xz: Update to version 5.6.3

- Update from version 5.4.5 to 5.6.3
- Update of rootfile
- This update is now done only by the xz originator Lasse Collin (Larhzu). A new github
   repo was created by Lasse for xz and this does not contain the malicious versions -
   5.6.0 & 5.6.1  https://github.com/tukaani-project/xz/releases
- Version 5.6.3 is being used by Arch Linux and Ubuntu plucky
- Changelog
    5.6.3
	    IMPORTANT: This includes a Windows-specific security fix to
	    the command line tools. liblzma isn't affected by this issue.
	    * liblzma:
	        - Fix x86-64 inline assembly compatibility with GNU Binutils
	          older than 2.27.
	        - Fix the build with GCC 4.2 on OpenBSD/sparc64.
	    * xzdec: Display an error instead of failing silently if the
	      unsupported option -M is specified.
	    * lzmainfo: Fix integer overflows when rounding the dictionary and
	      uncompressed sizes to the nearest mebibyte.
	    * Windows (except Cygwin and MSYS2): Add an application manifest to
	      xz, xzdec, lzmadec, and lzmainfo executables:
	        - Declare them compatible with Vista/7/8/8.1/10/11. This way
	          the programs won't needlessly use Operating System Context
	          of Vista when running on later Windows versions. This setting
	          doesn't mean that the executables cannot run on even older
	          versions if otherwise built that way.
	        - Declare them as UAC-compliant. MSVC added this by default
	          already but it wasn't done with MinGW-w64, at least not
	          with all toolchain variants.
	        - Declare them long path aware. This makes long path names
	          work on Windows 10 and 11 if the feature has been enabled
	          in the Windows registry.
	        - Use the UTF-8 code page on Windows 10 version 1903 and later.
	            * Now command line tools can access files whose names
	              contain characters that don't exist in the current
	              legacy code page.
	            * The options --files and --files0 now expect file lists
	              to be in UTF-8 instead of the legacy code page.
	            * This fixes a security issue: If a command line contains
	              Unicode characters (for example, filenames) that don't
	              exist in the current legacy code page, the characters are
	              converted to similar-looking characters with best-fit
	              mapping. Some best-fit mappings result in ASCII
	              characters that change the meaning of the command line,
	              which can be exploited with malicious filenames to do
	              argument injection or directory traversal attacks.
	              UTF-8 avoids best-fit mappings and thus fixes the issue.
	              Forcing the process code page to UTF-8 is possible only
	              on Windows 10 version 1903 and later. The command line
	              tools remain vulnerable if used on an old older
	              version of Windows.
	              This issue was discovered by Orange Tsai and splitline
	              from DEVCORE Research Team.
	              A related smaller issue remains: Windows filenames may
	              contain unpaired surrogates (invalid UTF-16). These are
	              converted to the replacement character U+FFFD in the
	              UTF-8 code page. Thus, filenames with different unpaired
	              surrogates appear identical and aren't distinguishable
	              from filenames that contain the actual replacement
	              character U+FFFD.
	            * When building with MinGW-w64, it is recommended to use
	              UCRT version instead of the old MSVCRT. For example,
	              non-ASCII characters from filenames won't print
	              correctly in messages to console with MSVCRT with
	              the UTF-8 code page (a cosmetic issue). liblzma-only
	              builds are still fine with MSVCRT.
	        - Cygwin and MSYS2 process command line options differently and
	          the above issues don't exist. There is no need to replace the
	          default application manifest on Cygwin and MSYS2.
	    * Autotools-based build:
	        - Fix feature checks with link-time optimization (-flto).
	        - Solaris: Fix a compatibility issue in version.sh. It matters
	          if one wants to regenerate configure by running autoconf.
	    * CMake:
	        - Use paths relative to ${prefix} in liblzma.pc when possible.
	          This is done only with CMake >= 3.20.
	        - MSVC: Install liblzma.pc as it can be useful with MSVC too.
	        - Windows: Fix liblzma filename prefix, for example:
	            * Cygwin: The DLL was incorrectly named liblzma-5.dll.
	              Now it is cyglzma-5.dll.
