GUESTFS-RELEASE-NOTES-1.28(1)

📦
version 1.61.3 · 14 versions
, in centos-stream 10

💖 NAME 💖

guestfs-release-notes — libguestfs Release Notes. The header calls this manual page guestfs-rel...-notes-1.28(1) and files it under Virtualization Support, and bestie, it is literally serving release-notes realness. 💅

🌸 RELEASE NOTES FOR LIBGUESTFS 1.28 🌸

Okay so these release notes only cover the differences from the previous stable/dev branch split (1.26.0). For detailed changelogs, please see the git repository, or the ChangeLog file distributed in the tarball. Periodt. ✨

✨ New features ✨

🧰 Tools 🧰

First up, the tools. virt-v2v(1) and virt-p2v(1) are tools for converting from foreign hypervisors (such as VMware or Xen) or physical machines, to KVM. These tools were previously a separate project. The code for both tools has been integrated into the libguestfs tree. As part of the refactoring, virt-p2v has been rewritten (from Ruby, now C), and virt-v2v now uses several modern features of qemu which make it run many times faster than before. No cap, that's a glow-up. 🦋

  • virt-v2v(1) can import from:
    • VMware vCenter
    • VMware OVA files
    • local disk files
    • libvirt
    • RHEL 5 Xen
  • It can output to:
    • oVirt or Red Hat Enterprise Virtualization (RHEV-M)
    • OpenStack Glance
    • libvirt
    • qemu
    • local disk files
  • virt-log(1) is a new tool for listing log files from guests. It supports a variety of guests including Linux traditional, Linux using journal, and Windows event log. 👑
  • virt-builder(1) has a new --machine-readable option to make it simpler to consume virt-builder from other programs.
  • New virt-builder(1) and virt-customize(1) --chmod option.
  • virt-sysprep(1) will now remove: systemd journals, anaconda logs, lightdm logs, debian-installer files, apt logs, exim logs, ConsoleKit logs, firewalld logs, grubby logs, proftpd logs, libvirt/libxml logs, and several other log files. The virt-sysprep user-account operation is now able to remove or keep particular user accounts. (Pino Toscano).
  • New guestmount(1) --fd option, allowing you to run guestmount captive under another process.
  • virt-sparsify(1) has a new --tmp option allowing you to precisely control where temporary files are stored.
  • virt-sparsify(1) can now write to a block device.
  • virt-customize(1) and virt-sysprep(1) now support adding firstboot scripts to Windows guests.
  • virt-cat(1), virt-edit(1), virt-ls(1) now support the -m option, allowing you to override automatic inspection of guests and instead specify where to mount partitions (Pino Toscano).
  • The virt tools now have coloured output: green for OK, red for errors, blue for warnings. 🌈

🐍 Language bindings 🐍

  • You can build a Python distribution using make -C python sdist
  • Ruby bindings have switched from Test::Unit to MiniTest.
  • The Java bindings are now compatible with OpenJDK 8 (Pino Toscano).

🔍 Inspection 🔍

  • Oracle Linux is returned as oraclelinux (Nikos Skalkotos).
  • Linux guests which do not have /etc/fstab can now be handled (Pino Toscano).
  • Minix is returned as minix (Pino Toscano).

🏗️ Architectures 🏗️

  • Aarch64 (64 bit ARM) support has been added.
  • Inspection and the guestfs_file_architecture call can now recognize arm (32 bit) and aarch64 guests.

🔥 Security 🔥

CVE-2014-0191 Network usage and entity resolution in XML parsing

Okay so this one is important, bestie. Libguestfs previously used unsafe libxml2 APIs for parsing libvirt XML. These APIs defaulted to allowing network connections to be made when certain XML documents were presented. Using a malformed XML document it was also possible to exhaust all CPU, memory or file descriptors on the machine.

Security note: since the libvirt XML comes from a trusted source (the libvirt daemon) it is not thought that this could have been exploitable.

This was fixed in libguestfs ≥ 1.27.9 and the fix was backported to stable versions ≥ 1.26.2, ≥ 1.24.9, ≥ 1.22.10 and ≥ 1.20.13. (Thanks: Dan Berrange, Pino Toscano).

