From 2affc7e1438d92bbe7cbe67a3ae28a41716ed4da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20M=C3=BCller?= <323649642+oc-tmueller@users.noreply.github.com> Date: Wed, 9 Sep 2026 15:16:43 +0200 Subject: [PATCH] chore: prepare 11.0.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump version.php to 11.0.1 and add the changelog fragment for the release tarball repackaging. 11.0.0 shipped 13 bundled apps as the working tree they were built in - 101.94 MB of the 441.8 MB uncompressed complete tarball, across 16 shipped git repositories. files_antivirus carried its EICAR acceptance data, so anti-virus scans of the tarball failed; the files were covered by each app's signature.json, so an administrator could not remove them without breaking `occ integrity:check-app`; and the shipped .git/ leaked the release engineer's name and e-mail. The standard tarball was affected too, through notifications. The bundle specs repin all 14 affected apps onto releases built by CI (owncloud/server-release#53), and ocrelease now fails the build if an assembled tree contains a build working tree (owncloud/server-release#54). 11.0.1 also carries the eight fixes already queued in changelog/unreleased, so this is a genuine patch release rather than a repackaging alone. `ocrelease changelog --version 11.0.1 --date ` is deliberately not run here: it materialises the fragments into a changelog/11.0.1_/ folder whose name embeds the release date, so it belongs immediately before tagging rather than in this PR. Refs: owncloud/core#41824 Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --- changelog/unreleased/41824 | 23 +++++++++++++++++++++++ version.php | 4 ++-- 2 files changed, 25 insertions(+), 2 deletions(-) create mode 100644 changelog/unreleased/41824 diff --git a/changelog/unreleased/41824 b/changelog/unreleased/41824 new file mode 100644 index 000000000000..5f44ec381443 --- /dev/null +++ b/changelog/unreleased/41824 @@ -0,0 +1,23 @@ +Bugfix: Ship only the app payload in the release tarballs + +The release bundles contained 13 bundled apps as the working tree they had been +built in, rather than as the app's release artifact. Each of those app +directories carried `.git/` (a shallow clone including its pack file), +`.github/`, `tests/`, `vendor-bin/` and `build/artifacts/`, the last holding a +second copy of the app's own tarball. That was 101.94 MB of the 441.8 MB +uncompressed complete tarball, in 16 shipped git repositories. + +Three things made it more than dead weight. `files_antivirus` shipped its +anti-virus acceptance data, so a ClamAV scan of the tarball, or of any image +built from it, reported `Eicar-Test-Signature FOUND` and could be rejected by an +anti-virus gate. The development files were covered by the app's +`appinfo/signature.json`, so an administrator could not delete them without +breaking `occ integrity:check-app`. And the shipped `.git/` carried the release +engineer's clone metadata, including their name and e-mail address. + +The affected app releases have been repackaged, and the release tooling now +refuses to build a bundle that contains a build working tree, so this cannot +recur unnoticed. The standard tarball was affected as well, through +`notifications`. + +https://github.com/owncloud/core/issues/41824 diff --git a/version.php b/version.php index 71d65700a4d7..969457ada284 100644 --- a/version.php +++ b/version.php @@ -25,10 +25,10 @@ // We only can count up. The 4. digit is only for the internal patch-level to trigger DB upgrades // between betas, final and RCs. This is _not_ the public version number. Reset minor/patch-level // when updating major/minor version number. -$OC_Version = [11, 0, 0, 0]; +$OC_Version = [11, 0, 1, 0]; // The human-readable string -$OC_VersionString = '11.0.0'; +$OC_VersionString = '11.0.1'; $OC_VersionCanBeUpgradedFrom = [[8, 2, 11],[9, 0, 9],[9, 1]];