	            * MSVC: Rename import library from liblzma.lib to lzma.lib
	              while keeping liblzma.dll name as is. This helps with
	              "pkgconf --msvc-syntax --libs liblzma" because it mungles
	              "-llzma" in liblzma.pc to "lzma.lib".
	            * MinGW-w64: No changes.
	        - Windows: Use the correct resource file for lzmadec.exe.
	          Previously the resource file for xzdec.exe was used for both.
	          Autotools-based build isn't affected.
	        - Prefer a C11 compiler over a C99 compiler but accept both.
	        - Link Threads::Threads against liblzma using PRIVATE so that
	          -pthread and such flags won't unnecessarily get included in
	          the usage requirements of shared liblzma. That is,
	          target_link_libraries(foo PRIVATE liblzma::liblzma) no
	          longer adds -pthread if using POSIX threads and linking
	          against shared liblzma. The threading flags are still added
	          if linking against static liblzma.
	    * Updated translations: Catalan, Chinese (simplified), and
	      Brazilian Portuguese.
    5.6.2
	    * Remove the backdoor (CVE-2024-3094).
	    * Not changed: Memory sanitizer (MSAN) has a false positive
	      in the CRC CLMUL code which also makes OSS Fuzz unhappy.
	      Valgrind is smarter and doesn't complain.
	      A revision to the CLMUL code is coming anyway and this issue
	      will be cleaned up as part of it. It won't be backported to
	      5.6.x or 5.4.x because the old code isn't wrong. There is
	      no reason to risk introducing regressions in old branches
	      just to silence a false positive.
	    * liblzma:
	        - lzma_index_decoder() and lzma_index_buffer_decode(): Fix
	          a missing output pointer initialization (*i = NULL) if the
	          functions are called with invalid arguments. The API docs
	          say that such an initialization is always done. In practice
	          this matters very little because the problem can only occur
	          if the calling application has a bug and these functions
	          return LZMA_PROG_ERROR.
	        - lzma_str_to_filters(): Fix a missing output pointer
	          initialization (*error_pos = 0). This is very similar
	          to the fix above.
	        - Fix C standard conformance with function pointer types.
	        - Remove GNU indirect function (IFUNC) support. This is *NOT*
	          done for security reasons even though the backdoor relied on
	          this code. The performance benefits of IFUNC are too tiny in
	          this project to make the extra complexity worth it.
	        - FreeBSD on ARM64: Add error checking to CRC32 instruction
	          support detection.
	        - Fix building with NVIDIA HPC SDK.
	    * xz:
	        - Fix a C standard conformance issue in --block-list parsing
	          (arithmetic on a null pointer).
	        - Fix a warning from GNU groff when processing the man page:
	          "warning: cannot select font 'CW'"
	    * xzdec: Add support for Linux Landlock ABI version 4. xz already
	      had the v3-to-v4 change but it had been forgotten from xzdec.
	    * Autotools-based build system (configure):
	        - Symbol versioning variant can now be overridden with
	          --enable-symbol-versions. Documentation in INSTALL was
	          updated to match.
	        - Add new configure option --enable-doxygen to enable
	          generation and installation of the liblzma API documentation
	          using Doxygen. Documentation in INSTALL and PACKAGERS was
	          updated to match.
	    CMake:
	        - Fix detection of Linux Landlock support. The detection code
	          in CMakeLists.txt had been sabotaged.
	        - Disable symbol versioning on non-glibc Linux to match what
	          the Autotools build does. For example, symbol versioning
	          isn't enabled with musl.
	        - Symbol versioning variant can now be overridden by setting
	          SYMBOL_VERSIONING to "OFF", "generic", or "linux".
	        - Add support for all tests in typical build configurations.
	          Now the only difference to the tests coverage to Autotools
	          is that CMake-based build will skip more tests if features
	          are disabled. Such builds are only for special cases like
	          embedded systems.
	        - Separate the CMake code for the tests into tests/tests.cmake.
	          It is used conditionally, thus it is possible to
	              rm -rf tests
	          and the CMake-based build will still work normally except
	          that no tests are then available.
	        - Add a option ENABLE_DOXYGEN to enable generation and
	          installation of the liblzma API documentation using Doxygen.
