CVE-2026-25727

Impact

When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.

Patches

A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

Workarounds

Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of the stack consumed would be at most a factor of the length of the input.

Alternatively, avoiding the format altogether would also ensure that the vulnerability is not encountered. To do this, add

disallowed-types = ["time::format_description::well_known::Rfc2822"]

to your clippy.toml file. This will trigger the clippy::disallowed_types lint, which is warn-by-default and can be explicitly denied.

Impact

When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.

Patches

A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

Workarounds

Limiting the length of user input is the simplest way to avoid stack exhaustion, as the amount of the stack consumed would be at most a factor of the length of the input.

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.

This update for himmelblau fixes the following issues:

Update to himmelblau 2.3.8 (jsc#PED-14511):

Security issues:

• CVE-2025-54882: world readable cloud TGT token (bsc#1247735).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249013).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257904).
• CVE-2026-31979: race condition when accessiung /tmp/krb5cc_<uid> (bsc#1259548).

Non security issues:

• Fix SELinux module packaging to use standard policy macros (bsc#1258236).

Changelog:

Version 2.3.8:

• Add PrivateTmp back to Tasks Daemon
• Drop dead code
• Drop krb5 ccache dir code
• Add a TODO comment
• Drop non working packaged krb5 snippet file
• Write kerberos config snippet
• Extend resolver interface to return kerberos config together with TGTs
• Backport SELinux fixes from main
• Use libkrimes to store TGTs

Version 2.3.7:

• cargo vet
• Fix AWS-LC has PKCS7_verify Certificate Chain Validation Bypass
• Revert dependency change which broke the nightly build
• gen_dockerfiles: only himmelblaud has tpm feature, fix all others
• fix(build): gen_dockerfiles.py mutates shared features list mid-loop

Version 2.3.5:

• Better handle Intune API version
• Update make vet from main branch
• pam_himmelblau: call split_username once in chauthtok
• pam_himmelblau: return PAM_IGNORE in chauthtok for local users
• Don't attempt a DAG when Hello fails with SSPR demand

Version 2.3.4:

• deps(rust): bump the all-cargo-updates group across 1 directory with 8 updates
• Revert sketching update (which breaks SLE16 build)

Version 2.3.3:

• /var/cache/private/himmelblaud should not be created tmpfiles
• Updatee python vers for dataclasses dep
• deps(rust): bump the all-cargo-updates group across 1 directory with 3 updates
• Generate pin init service file systemd < 250
• Checkin missing himmelblaud.if file for SELinux
• Resolve typos in selinux package commands

Version 2.3.2:

• Compile SELinux policy at install time for cross-distro compatibility
• Improve PAM configuration on openSUSE/SLE
• Fix SELinux policy
• Add a git hook to ensure selinux policy is tested
• Ignore generated himmelblau-hsm-pin-init service file
• Refactor SELinux policy for cross-distro compatibility
• Fix NSS lookup for mapped local users
• Skip OS version compliance checks when min/max values are empty

Version 2.3.1:

• Remove references to qrcodegen (these are 3.x features)
• QR Greeter compatibility for old GNOME
• Enable QR greeter automatically
• ci: Use latest cargo-vet from git to fix CI
• Fix HSM pin migration failure on Debian/Ubuntu upgrades from v1.4.x

Version 2.3.0:

• Autostart the daemons on fresh install or upgrade
• Restart sshd when installing the ssh config
• Allow tasks daemon to write krb ccache
• Do not enumerate mapped users in NSS
• Update libhimmelblau to latest version
• Fix Tumbleweed build

Version 2.2.0:

• Update libhimmelblau to 0.8.x series
• deps(rust): bump the all-cargo-updates group with 17 updates
• Only use OpenSSH bug workaround for ssh service
• Fix debug noise from removing user from sudo group
• systemd: install files to /usr/lib/, not /etc/

Version 2.1.0:

• Fix nightly authselect build failure
• Generate the authselect profiles for each distro
• Improve pam config handling in aad-tool
• Make aad-tool configure-pam detect location of pam files

Version 2.0.5:

• /var/lib/private/himmelblaud should be owned by root
• Use tmpfiles.d to create himmelblaud private data directory
• deps(rust): bump the all-cargo-updates group with 13 updates

Version 2.0.4:

• Update kanidm_build_profiles mask version

• Utilize cargo vet from main

• Add policies cache patch via systemd-tmpfiles

• Fix man page comments about change idmap_range

• Stub picky-krb for osc build

• Stub a kanidm_build_profiles which builds in osc

• Ensure nss cache is created on Ubuntu/Debian

• Request a user…

These are all security issues fixed in the keylime-ima-policy-0.2.8+116-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the wicked2nm-1.4.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo-audit-0.22.1~git0.efcde93-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-maturin-1.11.5-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rustup-1.28.2~0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sccache-0.13.0~1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the snpguest-0.10.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo-auditable-0.7.2~0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo-c-0.10.15-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the himmelblau-2.3.5+git0.9dd526c-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the virtiofsd-1.13.2-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.5.0~git0.2950b36-1.1 package on the GA media of openSUSE Tumbleweed.

This update for wicked2nm fixes the following issues:

• Update to version 1.4.1
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257908).

This update for virtiofsd fixes the following issue:

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257912).

This update for rust-keylime fixes the following issues:

• Update to version 0.2.8+116:
• CVE-2026-25727: Update vendored crates to fix a date parser can lead to stack exhaustion in Time. (bsc#1257908)

This update for python-maturin fixes the following issue:

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257918).

