NOTE This release has a minor bug -- umoci --version will tell you that the version is "unknown". This was fixed in #369.

A security flaw was found in umoci, and has been fixed in this release.
If umoci was used to unpack a malicious image (using either
umoci unpack or umoci raw unpack) that contained a symlink entry for /.,
umoci would apply subsequent layers to the target of the symlink
(resolved on the host filesystem). This means that if you ran umoci as
root, a malicious image could overwrite any file on the system (assuming
you didn't have any other access control restrictions). Thanks to Robin
Peraglie from Cure53 for discovering this bug. CVE-2021-29136

Other changes in this release:

• umoci now compiles on FreeBSD and appears to work, with the notable
  limitation that it currently refuses to extract non-Linux images on any
  platform (this will be fixed in a future release -- see #364). #357
• Initial fuzzer implementations for oss-fuzz. #365

• umoci will now read all trailing data from image layers, to combat the
  existence of some image generators that appear to append NUL bytes to the end
  of the gzip stream (which would previously cause checksum failures because we
  didn't read nor checksum the trailing junk bytes). However, umoci will still
  not read past the descriptor length. #360
• umoci now ignores all overlayfs xattrs during unpack and repack operations,
  to avoid causing issues when packing a raw overlayfs directory. #354
• Changes to the (still-internal) APIs to allow for users to use umoci more
  effectively as a library.
  • The garbage collection API now supports custom GC policies. #338
  • The mutate API now returns information about what layers were added by the
    operation. #344
  • The mutate API now supports custom compression, and has in-tree support for
    zstd. #348 #350
  • Support overlayfs-style whiteouts during unpack and repack. #342

Thanks to all of the people who made this release possible:

• Adam Korcz adam@adalogics.com
• Aleksa Sarai cyphar@cyphar.com
• Mateusz Kwiatkowski mateusz@serveraptor.com
• Nisha K nishak@vmware.com
• Ramkumar Chinchani rchincha@cisco.com
• Shengjing Zhu zhsj@debian.org
• Tycho Andersen tycho@tycho.pizza

LGTMs: @cyphar
Signed-off-by: Aleksa Sarai cyphar@cyphar.com