GUESTFS-RELEASE-NOTES-1.26(1)

📦
version 1.61.3 · 14 versions
, in centos-stream 10

💖 NAME 💖

Ok so first the formalities bestie: this is guestfs-release-notes(1), and it lives in the Virtualization Support corner of the manual. Its whole job is libguestfs Release Notes. That's it. That's the name. 🎀

🌸 RELEASE NOTES FOR LIBGUESTFS 1.26 🌸

So real talk — these notes only cover the differences from the previous stable/dev branch split, which was 1.24.0. That's the scope, periodt. If you want the detailed changelogs, go look at the git repository, or the ChangeLog file that gets distributed in the tarball. 💅

✨ New features ✨

🛠️ Tools

  • virt-customize(1) — brand new tool alert!! 🎉 It's for customizing virtual machine disk images. You can install packages, edit configuration files, run scripts, set passwords, and so on. And here's the slay part: virt-builder(1) and virt-sysprep(1) both use virt-customize, and the command line options across all these tools are now identical. Consistency queen. 👑
  • virt-diff(1) — also new! It shows the differences between the filesystems of two virtual machines. It's mainly useful when you're showing what files have been changed between snapshots. It's giving detective energy. 🔍
  • virt-builder(1) — got greatly enhanced, like glow-up of the century. There are many more ways to customize the virtual machine now. It can pull templates from multiple repositories. A parallelized internal xzcat implementation speeds up template decompression. Virt-builder uses an optimizing planner to choose the fastest way to build the VM. It's now easier to use virt-builder from other programs. Internationalization support has been added to metadata. More efficient SELinux relabelling of files. Can build guests for multiple architectures. And the error messages have been improved. (Pino Toscano) 🔥
  • virt-sparsify(1) — has a new --in-place option. This sparsifies an image in place (so like, without copying it) and it's also much faster. (Lots of help provided by Paolo Bonzini) ⚡
  • virt-sysprep(1) — can delete and scrub files under user control. You can lock user accounts or set random passwords on accounts. It can remove more log files. It can unsubscribe a guest from Red Hat Subscription Manager. And there's a new flexible way to enable and disable operations. (Wanlong Gao, Pino Toscano) 🧹
  • virt-win-reg(1) — allows you to use URIs to specify remote disk images. Fancy.
  • virt-format(1) — can now pass the extra space that it recovers back to the host. Giving back, we love to see it. 💖
  • guestfish(1) — has additional environment variables to give fine control over the "><fs>" prompt. Guestfish reads its (rarely used) configuration file in a different order now, so that local settings override global settings. (Pino Toscano)
  • virt-make-fs(1) — was rewritten in C, but it's unchanged in terms of functionality and command line usage. Same vibes, new internals. 🦋

🗣️ Language bindings

  • The OCaml bindings have a new Guestfs.Errno module, used to check the error number returned by Guestfs.last_errno.
  • PHP tests now work. (Pino Toscano) We stan a functioning test suite. 💅

🔎 Inspection

  • Inspection can recognize Debian live images. Iconic.

🖥️ Architectures

  • ARMv7 (32 bit) now supports KVM acceleration. Zoom zoom. 🏎️
  • Aarch64 (ARM 64 bit) is supported, but the appliance part does not work yet. Almost there bestie, almost.
  • PPC64 support has been fixed and enhanced. 🫶

🛡️ Security 🛡️

💀 Denial of service when inspecting disk images with corrupt btrfs volumes

So this is the serious one, pay attention. It was possible to crash libguestfs (and programs that use libguestfs as a library) by presenting a disk image containing a corrupt btrfs volume. Yeah. 😭

This was caused by a NULL pointer dereference causing a denial of service, and is not thought to be exploitable any further.

See commit d70ceb4cbea165c960710576efac5a5716055486 for the fix. This fix is included in libguestfs stable branches ≥ 1.26.0, ≥ 1.24.6 and ≥ 1.22.8, and also in RHEL ≥ 7.0. Earlier versions of libguestfs are not vulnerable.

Ok so if you're on an old version, you're fine — but if you're on one of those ranges, go get the fix. Not me being dramatic, just being accurate. 💅

🎲 Better generation of random root passwords and random seeds

When generating random root passwords and random seeds, two bugs were fixed which are possibly security related. Firstly we no longer read excessive bytes from /dev/urandom (most of which were just thrown away). Secondly we changed the code to avoid modulo bias. These issues were not thought to be exploitable. (Both changes suggested by Edwin Török) 🙈

🧬 API 🧬

GUID parameters are now validated when they are passed to API calls, whereas previously you could have passed any string. (Pino Toscano) No more nonsense strings slipping through. ✨