	    * Documentation:
	        - Omit the Doxygen-generated liblzma API documentation from the
	          package. Instead, the generation and installation of the API
	          docs can be enabled with a configure or CMake option if
	          Doxygen is available.
	        - Remove the XZ logo which was used in the API documentation.
	          The logo has been retired and isn't used by the project
	          anymore. However, it's OK to use it in contexts that refer
	          to the backdoor incident.
	        - Remove the PDF versions of the man pages from the source
	          package. These existed primarily for users of operating
	          systems which don't come with tools to render man page
	          source files. The plain text versions are still included
	          in doc/man/txt. PDF files can still be generated to doc/man,
	          if the required tools are available, using "make pdf" after
	          running "configure".
	        - Update home page URLs back to their old locations on
	          tukaani.org.
	        - Update maintainer info.
	    * Tests:
	        - In tests/files/README, explain how to recreate the ARM64
	          test files.
	        - Remove two tests that used tiny x86 and SPARC object files
	          as the input files. The matching .c file was included but
	          the object files aren't easy to reproduce. The test cases
	          weren't great anyway; they were from the early days (2009)
	          of the project when the test suite had very few tests.
	        - Improve a few tests.
    5.4.7
	    * Not changed: Memory sanitizer (MSAN) has a false positive
	      in the CRC CLMUL code which also makes OSS Fuzz unhappy.
	      Valgrind is smarter and doesn't complain.
	      A revision to the CLMUL code is coming anyway and this issue
	      will be cleaned up as part of it. It won't be backported to
	      5.6.x or 5.4.x because the old code isn't wrong. There is
	      no reason to risk introducing regressions in old branches
	      just to silence a false positive.
	    * liblzma:
	        - lzma_index_decoder() and lzma_index_buffer_decode(): Fix
	          a missing output pointer initialization (*i = NULL) if the
	          functions are called with invalid arguments. The API docs
	          say that such an initialization is always done. In practice
	          this matters very little because the problem can only occur
	          if the calling application has a bug and these functions
	          return LZMA_PROG_ERROR.
	        - lzma_str_to_filters(): Fix a missing output pointer
	          initialization (*error_pos = 0). This is very similar
	          to the fix above.
	        - Fix C standard conformance with function pointer types.
	          This newly showed up with Clang 17 with -fsanitize=undefined.
	          There are no bug reports about this.
	        - Fix building with NVIDIA HPC SDK.
	    * xz:
	        - Fix a C standard conformance issue in --block-list parsing
	          (arithmetic on a null pointer).
	        - Fix a warning from GNU groff when processing the man page:
	          "warning: cannot select font 'CW'"
	        - Fix outdated threading related information on the man page.
	    * xzless:
	        - With "less" version 451 and later, use "||-" instead of "|-"
	          in the environment variable LESSOPEN. This way compressed
	          files that contain no uncompressed data are shown correctly
	          as empty.
	        - With "less" version 632 and later, use --show-preproc-errors
	          to make "less" show a warning on decompression errors.
	    * Autotools-based build system (configure):
	        - Symbol versioning variant can now be overridden with
	          --enable-symbol-versions. Documentation in INSTALL was
	          updated to match.
	    CMake:
	        - Linux on MicroBlaze is handled specially now. This matches
	          the changes made to the Autotools-based build in XZ Utils
	          5.4.2 and 5.2.11.
	        - Disable symbol versioning on non-glibc Linux to match what
	          the Autotools build does. For example, symbol versioning
	          isn't enabled with musl.
	        - Symbol versioning variant can now be overridden by setting
	          SYMBOL_VERSIONING to "OFF", "generic", or "linux".
	    * Documentation:
	        - Clarify the description of --disable-assembler in INSTALL.
	          The option only affects 32-bit x86 assembly usage.
	        - Add doc/examples/11_file_info.c. It was added to the
	          Git repository in 2017 but forgotten to be added into
	          distribution tarballs.
	        - Don't install the TODO file as part of the documentation.
	          The file is out of date.
	        - Update home page URLs back to their old locations on
	          tukaani.org.
	        - Update maintainer info.
