From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Tue, 17 Mar 2026 15:21:00 +0100 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1w2VI3-001pgp-3A for lore@lore.pengutronix.de; Tue, 17 Mar 2026 15:20:59 +0100 Received: from bombadil.infradead.org ([2607:7c80:54:3::133]) by metis.whiteo.stw.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1w2VI3-00050a-Em for lore@pengutronix.de; Tue, 17 Mar 2026 15:20:59 +0100 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Type:MIME-Version: Message-ID:Subject:To:From:Date:Reply-To:Cc:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=2EiMydcDmDaAJImUiN3msobnIEP/d52RpGBinMOsbao=; b=cYGkNwOx6SV1QsADI6B5UrYRSz HgZilTBIAYVh/5DyMyzajY3zJIKhZEeIM+LVNDDO7wO2Wq4Kccvy4mdx1F9rgiHB8CMLot1+Ns8L6 OMSQiM3GJeNj2/BjIBqefw1k74z1Iat6h3nDpNz6LwxBqcwrf4AnPLR9MxM2wZlSfRV792FSYy9CZ crfeiCmdmJujWEGC3FwkJK/Gp0uN0mROZyyMIQlHRg7RWdHKAQToES7nz53y6UqNzEnu0EBz08neS cySxqwlYAzveS+sWlcD1CC8fAsDbWFSWeE3AN5spR2uuL0EgMWAjqB0X/YQueybqqcH7EIv+VKOQ9 AztIy5VQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux)) id 1w2VHV-00000006YsO-2WrM; Tue, 17 Mar 2026 14:20:25 +0000 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux)) id 1w2VHT-00000006YrT-2upY for barebox@lists.infradead.org; Tue, 17 Mar 2026 14:20:25 +0000 Received: from drehscheibe.grey.stw.pengutronix.de ([2a0a:edc0:0:c01:1d::a2]) by metis.whiteo.stw.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1w2VHS-0004sm-1V; Tue, 17 Mar 2026 15:20:22 +0100 Received: from pty.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::c5]) by drehscheibe.grey.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1w2VHR-000kx9-2l; Tue, 17 Mar 2026 15:20:21 +0100 Received: from sha by pty.whiteo.stw.pengutronix.de with local (Exim 4.98.2) (envelope-from ) id 1w2VHR-00000007Jqr-3BwN; Tue, 17 Mar 2026 15:20:21 +0100 Date: Tue, 17 Mar 2026 15:20:21 +0100 From: Sascha Hauer To: Barebox List Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Sent-From: Pengutronix Hildesheim X-URL: http://www.pengutronix.de/ X-Accept-Language: de,en X-Accept-Content-Type: text/plain X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260317_072023_735701_0487F424 X-CRM114-Status: GOOD ( 10.65 ) X-BeenThere: barebox@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "barebox" X-SA-Exim-Connect-IP: 2607:7c80:54:3::133 X-SA-Exim-Mail-From: barebox-bounces+lore=pengutronix.de@lists.infradead.org X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-3.7 required=4.0 tests=AWL,BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_NONE autolearn=unavailable autolearn_force=no version=3.4.2 Subject: Stable releases v2025.09.3 and v2026.03.1 X-SA-Exim-Version: 4.2.1 (built Wed, 08 May 2019 21:11:16 +0000) X-SA-Exim-Scanned: Yes (on metis.whiteo.stw.pengutronix.de) Hi All, I have just made two stable releases, both driven by the recently fixed FIT image vulnerability. The original fix had an issue where we checked the hashed-nodes property against the nodes-to-hash we extract from the FIT image structure. It turned out the check was too strict, both should contain the same nodes, but the order doesn't matter. v2026.03.1 has this check relaxed and now boots certain valid FIT images that v2026.03.0 rejected. v2025.09.3 has both fixes included. Sascha -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |