[ubuntu/resolute-proposed] busybox 1:1.37.0-7ubuntu1 (Accepted)

John Chittum john.chittum at canonical.com
Mon Feb 2 18:49:14 UTC 2026 

busybox (1:1.37.0-7ubuntu1) resolute; urgency=medium

  * Merge with Debian unstable. (LP: #2130136) Remaining changes:
    - Add busybox-initramfs binary package and initramfs flavour:
      - Add dirname from coreutils to the initramfs
      - Enable the new klibc utility implementations, nuke and run-init
        in the initramfs package; and also enable reboot.  Doesn't yet make
        klibc-utils irrelevant - we still use ipconfig, fstype, and nfsmount
        - but it moves us much closer and should save a little bit of disk
        space.
      - Enable TLS in initramfs flavour of wget applet, requires openssl
      - debian/config/pkg/initramfs: Enable the date applet with the same
        options as the other variants for use in fixrtc and casper scripts.
      - Prefer busybox cmds over klibc cmds where there is duplication.
      - Move zz-busybox to busybox-initramfs to ensure we get links to all
        the tools we need, stop shipping it anywhere else.
      - d/tree/busybox/usr/share/initramfs-tools/hooks/zz-busybox:
        Copy certs and openssl config for the casper+busybox-initramfs case.
      - Add Ubuntu configuration for busybox binaries.
    - test-bin.patch: Move test and friends to /bin.
    - static-sh-alias.patch: Add static-sh alias name for ash, and install
      /bin/static-sh symlink to busybox in busybox-static.
    - d/config/pkg/{deb,static}: Enable chpasswd (needed by LXC).
  * New Changes
    - d/config/pkg/initramfs: archival-disallow-path-traversals-*.patch adds a new
      feature that was not configured in d/config/pkg/initramfs as busybox-initramfs
      is an Ubuntu only package. Adds in the default config to to the initramfs conf.
    - d/p/fix-start-stop-daemon-rust-coreutils.patch
       rust-coreutils disallows running an executable by a different
       name. This leads to "start-stop-daemon with both -x and -a"
       to fail as it attempts to run /bin/false under a different
       name, qwerty. Patch test to use the same executable as the
       test does not check argv[0] difference
    - busybox-static.links updated to be in usr/bin instead of bin.
      (LP: #2139160)

busybox (1:1.37.0-7) unstable; urgency=medium

  * patches/archival-disallow-path-traversals-CVE-2023-39810.patch
    (Closes: #1055307, CVE-2023-39810)
  * archival-disallow-path-traversals-CVE-2023-39810.patch:
    use the correct "echo" when constructing the archive
  * d/config/pkg/* CONFIG_FEATURE_PATH_TRAVERSAL_PROTECTION=y
  * enable chattr and lsattr applets (Closes: #1119539)
  * udeb: install all links in /usr/, do not touch /bin & /sbin

busybox (1:1.37.0-6) unstable; urgency=medium

  * udeb config: remove wget applet
    (wget-udeb is used for this for many years) (Closes: #1107392)

busybox (1:1.37.0-5) unstable; urgency=medium

  * d/control: switch from Static-Built-Using back to Built-Using
    (Closes: #1106796)