    5.4.6
	    * Fixed a bug involving internal function pointers in liblzma not
	      being initialized to NULL. The bug can only be triggered if
	      lzma_filters_update() is called on a LZMA1 encoder, so it does
	      not affect xz or any application known to us that uses liblzma.
	    * xz:
	        - Fixed a regression introduced in 5.4.2 that caused encoding
	          in the raw format to unnecessarily fail if --suffix was not
	          used. For instance, the following command no longer reports
	          that --suffix must be used:
	              echo foo | xz --format=raw --lzma2 | wc -c
	        - Fixed an issue on MinGW-w64 builds that prevented reading
	          from or writing to non-terminal character devices like NUL.
	    * Added a new test.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

diff --git a/config/rootfiles/common/xz b/config/rootfiles/common/xz
index f3818a083c249e117ffa1fc670b84c030a1061f4..cd64e2c3191915a2c79b23b8dc61058ec932ef21 100644 (file)
--- a/config/rootfiles/common/xz
+++ b/config/rootfiles/common/xz
@@ -41,95 +41,24 @@ usr/bin/xzmore
 #usr/lib/liblzma.la
 #usr/lib/liblzma.so
 usr/lib/liblzma.so.5
-usr/lib/liblzma.so.5.4.5
+usr/lib/liblzma.so.5.6.3
 #usr/lib/pkgconfig/liblzma.pc
 #usr/share/doc/xz
 #usr/share/doc/xz/AUTHORS
 #usr/share/doc/xz/COPYING
+#usr/share/doc/xz/COPYING.0BSD
 #usr/share/doc/xz/COPYING.GPLv2
 #usr/share/doc/xz/NEWS
 #usr/share/doc/xz/README
 #usr/share/doc/xz/THANKS
-#usr/share/doc/xz/TODO
-#usr/share/doc/xz/api
-#usr/share/doc/xz/api/annotated.html
-#usr/share/doc/xz/api/base_8h.html
-#usr/share/doc/xz/api/bc_s.png
-#usr/share/doc/xz/api/bc_sd.png
-#usr/share/doc/xz/api/bcj_8h.html
-#usr/share/doc/xz/api/block_8h.html
-#usr/share/doc/xz/api/check_8h.html
-#usr/share/doc/xz/api/classes.html
-#usr/share/doc/xz/api/closed.png
-#usr/share/doc/xz/api/container_8h.html
-#usr/share/doc/xz/api/delta_8h.html
-#usr/share/doc/xz/api/dir_b17a1d403082bd69a703ed987cf158fb.html
-#usr/share/doc/xz/api/doc.svg
-#usr/share/doc/xz/api/docd.svg
-#usr/share/doc/xz/api/doxygen.css
-#usr/share/doc/xz/api/doxygen.svg
-#usr/share/doc/xz/api/files.html
-#usr/share/doc/xz/api/filter_8h.html
-#usr/share/doc/xz/api/folderclosed.svg
-#usr/share/doc/xz/api/folderclosedd.svg
-#usr/share/doc/xz/api/folderopen.svg
-#usr/share/doc/xz/api/folderopend.svg
-#usr/share/doc/xz/api/functions.html
-#usr/share/doc/xz/api/functions_vars.html
-#usr/share/doc/xz/api/globals.html
-#usr/share/doc/xz/api/globals_defs.html
-#usr/share/doc/xz/api/globals_enum.html
-#usr/share/doc/xz/api/globals_eval.html
-#usr/share/doc/xz/api/globals_func.html
-#usr/share/doc/xz/api/globals_type.html
-#usr/share/doc/xz/api/hardware_8h.html
-#usr/share/doc/xz/api/index.html