This update for snpguest fixes the following issues:

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257927).
• Update to version 0.10.0 (bsc#1257877):
  • chore: updating tool version to 0.10.0
  • refactor(certs): remove redundant branch in file-write logic
  • Docs: Adding verify measure, host-data, report-data to docs
  • verify: verify measurent, host data, and report data attributes from the attestation report.
  • library: Updating sev library to 7.1.0
  • ci: replace deprecated gh actions
  • feat: multi-format integer parsing for key subcommand arguments
  • chore(main): remove unused import clap::arg
  • feat(fetch): add fetch crl subcommand
  • .github/lint: Bump toolchain version to 1.86
  • Bump rust version to 1.86
  • feat: bumping tool to version 0.9.2
  • fix(verify): silence mismatched_lifetime_syntaxes in SnpOid::oid
  • feat: support SEV-SNP ABI Spec 1.58 (bump sev to v6.3.0)
  • docs: restore and clarify Global Options section
  • doc: fix CL argument orders + address recent changes
  • fix(hyperv): downgrade VMPL check from error to warning
  • fix(report.rs): remove conflict check between --random flag and Hyper-V
  • fix(report.rs): Decouple runtime behavior from hyperv build feature
  • refactor: clarify --platform error message
  • docs: add Azure/Hyper-V build note for --platform
  • docs: Update README.md
  • report: Writing Req Data as Binary (#101)
  • deps: bump virtee/sev to 6.2.1 (fix TCB-serialization bug) (#99)

This update for librsvg fixes the following issue:

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257922).

This update for agama fixes the following issue

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257930).

Changes for agama:

• Update "time" crate to version 0.3.47.

This update for gstreamer-devtools fixes the following issues:

• CVE-2025-4574: crossbeam-channel: internal Channel type's Drop method has a race condition that can lead to a double-free and memory corruption (bsc#1243178).
• CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into terminal output when logged and lead to terminal manipulation (bsc#1249015).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1274306).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257914).
• CVE-2026-72813: actix-files: empty Range header in GET requests for static files can lead to a process crash (bsc#1275210).
• CVE-2026-72814: actix-files: non-existing folders passed as an argument to the actix_files::Files::new() method can lead to information disclosure (bsc#1275209).

This update for aws-nitro-enclaves-cli fixes the following issues:

• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274300).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257933).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270202).

Changes for aws-nitro-enclaves-cli:

• Update to version 1.5.0

This update for sccache fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257923).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270206).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270559).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270736).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270869).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270512).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270938).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270948).
• CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).
• CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884).
• CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).
• CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).

Changes for sccache:

Update to version 0.18.0~2:

• Add experimental concurrent cache support
• chore: Remove dependency status badge (#2856)
• Don't hand the jobserver to children that can't use it
• dist: refuse to trim rlibs from crates that also emit a cdylib
• fix(cache): avoid duplicate multilevel reads
• Strip basedirs from the compiler arguments too
• tests/integration: replace MinIO with Silo
• ci: dump sccache logs on integration failures
• multilevel: a chain with any writable level is writable
• Fix parsing of #line directives
• Release 0.18.0
• daemonize: use an allow-list approach to inherited FDs
• gcc, clang: make the assembler part of the cache key
• support cl.exe /openmp:llvm
• support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args
• support MSVC /feature argument
• msvc: support lots of flags (#2832)
• Update shlex dependency to version 2 (#2836)
• gcc: mark flags as TooHard if need to cache something else (#2833)
• clang: support more CLI options (#2834)
• msvc: support arm64EC and fastfail flags (#2830)
• chore: fix typo in comment (#2829)
• nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)
• cache: allow skipping capability checks (#2822)
• Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)
• nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)
• Add an agent (#2812)
• Add support for d20bforceinline. (#2807)
• feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)
• Bump MSRV to 1.91.0 (#2793)
• Fix nvcc dryrun parsing for CUDA 13.3 (#2722)
• test: Fixed…

This update for rustup fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274144).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).
• rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Changes for rustup:

• Update to version 1.29.1~0:

• dist(rustup-init/sh): update commit shasum in help string
• style(bin/rustup-init): reformat code
• docs(changelog): update for v1.29.1 stable release
• warn how to switch away from the deprecated complete profile
• fix(cli/help): fix wording in rustup run --help
• ci(docker/android): stop building OpenSSL
• refactor(cli/docs): use tracing for docs opening status messages
• refactor(self-update): rename Windows uninstall registry helpers
• feat(test): isolate Windows registry state per test
• docs(dev-guide): mention how to support new compilation targets
• Fix funding link
• chore(deps): lock file maintenance
• refactor(cli/self-update): move current_install_opts() to InstallOpts::display()
• refactor(cli/self-update): move process out of InstallOpts
• fix(cli/self-update): postpone initialization of Cfg in setup_mode
• refactor(cli/self-update): take Process in check_existence_of_settings_file()
• fix(settings): prevent creating new file with SettingsFile::read_settings()
• test(cli-inst-interactive): test file creation on cancelled installation
• refactor(toolchain/names): inline validate() aliases into FromStr
• refactor(toolchain/names): rename validate() to normalize_name()
• fix minor typos
• www: align copy icon
• refactor(toolchain/names)!: remove try_from_str!()
• refactor(toolchain/names)!: remove from_variant!()
• Add rustup doc --serve to serve docs over local HTTP
• Move doc() and man() into a new docs module
• chore(github): comment out instructions in PR template
• docs(dev-guide): reapply abandoned changes from #4970
• Add riscv64 unknown linux musl support
• fix(deps): update rust crate enum-map to v3
• refactor(cli/self-update)!: rename install() to InstallOpts::install()
• refactor(cli/self-update)!: rename maybe_install_rust() to InstallOpts::install_rust()
• refactor(cli/self-update)!: rename…

This update for virtiofsd fixes the following issue:

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257912).