🌟 New APIs

  • guestfs_add_drive_opts: new discard parameter — this new discard parameter allows fine-grained control over discard/trim support for a particular disk. This allows the host file to become more sparse (or thin-provisioned) when you delete files or issue the guestfs_fstrim API call.
  • guestfs_add_domain: new parameters cachemode, discard — these parameters are passed through when adding the domain's disks.
  • guestfs_blkdiscard — discard all blocks on a guestfs device. Combined with the discard parameter above, this makes the host file sparse.
  • guestfs_blkdiscardzeroes — test if discarded blocks read back as zeroes.
  • guestfs_compare_*, guestfs_copy_* — for each struct returned through the API, libguestfs now generates guestfs_compare_* and guestfs_copy_* functions to allow you to compare and copy structs. So convenient honestly.
  • guestfs_copy_attributes — copy attributes (like permissions, xattrs, ownership) from one file to another. (Pino Toscano)
  • guestfs_disk_create — a flexible API for creating empty disk images from scratch. This avoids the need to call out to external programs like qemu-img(1). Doing it ourselves, love that for us. 🎀
  • guestfs_get_backend_settings, guestfs_set_backend_settings — per-backend settings (can also be set via the environment variable LIBGUESTFS_BACKEND_SETTINGS). The main use for this is forcing TCG mode in the qemu-based backends, for example:
export LIBGUESTFS_BACKEND=direct
export LIBGUESTFS_BACKEND_SETTINGS=force_tcg
  • guestfs_part_get_name — get the label or name of a partition (for GPT disk images). 🏷️

📦 Build changes 📦

The following extra packages are required to build libguestfs 1.26:

  • supermin ≥ 5 — Supermin version 5 is required to build this version of libguestfs.
  • flex, bison — Virt-builder now uses a real parser to parse its metadata file, so these tools are required.
  • xz — this is now a required build dependency, where previously it was (in theory) optional. "In theory" doing a lot of heavy lifting in that sentence tbh. 💀

🔧 Internals 🔧

  • PO message extraction rewritten to be more robust. (Pino Toscano)
  • podwrapper gives an error if the --insert or --verbatim argument pattern is not found.
  • Libguestfs now passes the qemu -enable-fips option to enable FIPS, if qemu supports it.
  • ./configure --without-qemu can be used if you don't want to specify a default hypervisor.
  • Copy-on-write [COW] overlays, used for example for read-only drives, are now created through an internal backend API (.create_cow_overlay).
  • Libvirt backend uses some funky C macros to generate XML. These are simpler and safer. Funky but responsible. 💅
  • The ChangeLog file format has changed. It is now just the same as git log, instead of using a custom format.
  • Appliance start-up has changed:
    • The libguestfs appliance now initializes LVM the same way as it is done on physical machines.
    • The libguestfs appliance does not write an empty string to /proc/sys/kernel/hotplug when starting up.
Note that you must configure your kernel to have CONFIG_UEVENT_HELPER_PATH="" otherwise you will get strange LVM errors (this applies as much to any Linux machine, not just libguestfs). (Peter Rajnoha) ⚠️
  • Libguestfs can now be built on arches that have ocamlc(1) but not ocamlopt(1). (Hilko Bengen, Olaf Hering)
  • You cannot use ./configure --disable-daemon --enable-appliance. It made no sense anyway. Now it is expressly forbidden by the configure script. 🚫
  • The packagelist file uses m4 for macro expansion instead of cpp.

🐛 Bugs fixed 🐛

🌈 SEE ALSO ✨

okay so if you're done here and you still want more libguestfs content (and honestly? same), go bother these fine pages, they all ate:

like, the FAQ alone is gonna save you so many tears. trust. 💖

🎀 AUTHOR 🌸

The one, the only, the main character who wrote all of this: Richard W.M. Jones. yeah. iconic behavior. 👑

Copyright (C) 2009-2025 Red Hat Inc. — all the legal vibes, protected and slaying since 2009. no cap.

📜 LICENSE ✨

okay bestie this next part is the boring-but-important bit, so here's the whole thing verbatim, no edits, no skipping, because the lawyers will notice:

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

lowkey read that twice, it's literally the whole contract of trust between you and this software 🫶

🐛 BUGS 💀

Found something cursed? It happens, no biggie, let's get it fixed together instead of suffering in silence 😭

To get a list of bugs against libguestfs, use this link:

https://bugzilla.redhat.com/buglist.cgi?component=libguestfs&product=Virtualization+Tools

To report a new bug against libguestfs, use this link:

https://bugzilla.redhat.com/enter_bug.cgi?component=libguestfs&product=Virtualization+Tools

🌸 When reporting a bug, please supply: 🌸

  1. The version of libguestfs.
  2. Where you got libguestfs (eg. which Linux distro, compiled from source, etc)
  3. Describe the bug accurately and give a way to reproduce it.
  4. Run libguestfs-test-tool(1) and paste the complete, unedited output into the bug report.
ngl, "complete, unedited output" is doing a LOT of work in that last one — do not trim it, do not paraphrase it, do not "clean it up a little". paste it raw, bestie. that's the whole assignment. 🙈

and that's a wrap on the guestfs-release-notes-1.26 page 💜 this was rendered from libguestfs-1.61.3, dated 2026-09-16 — go forth, read your release notes, report your bugs nicely, and stay hydrated 🍓🧚✨

📦 where this page comes from