Colin WaltersandDemi Marie Obenour
83e6357186
The ed25519 signature verification code does not check that the signature is a minimum/correct length. As a result, if the signature is too short, libsodium will end up reading a few bytes out of bounds. Reported-by: Demi Marie Obenour <demi@invisiblethingslab.com> Co-authored-by: Demi Marie Obenour <demi@invisiblethingslab.com> Closes: https://github.com/ostreedev/ostree/security/advisories/GHSA-gqf4-p3gv-g8vw