Changes for virtiofsd:

• Update the time crate (bsc#1257912, CVE-2026-25727)
• Add command line options for UID/GID translation (bsc#1283239)
• PassthroughFs: Add IdMap structures (bsc#1283239)
• Add host/guest UID/GID translation code (bsc#1283239)
• Custom UID/GID mapping for Attr (bsc#1283239)
• Add UID/GID mapping functions to PassthroughFs (bsc#1283239)
• Use explicit UID/GID types (bsc#1283239)
• Introduce explicit UID/GID types (bsc#1283239)
• Use SetattrIn without conversion (bsc#1283239)
• Use fuse::Attr in FileSystem interfaces (bsc#1283239)

This update for himmelblau fixes the following issues:

Update to himmelblau 2.3.8 (jsc#PED-14511):

Security issues:

• CVE-2025-54882: world readable cloud TGT token (bsc#1247735).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249013).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257904).
• CVE-2026-31979: race condition when accessiung /tmp/krb5cc_<uid> (bsc#1259548).

Non security issues:

• Fix SELinux module packaging to use standard policy macros (bsc#1258236).

Changelog:

Version 2.3.8:

• Add PrivateTmp back to Tasks Daemon
• Drop dead code
• Drop krb5 ccache dir code
• Add a TODO comment
• Drop non working packaged krb5 snippet file
• Write kerberos config snippet
• Extend resolver interface to return kerberos config together with TGTs
• Backport SELinux fixes from main
• Use libkrimes to store TGTs

Version 2.3.7:

• cargo vet
• Fix AWS-LC has PKCS7_verify Certificate Chain Validation Bypass
• Revert dependency change which broke the nightly build
• gen_dockerfiles: only himmelblaud has tpm feature, fix all others
• fix(build): gen_dockerfiles.py mutates shared features list mid-loop

Version 2.3.5:

• Better handle Intune API version
• Update make vet from main branch
• pam_himmelblau: call split_username once in chauthtok
• pam_himmelblau: return PAM_IGNORE in chauthtok for local users
• Don't attempt a DAG when Hello fails with SSPR demand

Version 2.3.4:

• deps(rust): bump the all-cargo-updates group across 1 directory with 8 updates
• Revert sketching update (which breaks SLE16 build)

Version 2.3.3:

• /var/cache/private/himmelblaud should not be created tmpfiles
• Updatee python vers for dataclasses dep
• deps(rust): bump the all-cargo-updates group across 1 directory with 3 updates
• Generate pin init service file systemd < 250
• Checkin missing himmelblaud.if file for SELinux
• Resolve typos in selinux package commands

Version 2.3.2:

• Compile SELinux policy at install time for cross-distro compatibility
• Improve PAM configuration on openSUSE/SLE
• Fix SELinux policy
• Add a git hook to ensure selinux policy is tested
• Ignore generated himmelblau-hsm-pin-init service file
• Refactor SELinux policy for cross-distro compatibility
• Fix NSS lookup for mapped local users
• Skip OS version compliance checks when min/max values are empty

Version 2.3.1:

• Remove references to qrcodegen (these are 3.x features)
• QR Greeter compatibility for old GNOME
• Enable QR greeter automatically
• ci: Use latest cargo-vet from git to fix CI
• Fix HSM pin migration failure on Debian/Ubuntu upgrades from v1.4.x

Version 2.3.0:

• Autostart the daemons on fresh install or upgrade
• Restart sshd when installing the ssh config
• Allow tasks daemon to write krb ccache
• Do not enumerate mapped users in NSS
• Update libhimmelblau to latest version
• Fix Tumbleweed build

Version 2.2.0:

• Update libhimmelblau to 0.8.x series
• deps(rust): bump the all-cargo-updates group with 17 updates
• Only use OpenSSH bug workaround for ssh service
• Fix debug noise from removing user from sudo group
• systemd: install files to /usr/lib/, not /etc/

Version 2.1.0:

• Fix nightly authselect build failure
• Generate the authselect profiles for each distro
• Improve pam config handling in aad-tool
• Make aad-tool configure-pam detect location of pam files

Version 2.0.5:

• /var/lib/private/himmelblaud should be owned by root
• Use tmpfiles.d to create himmelblaud private data directory
• deps(rust): bump the all-cargo-updates group with 13 updates

Version 2.0.4:

• Update kanidm_build_profiles mask version

• Utilize cargo vet from main

• Add policies cache patch via systemd-tmpfiles

• Fix man page comments about change idmap_range

• Stub picky-krb for osc build

• Stub a kanidm_build_profiles which builds in osc

• Ensure nss cache is created on Ubuntu/Debian

• Request a user…

This update for rust-keylime fixes the following issues:

Update to version 0.2.8+116.

Security issues fixed:

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257908).

Other updates and bugfixes:

• Update vendored crates time to version 0.3.47.