Shellshock (bash CVE-2014-6271)

This bash bug indirectly affects libguestfs. For more information see:

https://www.redhat.com/archives/libguestfs/2014-September/msg00252.html

🌈 API 🌈

✨ New APIs ✨

  • guestfs_clear_backend_setting, guestfs_get_backend_setting, guestfs_set_backend_setting — use these APIs to set individual backend settings.
  • guestfs_cpio_out — convert a directory within the disk image to cpio format.
  • guestfs_journal_get_realtime_usec — fetch precise journal times, see sd_journal_get_realtime_usec(3).
  • guestfs_lstatns, guestfs_lstatnslist, guestfs_statns — enhanced versions of guestfs_lstat, guestfs_lstatlist, guestfs_stat which return nanosecond timestamps.

🛠️ Build changes 🛠️

  • Libguestfs can now be built with qemu 2.x.
  • Add support for packaging the appliance on Mageia (Joseph Wang, Thierry Vignaud).
  • Augeas is now a required dependency.
  • Flex and bison are now required dependencies.

🧚 Internals 🧚

  • User-Mode Linux (UML) is no longer a supported backend (although still available). It will be supported again once someone steps in and fixes various regressions and brokenness in the UML (Linux) kernel.
  • You can now connect gdb to qemu by specifying LIBGUESTFS_BACKEND_SETTINGS=gdb
  • Serial BIOS (sgabios) is now used by the libvirt backend (on x86 only) so that we see early BIOS messages.
  • For the OCaml virt tools, exceptions are now handled and printed by a common function.
  • A GCC warning about large stack frames is now enabled by default. Several places that used large arrays and structures on the stack have been fixed.
  • There is now a test for booting the appliance repeatedly. Useful for finding kernel leaks. See: tests/qemu/qemu-boot.c
  • There is a test for testing the speed of various qemu features such as virtio-serial uploads and block device writes. See: tests/qemu/qemu-speed-test.c
  • GCC warnings are now enabled for OCaml-C bindings in the OCaml virt tools.
  • The code for editing files used by virt-edit(1), guestfish(1) edit command, virt-customize(1) --edit option and more is now shared between all these utilities (thanks Pino Toscano).
  • The FUSE tests were rewritten in C to ensure finer control over how system calls are tested.
  • The update-bugs.sh script has been fixed so it should no longer create an empty BUGS file if the Bugzilla server is unavailable.
  • The virt-resize(1) tests now use a stochastic method to ensure much deeper and broader testing.
  • When the network is enabled, the appliance now uses DHCP to acquire an IP address.
  • If libvirt is being used then the appliance will connect to virbr0 (can be overridden by setting LIBGUESTFS_BACKEND_SETTINGS=network_bridge=<some_bridge>). This enables full-featured network connections, with working ICMP, ping and so on.

💀 Bugs fixed 💀

The receipts section is here, and every URL and every description stays exactly as it was — no erasing, no "fixing" the typos. 🙈

…and the list literally keeps going, bestie 😭 the bug-squashing did NOT stop. Every single one of these got fixed in 1.28, and we're archiving them here for the culture:

fr fr that last one, <rescue> in a manpage, iconic chaotic energy 🫶

🌈 SEE ALSO

Go read these next, bestie, they're the whole extended universe:

✍️ AUTHOR

The one and only Richard W.M. Jones. king behavior 👑

Copyright (C) 2009-2025 Red Hat Inc.

📜 LICENSE

Okay so legal stuff, but make it slay — this program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. 😤 (yes the caps are load-bearing, don't come for me)

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

🐛 BUGS

Found something cursed? We wanna know 💀

To get a list of bugs against libguestfs, use this link: https://bugzilla.redhat.com/buglist.cgi?component=libguestfs&product=Virtualization+Tools

To report a new bug against libguestfs, use this link: https://bugzilla.redhat.com/enter_bug.cgi?component=libguestfs&product=Virtualization+Tools

When reporting a bug, please supply — like, actually supply these, don't leave us guessing 🥺:

  • The version of libguestfs.
  • Where you got libguestfs (eg. which Linux distro, compiled from source, etc)
  • Describe the bug accurately and give a way to reproduce it.
  • Run libguestfs-test-tool(1) and paste the complete, unedited output into the bug report.
"complete, unedited" is doing so much heavy lifting in that last bullet, please don't trim it, the whole output is the vibe check 🔥

And that's the page, bestie! 🎀 This was libguestfs-1.61.3, dated 2026-09-16, you're reading guestfs-rel...-notes-1.28(1) — go forth and virtualize responsibly 💖✨🦋

📦 where this page comes from