New
umoci 0.5.1 -- "🖤 Yuki (2021-2025)"
This is a fairly minor update to umoci, containing a few bugfixes for some potential issues, as well as finally removing the requirement for oci-image-tool validation. We still do not support the latest image-spec release, but decoupling for oci-image-tool is a very important first step.
Fixed
- For images with an empty
index.json, umoci will no longer incorrectly set themanifestsentry tonull(which was technically a violation of the specification, though such images cannot be pushed or interacted with outside of umoci). - Based on some recent developments in the image-spec, umoci will now produce an error if it encounters descriptors with a negative size (this was a potential DoS vector previously) as well as a theoretical attack where an attacker would endlessly write to a blob (this would not be generally exploitable for images with descriptors).