A security flaw was found in umoci, and has been fixed in this release. If umoci was used to unpack a malicious image (using either umoci unpack or umoci raw unpack) that contained a symlink entry for /., umoci would apply subsequent layers to the target of the symlink (resolved on the host filesystem). This means that if you ran umoci as root, a malicious image could overwrite any file on the system (assuming you didn't have any other access control restrictions). CVE-2021-29136
Added
- umoci now compiles on FreeBSD and appears to work, with the notable limitation that it currently refuses to extract non-Linux images on any platform (this will be fixed in a future release -- see #364). #357
- Initial fuzzer implementations for oss-fuzz. #365
Changed
- umoci will now read all trailing data from image layers, to combat the existence of some image generators that appear to append NUL bytes to the end of the gzip stream (which would previously cause checksum failures because we didn't read nor checksum the trailing junk bytes). However, umoci will still not read past the descriptor length. #360
- umoci now ignores all overlayfs xattrs during unpack and repack operations, to avoid causing issues when packing a raw overlayfs directory. #354
- Changes to the (still-internal) APIs to allow for users to use umoci more effectively as a library.
  - The garbage collection API now supports custom GC policies. #338
  - The mutate API now returns information about what layers were added by the operation. #344
  - The mutate API now supports custom compression, and has in-tree support for zstd. #348 #350
  - Support overlayfs-style whiteouts during unpack and repack. #342
Open source →
Release notes
umoci 0.4.7

Compare

Choose a tag to compare

Open source →
v0.4.7-0.20240306125805-0a7d3ec870776 Mar 2024pre-release
Nothing published for this version
v0.4.7-0.20220301172632-87f2e175be311 Mar 2022pre-release
Nothing published for this version
v0.4.7-0.20211009121349-9c76304c034d9 Oct 2021pre-release
Nothing published for this version
v0.4.7-0.20210903050032-f6c2e79124d83 Sept 2021pre-release
Nothing published for this version
v0.4.7-0.20210420163055-d5d13baab7c020 Apr 2021pre-release
Nothing published for this version
v0.4.7-0.20210405115745-9b9c3cae049b5 Apr 2021pre-release
Nothing published for this version
v0.4.7-0.20210405115729-c6feeab1fb4a5 Apr 2021pre-release
Nothing published for this version
v0.4.7-0.20210405115726-d9efc31daf225 Apr 2021pre-release
Nothing published for this version
v0.4.7-0.20210330121820-07fa845e5b0630 Mar 2021pre-release
Nothing published for this version
v0.4.7-0.20210330121705-0976fbba65e230 Mar 2021pre-release
Nothing published for this version
v0.4.7-0.20210329170752-1f954d4d457429 Mar 2021pre-release
Nothing published for this version
v0.4.7-0.20210329170749-4faf753956f629 Mar 2021pre-release
Nothing published for this version
v0.4.7-0.20210319093821-3d09b87400b319 Mar 2021pre-release
Nothing published for this version
v0.4.7-0.20210318040234-5bb0f6fe19fd18 Mar 2021pre-release
Nothing published for this version
v0.4.7-0.20210318040219-7c5a478292cb18 Mar 2021pre-release
Nothing published for this version
v0.4.7-0.20210311070915-5412deddc7da11 Mar 2021pre-release
Nothing published for this version
v0.4.7-0.20210306002704-130e11adfe106 Mar 2021pre-release
Nothing published for this version
v0.4.7-0.20210304080702-ea32e1d5e2c14 Mar 2021pre-release
Nothing published for this version
v0.4.7-0.20210226092314-6fbd32e48b6626 Feb 2021pre-release
Nothing published for this version
v0.4.7-0.20210226091031-4a16dca1946726 Feb 2021pre-release
Nothing published for this version
v0.4.7-0.20210209144743-64c489842ec99 Feb 2021pre-release
Nothing published for this version
v0.4.7-0.20210202172325-d193642799c82 Feb 2021pre-release
Nothing published for this version
v0.4.7-0.20210202172227-8e665b719d0a2 Feb 2021pre-release
Nothing published for this version
v0.4.7-0.20210128185808-b171df228c3928 Jan 2021pre-release
Nothing published for this version
v0.4.7-0.20210114034744-312f2f6bc8d114 Jan 2021pre-release
Nothing published for this version
v0.4.7-0.20201217091626-9574d71b399517 Dec 2020pre-release
Nothing published for this version
v0.4.7-0.20201217060908-53a70f8810c817 Dec 2020pre-release
Nothing published for this version
v0.4.7-0.20201217045247-1e9c04257d3117 Dec 2020pre-release
Nothing published for this version
v0.4.7-0.20201201202832-2399123092791 Dec 2020pre-release
Nothing published for this version
v0.4.7-0.20201121021457-d405714a4f5f21 Nov 2020pre-release
Nothing published for this version
v0.4.7-0.20201029051143-b09d036cbfde29 Oct 2020pre-release
Nothing published for this version
v0.4.7-0.20201028174458-9dd9f79fe4e828 Oct 2020pre-release
Nothing published for this version
v0.4.7-0.20200930143527-05c30365a67430 Sept 2020pre-release
Nothing published for this version
v0.4.7-0.20200929202219-d82a276181ed29 Sept 2020pre-release
Nothing published for this version

github.com/opencontainers/umoci

Release timeline

Releases

Security

Added

Changed

Choose a tag to compare