-#usr/share/doc/xz/api/index_8h.html
-#usr/share/doc/xz/api/index__hash_8h.html
-#usr/share/doc/xz/api/lzma12_8h.html
-#usr/share/doc/xz/api/lzma_8h.html
-#usr/share/doc/xz/api/nav_f.png
-#usr/share/doc/xz/api/nav_fd.png
-#usr/share/doc/xz/api/nav_g.png
-#usr/share/doc/xz/api/nav_h.png
-#usr/share/doc/xz/api/nav_hd.png
-#usr/share/doc/xz/api/open.png
-#usr/share/doc/xz/api/splitbar.png
-#usr/share/doc/xz/api/splitbard.png
-#usr/share/doc/xz/api/stream__flags_8h.html
-#usr/share/doc/xz/api/structlzma__allocator.html
-#usr/share/doc/xz/api/structlzma__block.html
-#usr/share/doc/xz/api/structlzma__filter.html
-#usr/share/doc/xz/api/structlzma__index__iter.html
-#usr/share/doc/xz/api/structlzma__mt.html
-#usr/share/doc/xz/api/structlzma__options__bcj.html
-#usr/share/doc/xz/api/structlzma__options__delta.html
-#usr/share/doc/xz/api/structlzma__options__lzma.html
-#usr/share/doc/xz/api/structlzma__stream.html
-#usr/share/doc/xz/api/structlzma__stream__flags.html
-#usr/share/doc/xz/api/sync_off.png
-#usr/share/doc/xz/api/sync_on.png
-#usr/share/doc/xz/api/tab_a.png
-#usr/share/doc/xz/api/tab_ad.png
-#usr/share/doc/xz/api/tab_b.png
-#usr/share/doc/xz/api/tab_bd.png
-#usr/share/doc/xz/api/tab_h.png
-#usr/share/doc/xz/api/tab_hd.png
-#usr/share/doc/xz/api/tab_s.png
-#usr/share/doc/xz/api/tab_sd.png
-#usr/share/doc/xz/api/tabs.css
-#usr/share/doc/xz/api/version_8h.html
-#usr/share/doc/xz/api/vli_8h.html
 #usr/share/doc/xz/examples
 #usr/share/doc/xz/examples/00_README.txt
 #usr/share/doc/xz/examples/01_compress_easy.c
 #usr/share/doc/xz/examples/02_decompress.c
 #usr/share/doc/xz/examples/03_compress_custom.c
 #usr/share/doc/xz/examples/04_compress_easy_mt.c
+#usr/share/doc/xz/examples/11_file_info.c
 #usr/share/doc/xz/examples/Makefile
-#usr/share/doc/xz/examples_old
-#usr/share/doc/xz/examples_old/xz_pipe_comp.c
-#usr/share/doc/xz/examples_old/xz_pipe_decomp.c
 #usr/share/doc/xz/faq.txt
 #usr/share/doc/xz/history.txt
 #usr/share/doc/xz/lzma-file-format.txt
@@ -168,6 +97,7 @@ usr/lib/liblzma.so.5.4.5
 #usr/share/man/de/man1/lzless.1
 #usr/share/man/de/man1/lzma.1
 #usr/share/man/de/man1/lzmadec.1
+#usr/share/man/de/man1/lzmainfo.1
 #usr/share/man/de/man1/lzmore.1
 #usr/share/man/de/man1/unlzma.1
 #usr/share/man/de/man1/unxz.1
@@ -184,21 +114,16 @@ usr/lib/liblzma.so.5.4.5
 #usr/share/man/fr
 #usr/share/man/fr/man1
 #usr/share/man/fr/man1/lzcat.1
-#usr/share/man/fr/man1/lzcmp.1
-#usr/share/man/fr/man1/lzdiff.1
 #usr/share/man/fr/man1/lzless.1
 #usr/share/man/fr/man1/lzma.1
 #usr/share/man/fr/man1/lzmadec.1
-#usr/share/man/fr/man1/lzmore.1
+#usr/share/man/fr/man1/lzmainfo.1
 #usr/share/man/fr/man1/unlzma.1
 #usr/share/man/fr/man1/unxz.1
 #usr/share/man/fr/man1/xz.1
 #usr/share/man/fr/man1/xzcat.1
