[ptxdist] [PATCH v2] xz: version bump 5.4.4 -> 5.8.1

["Sven Püschel" <s.pueschel@pengutronix.de>]

This fixes CVE-2025-31115: Threaded .xz decoder frees memory too early.

To avoid malicious tarballs, which happened in the past switch to the
automatically generated tarballs from by GitHub. As xz also has a
feature complete CMake build system, use it to avoid adding an
autogen.sh file.

Most parts of the COPYING file replaced public domain licenses with
0BSD. But public domain is still mentioned for some old translations.
Therefore only add 0BSD to the license list.

Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
---
 rules/host-xz.in   |  1 +
 rules/host-xz.make | 52 ++++++++++++++++---------------------
 rules/xz.in        |  1 +
 rules/xz.make      | 65 +++++++++++++++++++++-------------------------
 4 files changed, 54 insertions(+), 65 deletions(-)

diff --git a/rules/host-xz.in b/rules/host-xz.in
index 9d1b4fe6a..b38a42194 100644
--- a/rules/host-xz.in
+++ b/rules/host-xz.in
@@ -2,6 +2,7 @@
 
 config HOST_XZ
 	tristate
+	select HOST_CMAKE
 	default y if ALLYES
 	help
 	  XZ-format compression utilities
diff --git a/rules/host-xz.make b/rules/host-xz.make
index c04db9567..c719421b5 100644
--- a/rules/host-xz.make
+++ b/rules/host-xz.make
@@ -15,35 +15,29 @@ HOST_PACKAGES-$(PTXCONF_HOST_XZ) += host-xz
 # Prepare
 # ----------------------------------------------------------------------------
 
-#
-# autoconf
-#
-HOST_XZ_CONF_TOOL	:= autoconf
+HOST_XZ_CONF_TOOL	:= cmake
 HOST_XZ_CONF_OPT	:= \
-	$(HOST_AUTOCONF) \
-	--disable-debug \
-	--disable-external-sha256 \
-	--disable-microlzma \
-	--disable-lzip-decoder \
-	--enable-assembler \
-	--enable-clmul-crc \
-	--disable-small \
-	--enable-threads \
-	--enable-xz \
-	--disable-xzdec \
-	--disable-lzmadec \
-	--disable-lzmainfo \
-	--disable-lzma-links \
-	--disable-scripts \
-	--disable-doc \
-	--disable-sandbox \
-	--enable-shared \
-	--disable-static \
-	--enable-symbol-versions \
-	--disable-nls \
-	--enable-rpath \
-	--enable-unaligned-access=auto \
-	--disable-unsafe-type-punning \
-	--disable-werror
+	$(HOST_CMAKE_OPT) \
+	-DBUILD_SHARED_LIBS=ON \
+	-DBUILD_TESTING=OFF \
+	-DTUKLIB_USE_UNSAFE_TYPE_PUNNING=OFF \
+	-DXZ_DOC=OFF \
+	-DXZ_DOXYGEN=OFF \
+	-DXZ_EXTERNAL_SHA256=OFF \
+	-DXZ_LZIP_DECODER=OFF \
+	-DXZ_MICROLZMA_DECODER=OFF \
+	-DXZ_MICROLZMA_ENCODER=OFF \
+	-DXZ_NLS=OFF \
+	-DXZ_SANDBOX=no \
+	-DXZ_SMALL=OFF \
+	-DXZ_SYMBOL_VERSIONING=linux \
+	-DXZ_THREADS=yes \
+	-DXZ_TOOL_LZMADEC=OFF \
+	-DXZ_TOOL_LZMAINFO=OFF \
+	-DXZ_TOOL_SCRIPTS=OFF \
+	-DXZ_TOOL_SYMLINKS=OFF \
+	-DXZ_TOOL_SYMLINKS_LZMA=OFF \
+	-DXZ_TOOL_XZ=ON \
+	-DXZ_TOOL_XZDEC=OFF
 