• Update to version 0.2.8+116:

  • build(deps): bump bytes from 1.7.2 to 1.11.1
  • api: Modify /version endpoint output in version 2.5
  • Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  • tests: add unit test for resolve_agent_id (#1182)
  • (pull-model): enable retry logic for registration
  • rpm: Update specfiles to apply on master
  • workflows: Add test to detect unused crates
  • lib: Drop unused crates
  • push-model: Drop unused crates
  • keylime-agent: Drop unused crates
  • build(deps): bump uuid from 1.18.1 to 1.19.0
  • Update reqwest-retry to 0.8, retry-policies to 0.5
  • rpm: Fix cargo_build macro usage on CentOS Stream
  • fix(push-model): resolve hash_ek uuid to actual EK hash
  • build(deps): bump thiserror from 2.0.16 to 2.0.17
  • workflows: Separate upstream test suite from e2e coverage
  • Send UEFI measured boot logs as raw bytes (#1173)
  • auth: Add unit tests for SecretToken implementation
  • packit: Enable push-attestation tests
  • resilient_client: Prevent authentication token leakage in logs

• Use tmpfiles.d for /var directories (PED-14736)

• Update to version 0.2.8+96:

  • build(deps): bump wiremock from 0.6.4 to 0.6.5
  • build(deps): bump actions/checkout from 5 to 6
  • build(deps): bump chrono from 0.4.41 to 0.4.42
  • packit: Get coverage from Fedora 43 runs
  • Fix issues pointed out by clippy
  • Replace mutex unwraps with proper error handling in TPM library
  • Remove unused session request methods from StructureFiller
  • Fix config panic on missing ek_handle in push model agent
  • build(deps): bump tempfile from 3.21.0 to 3.23.0
  • build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  • Fix clippy warnings project-wide
  • Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  • Thread privileged resources and use MeasurementList for IMA reading
  • Add privileged resource initialization and privilege dropping to push model agent
  • Fix privilege dropping order in run_as()
  • add documentation on FQDN hostnames
  • Remove confusing logs for push mode agent
  • Set correct default Verifier port (8891->8881) (#1159)
  • Add verifier_url to reference configuration file (#1158)
  • Add TLS support for Registrar communication (#1139)
  • Fix agent handling of 403 registration responses (#1154)
  • Add minor README.md rephrasing (#1151)
  • build(deps): bump actions/checkout from 5 to 6 (#1153)
  • ci: update spec files for packit COPR build
  • docs: improve challenge encoding and async TPM documentation
  • refactor: improve middleware and error handling
  • feat: add authentication client with middleware integration
  • docker: Include keylime_push_model_agent binary
  • Include attestation_interval configuration (#1146)
  • Persist payload keys to avoid attestation failure on restart
  • crypto: Implement the load or generate pattern for keys
  • Use simple algorithm specifiers in certification_keys object (#1140)
  • tests: Enable more tests in CI
  • Fix RSA2048 algorithm reporting in keylime agent
  • Remove disabled_signing_algorithms configuration
  • rpm: Fix metadata patches to apply to current code
  • workflows/rpm.yml: Use more strict patching
  • build(deps): bump uuid from 1.17.0 to 1.18.1
  • Fix ECC algorithm selection and reporting for keylime agent
  • Improve logging consistency and coherency
  • Implement minimal RFC compliance for Location header and URI parsing (#1125)
  • Use separate keys for payload mechanism and mTLS
  • docker: update rust to 1.81 for distroless Dockerfile
  • Ensure UEFI log capabilities are set to false
  • build(deps): bump http from 1.1.0 to 1.3.1
  • build(deps):…

This update for rust-keylime fixes the following issues:

Update to version 0.2.8+116.

Security issues fixed:

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257908).

Other updates and bugfixes:

• Update vendored crates time to version 0.3.47.

• Update to version 0.2.8+116:

  • build(deps): bump bytes from 1.7.2 to 1.11.1
  • api: Modify /version endpoint output in version 2.5
  • Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  • tests: add unit test for resolve_agent_id (#1182)
  • (pull-model): enable retry logic for registration
  • rpm: Update specfiles to apply on master
  • workflows: Add test to detect unused crates
  • lib: Drop unused crates
  • push-model: Drop unused crates
  • keylime-agent: Drop unused crates
  • build(deps): bump uuid from 1.18.1 to 1.19.0
  • Update reqwest-retry to 0.8, retry-policies to 0.5
  • rpm: Fix cargo_build macro usage on CentOS Stream
  • fix(push-model): resolve hash_ek uuid to actual EK hash
  • build(deps): bump thiserror from 2.0.16 to 2.0.17
  • workflows: Separate upstream test suite from e2e coverage
  • Send UEFI measured boot logs as raw bytes (#1173)
  • auth: Add unit tests for SecretToken implementation
  • packit: Enable push-attestation tests
  • resilient_client: Prevent authentication token leakage in logs

• Use tmpfiles.d for /var directories (PED-14736)

• Update to version 0.2.8+96:

  • build(deps): bump wiremock from 0.6.4 to 0.6.5
  • build(deps): bump actions/checkout from 5 to 6
  • build(deps): bump chrono from 0.4.41 to 0.4.42
  • packit: Get coverage from Fedora 43 runs
  • Fix issues pointed out by clippy
  • Replace mutex unwraps with proper error handling in TPM library
  • Remove unused session request methods from StructureFiller
  • Fix config panic on missing ek_handle in push model agent
  • build(deps): bump tempfile from 3.21.0 to 3.23.0
  • build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  • Fix clippy warnings project-wide
  • Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  • Thread privileged resources and use MeasurementList for IMA reading
  • Add privileged resource initialization and privilege dropping to push model agent
  • Fix privilege dropping order in run_as()
  • add documentation on FQDN hostnames
  • Remove confusing logs for push mode agent
  • Set correct default Verifier port (8891->8881) (#1159)
  • Add verifier_url to reference configuration file (#1158)
  • Add TLS support for Registrar communication (#1139)
  • Fix agent handling of 403 registration responses (#1154)
  • Add minor README.md rephrasing (#1151)
  • build(deps): bump actions/checkout from 5 to 6 (#1153)
  • ci: update spec files for packit COPR build
  • docs: improve challenge encoding and async TPM documentation
  • refactor: improve middleware and error handling
  • feat: add authentication client with middleware integration
  • docker: Include keylime_push_model_agent binary
  • Include attestation_interval configuration (#1146)
  • Persist payload keys to avoid attestation failure on restart
  • crypto: Implement the load or generate pattern for keys
  • Use simple algorithm specifiers in certification_keys object (#1140)
  • tests: Enable more tests in CI
  • Fix RSA2048 algorithm reporting in keylime agent
  • Remove disabled_signing_algorithms configuration
  • rpm: Fix metadata patches to apply to current code
  • workflows/rpm.yml: Use more strict patching
  • build(deps): bump uuid from 1.17.0 to 1.18.1
  • Fix ECC algorithm selection and reporting for keylime agent
  • Improve logging consistency and coherency
  • Implement minimal RFC compliance for Location header and URI parsing (#1125)
  • Use separate keys for payload mechanism and mTLS
  • docker: update rust to 1.81 for distroless Dockerfile
  • Ensure UEFI log capabilities are set to false
  • build(deps): bump http from 1.1.0 to 1.3.1 *…

This update for rust-keylime fixes the following issues:

Update to version 0.2.8+116.

Security issues fixed:

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257908).

Other updates and bugfixes:

• Update vendored crates time to version 0.3.47.

• Update to version 0.2.8+116:

  • build(deps): bump bytes from 1.7.2 to 1.11.1
  • api: Modify /version endpoint output in version 2.5
  • Add API v2.5 with backward-compatible /v2.5/quotes/integrity
  • tests: add unit test for resolve_agent_id (#1182)
  • (pull-model): enable retry logic for registration
  • rpm: Update specfiles to apply on master
  • workflows: Add test to detect unused crates
  • lib: Drop unused crates
  • push-model: Drop unused crates
  • keylime-agent: Drop unused crates
  • build(deps): bump uuid from 1.18.1 to 1.19.0
  • Update reqwest-retry to 0.8, retry-policies to 0.5
  • rpm: Fix cargo_build macro usage on CentOS Stream
  • fix(push-model): resolve hash_ek uuid to actual EK hash
  • build(deps): bump thiserror from 2.0.16 to 2.0.17
  • workflows: Separate upstream test suite from e2e coverage
  • Send UEFI measured boot logs as raw bytes (#1173)
  • auth: Add unit tests for SecretToken implementation
  • packit: Enable push-attestation tests
  • resilient_client: Prevent authentication token leakage in logs

• Use tmpfiles.d for /var directories (PED-14736)

• Update to version 0.2.8+96:

  • build(deps): bump wiremock from 0.6.4 to 0.6.5
  • build(deps): bump actions/checkout from 5 to 6
  • build(deps): bump chrono from 0.4.41 to 0.4.42
  • packit: Get coverage from Fedora 43 runs
  • Fix issues pointed out by clippy
  • Replace mutex unwraps with proper error handling in TPM library
  • Remove unused session request methods from StructureFiller
  • Fix config panic on missing ek_handle in push model agent
  • build(deps): bump tempfile from 3.21.0 to 3.23.0
  • build(deps): bump actions/upload-artifact from 4 to 6 (#1163)
  • Fix clippy warnings project-wide
  • Add KEYLIME_DIR support for verifier TLS certificates in push model agent
  • Thread privileged resources and use MeasurementList for IMA reading
  • Add privileged resource initialization and privilege dropping to push model agent
  • Fix privilege dropping order in run_as()
  • add documentation on FQDN hostnames
  • Remove confusing logs for push mode agent
  • Set correct default Verifier port (8891->8881) (#1159)
  • Add verifier_url to reference configuration file (#1158)
  • Add TLS support for Registrar communication (#1139)
  • Fix agent handling of 403 registration responses (#1154)
  • Add minor README.md rephrasing (#1151)
  • build(deps): bump actions/checkout from 5 to 6 (#1153)
  • ci: update spec files for packit COPR build
  • docs: improve challenge encoding and async TPM documentation
  • refactor: improve middleware and error handling
  • feat: add authentication client with middleware integration
  • docker: Include keylime_push_model_agent binary
  • Include attestation_interval configuration (#1146)
  • Persist payload keys to avoid attestation failure on restart
  • crypto: Implement the load or generate pattern for keys
  • Use simple algorithm specifiers in certification_keys object (#1140)
  • tests: Enable more tests in CI
  • Fix RSA2048 algorithm reporting in keylime agent
  • Remove disabled_signing_algorithms configuration
  • rpm: Fix metadata patches to apply to current code
  • workflows/rpm.yml: Use more strict patching
  • build(deps): bump uuid from 1.17.0 to 1.18.1
  • Fix ECC algorithm selection and reporting for keylime agent
  • Improve logging consistency and coherency
  • Implement minimal RFC compliance for Location header and URI parsing (#1125)
  • Use separate keys for payload mechanism and mTLS
  • docker: update rust to 1.81 for distroless Dockerfile
  • Ensure UEFI log capabilities are set to false
  • build(deps): bump http from 1.1.0 to 1.3.1
  • build(deps):…

This update for cargo-auditable fixes the following issues:

Update to version 0.7.2~0.

