-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 13 Aug 2026 13:35:47 +0800
Source: docker.io
Architecture: source
Version: 26.1.5+dfsg1-9+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Debian Go Packaging Team <team+pkg-go@tracker.debian.org>
Changed-By: Aron Xu <aron@debian.org>
Changes:
 docker.io (26.1.5+dfsg1-9+deb13u1) trixie-security; urgency=high
 .
   * Non-maintainer upload by the Security Team.
   * Engine fixes are cherry-picked from the upstream 25.0 LTS branch, which
     carries official backports of all of them; BuildKit fixes are taken from
     BuildKit v0.28.1 as vendored by moby/moby: CVE-2026-41568, CVE-2026-42306,
     CVE-2026-34040, CVE-2026-33997, CVE-2026-33747, CVE-2026-33748.
   * Add engine-go1.24-os-root-mkdirall.patch. The upstream CVE-2026-41568 fix
     calls os.Root.MkdirAll, added in Go 1.25; trixie has Go 1.24, so the two
     calls are replaced by an equivalent helper built on os.Root.Mkdir.
Checksums-Sha1:
 af30c427e2862758ef01e0fc2366acca316e4aa8 7997 docker.io_26.1.5+dfsg1-9+deb13u1.dsc
 ad7a93f2e9a6df8a49b8372dbcb37e72c0fc5b7f 1406148 docker.io_26.1.5+dfsg1.orig-buildkit.tar.xz
 953e1c50e44d9982fc206d5aa5f351e35f3efc38 1176732 docker.io_26.1.5+dfsg1.orig-cli.tar.xz
 b03e2910c0542b6e93bc257d98685badb27a3989 4443500 docker.io_26.1.5+dfsg1.orig.tar.xz
 e049c3a14448e4722320f6926f28ac7e2a54d606 71544 docker.io_26.1.5+dfsg1-9+deb13u1.debian.tar.xz
 abf801f216a5b0844f799c702a3e7bae3574a98b 7116 docker.io_26.1.5+dfsg1-9+deb13u1_source.buildinfo
Checksums-Sha256:
 7cd1bd886b554122c10bb45f8f9426c84f1045a2736a0d6c2f469eb5b23767e5 7997 docker.io_26.1.5+dfsg1-9+deb13u1.dsc
 3a4a472c237b1caf456aac2cae810fea2b4fae9d0e9e71af5540645b510ff10c 1406148 docker.io_26.1.5+dfsg1.orig-buildkit.tar.xz
 477e396c50ea9e617cf6a9d70eef9509e587508faeaa5ab8e0304d600612c11b 1176732 docker.io_26.1.5+dfsg1.orig-cli.tar.xz
 e06baad2dbca2a79d3569ee358a4442cf9e550a355872484631860941bee73c9 4443500 docker.io_26.1.5+dfsg1.orig.tar.xz
 a579e61d4a60407d52347bb2af497cc16eeb964b9a7ebe3445ea854f5b9d8ee2 71544 docker.io_26.1.5+dfsg1-9+deb13u1.debian.tar.xz
 936b792a1e425a48b792805ca840a0062c5aacaf997434f22881dcaa23635683 7116 docker.io_26.1.5+dfsg1-9+deb13u1_source.buildinfo
Files:
 d0e37b6c9b9ed9d5ef21e25888fcda68 7997 admin optional docker.io_26.1.5+dfsg1-9+deb13u1.dsc
 fe49effec33d3202b7c9bc225ec6a297 1406148 admin optional docker.io_26.1.5+dfsg1.orig-buildkit.tar.xz
 f16c568c7f46cb446904265bd5a87d6a 1176732 admin optional docker.io_26.1.5+dfsg1.orig-cli.tar.xz
 bc3ab3a62a9469b6bfde91223a129fb6 4443500 admin optional docker.io_26.1.5+dfsg1.orig.tar.xz
 0e9620009c585732e224968e3c40315e 71544 admin optional docker.io_26.1.5+dfsg1-9+deb13u1.debian.tar.xz
 1e0b39ea4d8829c8b23a679c629ebf2e 7116 admin optional docker.io_26.1.5+dfsg1-9+deb13u1_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCgAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmp9cGgACgkQ+GQ1dHE8
m6503ggAoJV42bHbItPgrh0Bm8SATTDDBRWcxajiXQjwt0jnEO+mLNgwdQmbnrKA
tq4+rMMhkY7lnYp0WD3JbsOW74WRa8ZhxI4qF5CP600s3Q0r8wifeXSOlnfAS08d
5RSrUgNDch1fVafj3c96fDfp52updnTmVwDcexSNf38TdO7vAq99V3rbMk0enbea
yb8g/YMMMk5b6YWxA8Tv/orDIcixYFshbT5Y3UUQZr/6kyDZwySOAp28YPMUxZUp
zUeEG4XDag9jTKVOXxt/vQBGcSom7uu1ZFQLW/WIcnyBR2ZprD6YmTajyVnW1YSl
tSlKudfk9nOr52yKfnL4S5Df+e5Zpg==
=q0lD
-----END PGP SIGNATURE-----