 # vim: syntax=make
diff --git a/rules/xz.in b/rules/xz.in
index 9f31a4f45..f61a58f05 100644
--- a/rules/xz.in
+++ b/rules/xz.in
@@ -2,6 +2,7 @@
 
 menuconfig XZ
 	tristate
+	select HOST_CMAKE
 	prompt "xz                            "
 	help
 	  XZ Utils is free general-purpose data compression software
diff --git a/rules/xz.make b/rules/xz.make
index f24a2ac03..d80ce9276 100644
--- a/rules/xz.make
+++ b/rules/xz.make
@@ -14,16 +14,16 @@ PACKAGES-$(PTXCONF_XZ) += xz
 #
 # Paths and names
 #
-XZ_VERSION	:= 5.4.4
-XZ_MD5		:= fbb849a27e266964aefe26bad508144f
+XZ_VERSION	:= 5.8.1
+XZ_MD5		:= 1be5d8137d7b5e91fa9ff8a6fdc4895b
 XZ		:= xz-$(XZ_VERSION)
-XZ_SUFFIX	:= tar.bz2
-XZ_URL		:= https://tukaani.org/xz/$(XZ).$(XZ_SUFFIX)
+XZ_SUFFIX	:= tar.gz
+XZ_URL		:= https://github.com/tukaani-project/xz/archive/refs/tags/v$(XZ_VERSION).$(XZ_SUFFIX)
 XZ_SOURCE	:= $(SRCDIR)/$(XZ).$(XZ_SUFFIX)
 XZ_DIR		:= $(BUILDDIR)/$(XZ)
-XZ_LICENSE	:= public_domain AND LGPL-2.1-or-later AND GPL-2.0-or-later AND GPL-3.0-or-later
+XZ_LICENSE	:= 0BSD AND public_domain AND LGPL-2.1-or-later AND GPL-2.0-or-later AND GPL-3.0-or-later
 XZ_LICENSE_FILES := \
-	file://COPYING;md5=c8ea84ebe7b93cce676b54355dc6b2c0 \
+	file://COPYING;md5=d38d562f6112174de93a9677682231b2 \
 	file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
 	file://COPYING.GPLv3;md5=1ebbd3e34237af26da5dc08a4e440464 \
 	file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c
@@ -32,37 +32,30 @@ XZ_LICENSE_FILES := \
 # Prepare
 # ----------------------------------------------------------------------------
 
-#
-# autoconf
-#
-XZ_CONF_TOOL	:= autoconf
+XZ_CONF_TOOL	:= cmake
 XZ_CONF_OPT	:= \
-	$(CROSS_AUTOCONF_USR) \
-	--disable-debug \
-	--disable-external-sha256 \
-	--disable-microlzma \
-	--disable-lzip-decoder \
-	--enable-assembler \
-	--enable-clmul-crc \
-	--disable-small \
-	--enable-threads \
-	--$(call ptx/endis,PTXCONF_XZ_TOOLS)-xz \
-	--$(call ptx/endis,PTXCONF_XZ_TOOLS)-xzdec \
-	--disable-lzmadec \
-	--disable-lzmainfo \
-	--disable-lzma-links \
-	--$(call ptx/endis,PTXCONF_XZ_TOOLS)-scripts \
-	--disable-doc \
-	--disable-sandbox \
-	--enable-shared \
-	--disable-static \
-	--enable-symbol-versions \
-	--disable-nls \
-	--disable-rpath \
-	$(GLOBAL_LARGE_FILE_OPTION) \
-	--enable-unaligned-access=auto \
-	--disable-unsafe-type-punning \
-	--disable-werror
+	$(CROSS_CMAKE_USR) \
+	-DBUILD_SHARED_LIBS=ON \
+	-DBUILD_TESTING=OFF \
+	-DTUKLIB_USE_UNSAFE_TYPE_PUNNING=OFF \
+	-DXZ_DOC=OFF \
+	-DXZ_DOXYGEN=OFF \
+	-DXZ_EXTERNAL_SHA256=OFF \
+	-DXZ_LZIP_DECODER=OFF \
+	-DXZ_MICROLZMA_DECODER=OFF \
+	-DXZ_MICROLZMA_ENCODER=OFF \
+	-DXZ_NLS=OFF \
+	-DXZ_SANDBOX=no \
+	-DXZ_SMALL=OFF \
+	-DXZ_SYMBOL_VERSIONING=linux \
+	-DXZ_THREADS=yes \
+	-DXZ_TOOL_LZMADEC=OFF \
+	-DXZ_TOOL_LZMAINFO=OFF \
+	-DXZ_TOOL_SCRIPTS=$(call ptx/onoff,PTXCONF_XZ_TOOLS) \
+	-DXZ_TOOL_SYMLINKS=OFF \
+	-DXZ_TOOL_SYMLINKS_LZMA=OFF \
+	-DXZ_TOOL_XZ=$(call ptx/onoff,PTXCONF_XZ_TOOLS) \
+	-DXZ_TOOL_XZDEC=$(call ptx/onoff,PTXCONF_XZ_TOOLS)
 
 # ----------------------------------------------------------------------------
 # Target-Install
-- 
2.47.3