Security issues fixed:

• CVE-2026-25727: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257906).

Other updates and bugfixes:

• Update to version 0.7.2~0:

  • mention cargo-dist in README
  • commit Cargo.lock
  • bump which dev-dependency to 8.0.0
  • bump object to 0.37
  • Upgrade cargo_metadata to 0.23
  • Expand the set of dist platforms in config

• Update to version 0.7.1~0:

  • Out out of unhelpful clippy lint
  • Satisfy clippy
  • Do not assume --crate-name and --out-dir are present in the rustc command, but show warnings if they aren't
  • Run apt-get update before trying to install packages
  • run cargo dist init on dist 0.30
  • Drop allow-dirty from dist config, should no longer be needed
  • Reorder paragraphs in README
  • Note the maintenance transition for the go extraction library
  • Editing pass on the adopters: scanners
  • clarify Docker support
  • Cargo clippy fix
  • Add Wolfi OS and Chainguard to adopters
  • Update mentions around Anchore tooling
  • README and documentation updates for nightly
  • Bump dependency version in rust-audit-info
  • More work on docs
  • Nicer formatting on format revision documentation
  • Bump versions
  • regenerate JSON schema
  • cargo fmt
  • Document format field
  • Make it more clear that RawVersionInfo is private
  • Add format field to the serialized data
  • cargo clippy fix
  • Add special handling for proc macros to treat them as the build dependencies they are
  • Add a test to ensure proc macros are reported as build dependencies
  • Add a test fixture for a crate with a proc macro dependency
  • parse fully qualified package ID specs from SBOMs
  • select first discovered SBOM file
  • cargo sbom integration
  • Get rid of unmaintained wee_alloc in test code to make people's scanners misled by GHSA chill out
  • Don't fail plan workflow due to manually changed release.yml
  • Bump Ubuntu version to hopefully fix release.yml workflow
  • Add test for stripped binary
  • Bump version to 0.6.7
  • Populate changelog
  • README.md: add auditable2cdx, more consistency in text
  • Placate clippy
  • Do not emit -Wl if a bare linker is in use
  • Get rid of a compiler warning
  • Add bare linker detection function
  • drop boilerplate from test that's no longer relevant
  • Add support for recovering rustc codegen options
  • More lenient parsing of rustc arguments
  • More descriptive error message in case rustc is killed abruptly
  • change formatting to fit rustfmt
  • More descriptive error message in case cargo is killed
  • Update REPLACING_CARGO.md to fix #195
  • Clarify osv-scanner support in README
  • Include the command required to view metadata
  • Mention wasm-tools support
  • Switch from broken generic cache action to a Rust-specific one
  • Fill in various fields in auditable2cdx Cargo.toml
  • Include osv-scanner in the list, with a caveat
  • Add link to blint repo to README
  • Mention that blint supports our data
  • Consolidate target definitions
  • Account for WASM test dependencies changing, commit the Cargo.lock so they would stop doing that
  • Migrate to a maintained toolchain action
  • Fix author specification
  • Add link to repository to resolverver Cargo.toml
  • Bump resolverver to 0.1.0
  • Add resolverver crate to the tree

• Update to version 0.6.6~0:

  • Note the object upgrade in the changelog
  • Upgrade cyclonedx-bom from 0.5 to 0.8 in auditable-cyclonedx
  • Upgrade object crate from 0.30 to 0.36 to reduce dependency footprint
  • Update dependencies in the lock file
  • Populate changelog
  • apply clippy lint
  • add another --emit parsing test
  • shorter code with cargo fmt
  • Actually fix cargo-c compatibility
  • Attempt to fix cargo-capi incompatibility
  • Refactoring in preparation for fixes
  • Also read the --emit flag to rustc
  • Fill in changelogs
  • Bump…

This update for cargo-auditable fixes the following issues:

Update to version 0.7.2~0.

Security issues fixed:

• CVE-2026-25727: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257906).

Other updates and bugfixes:

• Update to version 0.7.2~0:

  • mention cargo-dist in README
  • commit Cargo.lock
  • bump which dev-dependency to 8.0.0
  • bump object to 0.37
  • Upgrade cargo_metadata to 0.23
  • Expand the set of dist platforms in config

• Update to version 0.7.1~0:

