Skip to content
This repository was archived by the owner on Sep 20, 2026. It is now read-only.

Version 1.24

Latest
Latest

Choose a tag to compare

View all tags
@fdegros fdegros released this 04 Aug 05:30
· 2 commits to main since this release
v1.24
3e1298e
This commit was signed with the committer’s verified signature.
fdegros François Degros
GPG key ID: 837AAB0FAC9A1E11
Verified
Learn about vigilant mode.

fuse-archive 1.24 is the new stable release of the read-only FUSE filesystem for mounting various archive and compressed file formats. Built on C++23 standards, this release introduces key security enhancements, critical correctness fixes for hardlink resolution (especially in multi-archive mode), and improved test isolation.

🔒 Security Enhancements

Safe PATH Filtering

  • Filtered Environment Execution: Added standard path filtering to restrict the PATH environment variable during execution. The filesystem now keeps only safe, standard system directories (e.g., /usr/bin, /bin, /usr/local/bin). This prevents untrusted or relative directories in a user's local PATH from executing arbitrary binaries during bidding, decompression, or filter setup.

🛠️ Correctness & Bug Fixes

Hardlink Resolution

  • Index Renamed Nodes by Original Path: Resolved a critical bug where renamed filesystem nodes broke hardlink resolution. Renamed nodes are now indexed by their original paths, ensuring hardlinks resolve seamlessly post-rename.
  • Multi-Archive Hardlink Support: Fixed hardlink resolution specifically when mounting in multi-archive mode, preventing linking conflicts between distinct archive boundaries.

Library Workarounds

  • Optimized libarchive 2514 Workaround: Adjusted the WORK_AROUND_ISSUE_2514 version threshold. The workaround for the libarchive compress-filter SIGSEGV crash is now skipped for libarchive 3.8.8 and newer, allowing modern versions (including the newly-deployed 3.8.9) to leverage the clean, native, and fast upstream path.

🧪 Testing & Dev-Loop Quality

GPG Test Isolation

  • Keychain Isolation: Completely isolated GPG integration tests from the host system's keyring. Improved reliability and eliminated test failures on systems with custom or pre-existing local GPG user configs.
  • GPG Environment Robustness: Standardized test behaviors across varying Linux setups and environments.

🧹 Code Quality & Refactorings

  • Filesystem Tree Encapsulation: Replaced the legacy struct Tree declaration with a fully-encapsulated class Tree in the Reader header, aligning with modern C++ class architecture and access conventions.
  • Tree Comparisons: Added a missing overload of Tree::HasSamePath to simplify and safely check path equality within the filesystem tree representation.

Full Changelog: v1.22...v1.24

Assets 2
Loading