Date: Wed, 14 Jan 2026 10:50:37 -0500
Changed-By: John Chittum <john.chittum at canonical.com>
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Signed-By: Nick Rosbrook <nick.rosbrook at canonical.com>
https://launchpad.net/ubuntu/+source/busybox/1:1.37.0-7ubuntu1
-------------- next part --------------
Format: 1.8
Date: Wed, 14 Jan 2026 10:50:37 -0500
Source: busybox
Built-For-Profiles: noudeb
Architecture: source
Version: 1:1.37.0-7ubuntu1
Distribution: resolute
Urgency: medium
Maintainer: Ubuntu Developers <ubuntu-devel-discuss at lists.ubuntu.com>
Changed-By: John Chittum <john.chittum at canonical.com>
Closes: 1055307 1106796 1107392 1119539
Launchpad-Bugs-Fixed: 2130136 2139160
Changes:
 busybox (1:1.37.0-7ubuntu1) resolute; urgency=medium
 .
   * Merge with Debian unstable. (LP: #2130136) Remaining changes:
     - Add busybox-initramfs binary package and initramfs flavour:
       - Add dirname from coreutils to the initramfs
       - Enable the new klibc utility implementations, nuke and run-init
         in the initramfs package; and also enable reboot.  Doesn't yet make
         klibc-utils irrelevant - we still use ipconfig, fstype, and nfsmount
         - but it moves us much closer and should save a little bit of disk
         space.
       - Enable TLS in initramfs flavour of wget applet, requires openssl
       - debian/config/pkg/initramfs: Enable the date applet with the same
         options as the other variants for use in fixrtc and casper scripts.
       - Prefer busybox cmds over klibc cmds where there is duplication.
       - Move zz-busybox to busybox-initramfs to ensure we get links to all
         the tools we need, stop shipping it anywhere else.
       - d/tree/busybox/usr/share/initramfs-tools/hooks/zz-busybox:
         Copy certs and openssl config for the casper+busybox-initramfs case.
       - Add Ubuntu configuration for busybox binaries.
     - test-bin.patch: Move test and friends to /bin.
     - static-sh-alias.patch: Add static-sh alias name for ash, and install
       /bin/static-sh symlink to busybox in busybox-static.
     - d/config/pkg/{deb,static}: Enable chpasswd (needed by LXC).
   * New Changes
     - d/config/pkg/initramfs: archival-disallow-path-traversals-*.patch adds a new
       feature that was not configured in d/config/pkg/initramfs as busybox-initramfs
       is an Ubuntu only package. Adds in the default config to to the initramfs conf.
     - d/p/fix-start-stop-daemon-rust-coreutils.patch
        rust-coreutils disallows running an executable by a different
        name. This leads to "start-stop-daemon with both -x and -a"
        to fail as it attempts to run /bin/false under a different
        name, qwerty. Patch test to use the same executable as the
        test does not check argv[0] difference
     - busybox-static.links updated to be in usr/bin instead of bin.
       (LP: #2139160)
 .
 busybox (1:1.37.0-7) unstable; urgency=medium
 .
   * patches/archival-disallow-path-traversals-CVE-2023-39810.patch
     (Closes: #1055307, CVE-2023-39810)
   * archival-disallow-path-traversals-CVE-2023-39810.patch:
     use the correct "echo" when constructing the archive
   * d/config/pkg/* CONFIG_FEATURE_PATH_TRAVERSAL_PROTECTION=y
   * enable chattr and lsattr applets (Closes: #1119539)
   * udeb: install all links in /usr/, do not touch /bin & /sbin
 .
 busybox (1:1.37.0-6) unstable; urgency=medium
 .
   * udeb config: remove wget applet
     (wget-udeb is used for this for many years) (Closes: #1107392)
 .
 busybox (1:1.37.0-5) unstable; urgency=medium
 .
   * d/control: switch from Static-Built-Using back to Built-Using
     (Closes: #1106796)
Checksums-Sha1:
 17b21744b5fc368af3155faac9513f29c69da3c3 2703 busybox_1.37.0-7ubuntu1.dsc
 297442b675064144fe2db8ce1d70f49d4b2d198e 80004 busybox_1.37.0-7ubuntu1.debian.tar.xz
 344f8c9e7f27d9023702b0faaa62ef29b00f87f3 6898 busybox_1.37.0-7ubuntu1_source.buildinfo
Checksums-Sha256:
 125ebeae728a614d5c93687307d342037baade55599c10bc8c2e927e70d1ffab 2703 busybox_1.37.0-7ubuntu1.dsc
 5b97c2c2e4f259cccb57f5613d7261e8a0e2b94c4c3e55e2a907bb4cc1186915 80004 busybox_1.37.0-7ubuntu1.debian.tar.xz
 42f6d7ee41c5242247f1816fcca1f61de812d52acb20006560475fb13f56c9af 6898 busybox_1.37.0-7ubuntu1_source.buildinfo
Files:
 6da8ee96de853f3aa9595f192562bfd3 2703 utils optional busybox_1.37.0-7ubuntu1.dsc
 e818628aa2b1f2732fc85b47724adfd8 80004 utils optional busybox_1.37.0-7ubuntu1.debian.tar.xz
 028f965340ebbd7558abe2423c78f167 6898 utils optional busybox_1.37.0-7ubuntu1_source.buildinfo
Original-Maintainer: Debian Install System Team <debian-boot at lists.debian.org>
Vcs-Git: https://git.launchpad.net/~jchittum/ubuntu/+source/busybox
Vcs-Git-Commit: b3af4fc8992e8b6ea15e40330f150258137c1f31
Vcs-Git-Ref: refs/heads/resolute-merge-lp2130136

More information about the Resolute-changes mailing list