  • Out out of unhelpful clippy lint
  • Satisfy clippy
  • Do not assume --crate-name and --out-dir are present in the rustc command, but show warnings if they aren't
  • Run apt-get update before trying to install packages
  • run cargo dist init on dist 0.30
  • Drop allow-dirty from dist config, should no longer be needed
  • Reorder paragraphs in README
  • Note the maintenance transition for the go extraction library
  • Editing pass on the adopters: scanners
  • clarify Docker support
  • Cargo clippy fix
  • Add Wolfi OS and Chainguard to adopters
  • Update mentions around Anchore tooling
  • README and documentation updates for nightly
  • Bump dependency version in rust-audit-info
  • More work on docs
  • Nicer formatting on format revision documentation
  • Bump versions
  • regenerate JSON schema
  • cargo fmt
  • Document format field
  • Make it more clear that RawVersionInfo is private
  • Add format field to the serialized data
  • cargo clippy fix
  • Add special handling for proc macros to treat them as the build dependencies they are
  • Add a test to ensure proc macros are reported as build dependencies
  • Add a test fixture for a crate with a proc macro dependency
  • parse fully qualified package ID specs from SBOMs
  • select first discovered SBOM file
  • cargo sbom integration
  • Get rid of unmaintained wee_alloc in test code to make people's scanners misled by GHSA chill out
  • Don't fail plan workflow due to manually changed release.yml
  • Bump Ubuntu version to hopefully fix release.yml workflow
  • Add test for stripped binary
  • Bump version to 0.6.7
  • Populate changelog
  • README.md: add auditable2cdx, more consistency in text
  • Placate clippy
  • Do not emit -Wl if a bare linker is in use
  • Get rid of a compiler warning
  • Add bare linker detection function
  • drop boilerplate from test that's no longer relevant
  • Add support for recovering rustc codegen options
  • More lenient parsing of rustc arguments
  • More descriptive error message in case rustc is killed abruptly
  • change formatting to fit rustfmt
  • More descriptive error message in case cargo is killed
  • Update REPLACING_CARGO.md to fix #195
  • Clarify osv-scanner support in README
  • Include the command required to view metadata
  • Mention wasm-tools support
  • Switch from broken generic cache action to a Rust-specific one
  • Fill in various fields in auditable2cdx Cargo.toml
  • Include osv-scanner in the list, with a caveat
  • Add link to blint repo to README
  • Mention that blint supports our data
  • Consolidate target definitions
  • Account for WASM test dependencies changing, commit the Cargo.lock so they would stop doing that
  • Migrate to a maintained toolchain action
  • Fix author specification
  • Add link to repository to resolverver Cargo.toml
  • Bump resolverver to 0.1.0
  • Add resolverver crate to the tree

• Update to version 0.6.6~0:

  • Note the object upgrade in the changelog
  • Upgrade cyclonedx-bom from 0.5 to 0.8 in auditable-cyclonedx
  • Upgrade object crate from 0.30 to 0.36 to reduce dependency footprint
  • Update dependencies in the lock file
  • Populate changelog
  • apply clippy lint
  • add another --emit parsing test
  • shorter code with cargo fmt
  • Actually fix cargo-c compatibility
  • Attempt to fix cargo-capi incompatibility
  • Refactoring in preparation for fixes
  • Also read the --emit flag to rustc
  • Fill in changelogs
  • Bump…

This update for cargo-auditable fixes the following issues:

Update to version 0.7.2~0.

Security issues fixed:

• CVE-2026-25727: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257906).

Other updates and bugfixes:

• Update to version 0.7.2~0:

  • mention cargo-dist in README
  • commit Cargo.lock
  • bump which dev-dependency to 8.0.0
  • bump object to 0.37
  • Upgrade cargo_metadata to 0.23
  • Expand the set of dist platforms in config

• Update to version 0.7.1~0:

  • Out out of unhelpful clippy lint
  • Satisfy clippy
  • Do not assume --crate-name and --out-dir are present in the rustc command, but show warnings if they aren't
  • Run apt-get update before trying to install packages
  • run cargo dist init on dist 0.30
  • Drop allow-dirty from dist config, should no longer be needed
  • Reorder paragraphs in README
  • Note the maintenance transition for the go extraction library
  • Editing pass on the adopters: scanners
  • clarify Docker support
  • Cargo clippy fix
  • Add Wolfi OS and Chainguard to adopters
  • Update mentions around Anchore tooling
  • README and documentation updates for nightly
  • Bump dependency version in rust-audit-info
  • More work on docs
  • Nicer formatting on format revision documentation
  • Bump versions
  • regenerate JSON schema
  • cargo fmt
  • Document format field
  • Make it more clear that RawVersionInfo is private
  • Add format field to the serialized data
  • cargo clippy fix
  • Add special handling for proc macros to treat them as the build dependencies they are
  • Add a test to ensure proc macros are reported as build dependencies
  • Add a test fixture for a crate with a proc macro dependency
  • parse fully qualified package ID specs from SBOMs
  • select first discovered SBOM file
  • cargo sbom integration
  • Get rid of unmaintained wee_alloc in test code to make people's scanners misled by GHSA chill out
  • Don't fail plan workflow due to manually changed release.yml
  • Bump Ubuntu version to hopefully fix release.yml workflow
  • Add test for stripped binary
  • Bump version to 0.6.7
  • Populate changelog
  • README.md: add auditable2cdx, more consistency in text
  • Placate clippy
  • Do not emit -Wl if a bare linker is in use
  • Get rid of a compiler warning
  • Add bare linker detection function
  • drop boilerplate from test that's no longer relevant
  • Add support for recovering rustc codegen options
  • More lenient parsing of rustc arguments
  • More descriptive error message in case rustc is killed abruptly
  • change formatting to fit rustfmt
  • More descriptive error message in case cargo is killed
  • Update REPLACING_CARGO.md to fix #195
  • Clarify osv-scanner support in README
  • Include the command required to view metadata
  • Mention wasm-tools support
  • Switch from broken generic cache action to a Rust-specific one
  • Fill in various fields in auditable2cdx Cargo.toml
  • Include osv-scanner in the list, with a caveat
  • Add link to blint repo to README
  • Mention that blint supports our data
  • Consolidate target definitions
  • Account for WASM test dependencies changing, commit the Cargo.lock so they would stop doing that
  • Migrate to a maintained toolchain action
  • Fix author specification
  • Add link to repository to resolverver Cargo.toml
  • Bump resolverver to 0.1.0
  • Add resolverver crate to the tree

• Update to version 0.6.6~0:

  • Note the object upgrade in the changelog
  • Upgrade cyclonedx-bom from 0.5 to 0.8 in auditable-cyclonedx
  • Upgrade object crate from 0.30 to 0.36 to reduce dependency footprint
  • Update dependencies in the lock file
  • Populate changelog
  • apply clippy lint
  • add another --emit parsing test
  • shorter code with cargo fmt
  • Actually fix cargo-c compatibility
  • Attempt to fix cargo-capi incompatibility
  • Refactoring in preparation for fixes
  • Also read the --emit flag to rustc
  • Fill in changelogs
  • Bump…

This update for snpguest fixes the following issues:

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257927).