-#usr/share/man/fr/man1/xzcmp.1
 #usr/share/man/fr/man1/xzdec.1
-#usr/share/man/fr/man1/xzdiff.1
 #usr/share/man/fr/man1/xzless.1
-#usr/share/man/fr/man1/xzmore.1
 #usr/share/man/ko
 #usr/share/man/ko/man1
 #usr/share/man/ko/man1/lzcat.1
@@ -210,6 +135,7 @@ usr/lib/liblzma.so.5.4.5
 #usr/share/man/ko/man1/lzless.1
 #usr/share/man/ko/man1/lzma.1
 #usr/share/man/ko/man1/lzmadec.1
+#usr/share/man/ko/man1/lzmainfo.1
 #usr/share/man/ko/man1/lzmore.1
 #usr/share/man/ko/man1/unlzma.1
 #usr/share/man/ko/man1/unxz.1
@@ -249,27 +175,16 @@ usr/lib/liblzma.so.5.4.5
 #usr/share/man/pt_BR
 #usr/share/man/pt_BR/man1
 #usr/share/man/pt_BR/man1/lzcat.1
-#usr/share/man/pt_BR/man1/lzcmp.1
-#usr/share/man/pt_BR/man1/lzdiff.1
-#usr/share/man/pt_BR/man1/lzegrep.1
-#usr/share/man/pt_BR/man1/lzfgrep.1
-#usr/share/man/pt_BR/man1/lzgrep.1
 #usr/share/man/pt_BR/man1/lzless.1
 #usr/share/man/pt_BR/man1/lzma.1
 #usr/share/man/pt_BR/man1/lzmadec.1
-#usr/share/man/pt_BR/man1/lzmore.1
+#usr/share/man/pt_BR/man1/lzmainfo.1
 #usr/share/man/pt_BR/man1/unlzma.1
 #usr/share/man/pt_BR/man1/unxz.1
 #usr/share/man/pt_BR/man1/xz.1
 #usr/share/man/pt_BR/man1/xzcat.1
-#usr/share/man/pt_BR/man1/xzcmp.1
 #usr/share/man/pt_BR/man1/xzdec.1
-#usr/share/man/pt_BR/man1/xzdiff.1
-#usr/share/man/pt_BR/man1/xzegrep.1
-#usr/share/man/pt_BR/man1/xzfgrep.1
-#usr/share/man/pt_BR/man1/xzgrep.1
 #usr/share/man/pt_BR/man1/xzless.1
-#usr/share/man/pt_BR/man1/xzmore.1
 #usr/share/man/ro
 #usr/share/man/ro/man1
 #usr/share/man/ro/man1/lzcat.1
@@ -281,6 +196,7 @@ usr/lib/liblzma.so.5.4.5
 #usr/share/man/ro/man1/lzless.1
 #usr/share/man/ro/man1/lzma.1
 #usr/share/man/ro/man1/lzmadec.1
+#usr/share/man/ro/man1/lzmainfo.1
 #usr/share/man/ro/man1/lzmore.1
 #usr/share/man/ro/man1/unlzma.1
 #usr/share/man/ro/man1/unxz.1
@@ -305,6 +221,7 @@ usr/lib/liblzma.so.5.4.5
 #usr/share/man/uk/man1/lzless.1
 #usr/share/man/uk/man1/lzma.1
 #usr/share/man/uk/man1/lzmadec.1
+#usr/share/man/uk/man1/lzmainfo.1
 #usr/share/man/uk/man1/lzmore.1
 #usr/share/man/uk/man1/unlzma.1
 #usr/share/man/uk/man1/unxz.1

diff --git a/lfs/xz b/lfs/xz
index 0a17633406237e9b7587ad427006259198ec46cd..aa04a8d3a500d904f7cc43dffaf0c3758263b151 100644 (file)
--- a/lfs/xz
+++ b/lfs/xz
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 5.4.5
+VER        = 5.6.3
 
 THISAPP    = xz-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -45,7 +45,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 08d9afebd927ea5d155515a4c9eedda4d1a249f2b1ab6ada11f50e5b7a3c90b389b32378ab1c0872c7f4627de8dff37149d85e49f7f4d30614add37320ec4f3e
+$(DL_FILE)_BLAKE2 = 7c75a334abdec370d03bea1d07f9211069633e2851e304f189b6b316d9c8363350849404cff318310c3d4a6d2ec6439e64e074f40d7ad5f02ff101757de27f99
 
 install : $(TARGET)