This update for snpguest fixes the following issues:

Update to version 0.10.0.

Security issues fixed:

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257927).
• CVE-2025-3416: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242601).
• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bcs#1243869).

Other updates and bugfixes:

• Update to version 0.10.0

  • fails to generate attestation reports on SEV-SNP guests with firmware API (bsc#1257877).
  • chore: updating tool version to 0.10.0
  • refactor(certs): remove redundant branch in file-write logic
  • Docs: Adding verify measure, host-data, report-data to docs
  • verify: verify measurent, host data, and report data attributes from the attestation report.
  • library: Updating sev library to 7.1.0
  • ci: replace deprecated gh actions
  • feat: multi-format integer parsing for key subcommand arguments
  • chore(main): remove unused import clap::arg
  • feat(fetch): add fetch crl subcommand
  • .github/lint: Bump toolchain version to 1.86
  • Bump rust version to 1.86
  • feat: bumping tool to version 0.9.2
  • fix(verify): silence mismatched_lifetime_syntaxes in SnpOid::oid
  • feat: support SEV-SNP ABI Spec 1.58 (bump sev to v6.3.0)
  • docs: restore and clarify Global Options section
  • doc: fix CL argument orders + address recent changes
  • fix(hyperv): downgrade VMPL check from error to warning
  • fix(report.rs): remove conflict check between --random flag and Hyper-V
  • fix(report.rs): Decouple runtime behavior from hyperv build feature
  • refactor: clarify --platform error message
  • docs: add Azure/Hyper-V build note for --platform
  • report: Writing Req Data as Binary (#101)
  • deps: bump virtee/sev to 6.2.1 (fix TCB-serialization bug) (#99)
  • Updating SEV library to 6.1.0 and updating version to 0.9.1
  • Update version (0.9.0)
  • HyperV: Fixing report command failure on Azure confidential VM
  • Removing intird and append requirement for kernel measurements (#93)
  • Updating to version 6 of library and fixing attestation (#89)
  • CI: Fixing create_release workflow (#91)
  • Minor update (0.8.3)
  • Adding build script
  • Update preattestation.rs
  • Fix certificate fetch bug for Turin
  • Minor update
  • Update bitfield to 0.15.0
  • Update to 0.8.1
  • Update asn1-rs and x509-parser
  • Update to 0.8.0
  • key: Fix guest_field_select typo
  • Adding Turin support and updating ASK cn

This update for wicked2nm,suse-migration-services,suse-migration-sle16-activation,SLES16-Migration,SLES16-SAP_Migration fixes the following issues:

Changes for SLES16-SAP_Migration:

• Bump version: 2.1.30

Changes for SLES16-Migration:

• Bump version: 2.1.30

Changes for suse-migration-sle16-activation:

• Move script package to the main migration provider
• Create lib file for common network-prereq tasks
• Refactor mount_system service

Changes for suse-migration-services:

• Bump to version: 2.1.30:
  • Update docinfo
  • Update doc/adoc/user_guide.adoc
  • Update documentation for 12-to-15 in pubclouds Fix information about default service pack target.
  • Apply make black
  • Added black for code formatting
  • refactor: add Zypper.install wrapper Add Zypper.install wrapper method for package installation
  • Fixed get_migration_target return behavior
  • fix: ensure NetworkManager is installed on the target system

Changes for wicked2nm:

• Update to version v1.4.1.

Security issues fixed:

• CVE-2026-25727: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257911).

Other updates and bugfixes:

• update bytes from 1.10.1 to 1.11.1
• update time to 0.3.47

This update for virtiofsd fixes the following issue:

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257912).

This update for virtiofsd fixes the following issue:

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257912).

This update for python-maturin fixes the following issue:

• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257918).

This update for himmelblau fixes the following issues:

Update to version 2.3.9+git0.a9fd29b; (jsc#PED-14511):

• CVE-2026-34397: Fix LPE due to name collision during NSS fake-primary group lookup (bsc#1261324).
• CVE-2026-31979: Fix race condition when accessiung /tmp/krb5cc_uid (bsc#1259548).
• CVE-2026-25727: deps(rust): Bump the all-cargo-updates group with 8 updates (bsc#1257904).
• CVE-2025-58160: deps(rust): Bump tracing-subscriber in the cargo group (bsc#1249013).
• CVE-2025-54882: Fix Kerberos credential cache permissions (bsc#1247735).
• CVE-2025-53013: Fix permitted authentication with invalid Hello PIN (bsc#1245437).
• CVE-2024-11738: Fix rustls network-reachable panic in Acceptor::accept (bsc#1233949).

Other bug fixes:

• Fix SELinux module packaging to use standard policy macros (bsc#1258236).