[ptxdist] [PATCH] xz: version bump 5.8.1 -> 5.8.4

[ptxdist] [PATCH] xz: version bump 5.8.1 -> 5.8.4

[Alexander Dahl via ptxdist]

URL moved back to direct tarball download.  PGP signed artifacts are
present on release pages at GitHub/Codeberg/Sourceforge, and download
section on authors site links to GitHub anyways.
Checksums should match checksums from other distributions again.

5.8.2 fixed mainly minor build issues.

Announcement for 5.8.3:

> IMPORTANT: This includes a fix for CVE-2026-34743 which affects all XZ
> Utils versions since 5.0.0. No new 5.2.x, 5.4.x, or 5.6.x releases will
> be made, but the fix is in the v5.2, v5.4, and v5.6 branches in the xz
> Git repository.

Announcement for 5.8.4:

> IMPORTANT: This includes a fix for a security issue that affects all XZ
> Utils versions since 5.0.0. This and a few other fixes have also been
> committed to the old stable branches (v5.2, v5.4, and v5.6) in the xz
> Git repository. Those fixes are marked below. No new 5.2.x, 5.4.x, or
> 5.6.x releases will be made.

Contact address of Free Software Foundation changed in license files,
otherwise unchanged.

Link: https://tukaani.org/xz/#_stable
Link: https://github.com/tukaani-project/xz/releases#release-v5.8.2
Link: https://github.com/tukaani-project/xz/releases#release-v5.8.3
Link: https://github.com/tukaani-project/xz/releases#release-v5.8.4
Signed-off-by: Alexander Dahl <ada@thorsis.com>
---

Notes:
    Not sure what security gain we have from tarballs created by GitHub?
    This just makes packaging harder.

 rules/xz.make | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/rules/xz.make b/rules/xz.make
index fa8b544e5..d93ff2cf8 100644
--- a/rules/xz.make
+++ b/rules/xz.make
@@ -14,19 +14,19 @@ PACKAGES-$(PTXCONF_XZ) += xz
 #
 # Paths and names
 #
-XZ_VERSION	:= 5.8.1
-XZ_SHA256	:= bdbc23fbf9098843357e71e49685724fda2c320c29cb1b25fd90505f14bb0b3d
+XZ_VERSION	:= 5.8.4
+XZ_SHA256	:= 0014c7886930454fe8bd4228665b51af55eeae560ea135c9c4cd33f55b2591d9
 XZ		:= xz-$(XZ_VERSION)
 XZ_SUFFIX	:= tar.gz
-XZ_URL		:= https://github.com/tukaani-project/xz/archive/refs/tags/v$(XZ_VERSION).$(XZ_SUFFIX)
+XZ_URL		:= https://github.com/tukaani-project/xz/releases/download/v$(XZ_VERSION)/$(XZ).$(XZ_SUFFIX)
 XZ_SOURCE	:= $(SRCDIR)/$(XZ).$(XZ_SUFFIX)
 XZ_DIR		:= $(BUILDDIR)/$(XZ)
 XZ_LICENSE	:= 0BSD AND public_domain AND LGPL-2.1-or-later AND GPL-2.0-or-later AND GPL-3.0-or-later
 XZ_LICENSE_FILES := \
 	file://COPYING;md5=d38d562f6112174de93a9677682231b2 \
-	file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
+	file://COPYING.GPLv2;md5=570a9b3749dd0463a1778803b12a6dce \
 	file://COPYING.GPLv3;md5=1ebbd3e34237af26da5dc08a4e440464 \
-	file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c
+	file://COPYING.LGPLv2.1;md5=4bf661c1e3793e55c8d1051bc5e0ae21
 
 # ----------------------------------------------------------------------------
 # Prepare

base-commit: 32189152b5ddb01bf113a5c88c3efa8196acfeb5
-- 
2.47.3

Re: [ptxdist] [PATCH] xz: version bump 5.8.1 -> 5.8.4

[Michael Olbrich]

On Mon, Sep 14, 2026 at 05:00:55PM +0200, Alexander Dahl via ptxdist wrote:
> URL moved back to direct tarball download.  PGP signed artifacts are
> present on release pages at GitHub/Codeberg/Sourceforge, and download
> section on authors site links to GitHub anyways.
> Checksums should match checksums from other distributions again.
> 
> 5.8.2 fixed mainly minor build issues.
> 
> Announcement for 5.8.3:
> 
> > IMPORTANT: This includes a fix for CVE-2026-34743 which affects all XZ
> > Utils versions since 5.0.0. No new 5.2.x, 5.4.x, or 5.6.x releases will
> > be made, but the fix is in the v5.2, v5.4, and v5.6 branches in the xz
> > Git repository.
> 
> Announcement for 5.8.4:
> 
> > IMPORTANT: This includes a fix for a security issue that affects all XZ
> > Utils versions since 5.0.0. This and a few other fixes have also been
> > committed to the old stable branches (v5.2, v5.4, and v5.6) in the xz
> > Git repository. Those fixes are marked below. No new 5.2.x, 5.4.x, or
> > 5.6.x releases will be made.
> 
> Contact address of Free Software Foundation changed in license files,
> otherwise unchanged.
> 
> Link: https://tukaani.org/xz/#_stable
> Link: https://github.com/tukaani-project/xz/releases#release-v5.8.2
> Link: https://github.com/tukaani-project/xz/releases#release-v5.8.3
> Link: https://github.com/tukaani-project/xz/releases#release-v5.8.4
> Signed-off-by: Alexander Dahl <ada@thorsis.com>
> ---
> 
> Notes:
>     Not sure what security gain we have from tarballs created by GitHub?

It helps detecting supply chain attacks. The "make dist" archive is
basically impossible to reproduce, so we need to trust the uploader that it
was not modified. For the git tarball, all changes are visible in the
commit history. While someone still needs to look, it's much easier to spot
something.
And that is not theoretical: The xz backdoor did just that with a modified
build-to-host.m4.

>     This just makes packaging harder.

I'm not sure what you mean with that.

Michael

> 
>  rules/xz.make | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/rules/xz.make b/rules/xz.make
> index fa8b544e5..d93ff2cf8 100644
> --- a/rules/xz.make
> +++ b/rules/xz.make
> @@ -14,19 +14,19 @@ PACKAGES-$(PTXCONF_XZ) += xz
>  #
>  # Paths and names
>  #
> -XZ_VERSION	:= 5.8.1
> -XZ_SHA256	:= bdbc23fbf9098843357e71e49685724fda2c320c29cb1b25fd90505f14bb0b3d
> +XZ_VERSION	:= 5.8.4
> +XZ_SHA256	:= 0014c7886930454fe8bd4228665b51af55eeae560ea135c9c4cd33f55b2591d9
>  XZ		:= xz-$(XZ_VERSION)
>  XZ_SUFFIX	:= tar.gz
> -XZ_URL		:= https://github.com/tukaani-project/xz/archive/refs/tags/v$(XZ_VERSION).$(XZ_SUFFIX)
> +XZ_URL		:= https://github.com/tukaani-project/xz/releases/download/v$(XZ_VERSION)/$(XZ).$(XZ_SUFFIX)
>  XZ_SOURCE	:= $(SRCDIR)/$(XZ).$(XZ_SUFFIX)
>  XZ_DIR		:= $(BUILDDIR)/$(XZ)
>  XZ_LICENSE	:= 0BSD AND public_domain AND LGPL-2.1-or-later AND GPL-2.0-or-later AND GPL-3.0-or-later
>  XZ_LICENSE_FILES := \
>  	file://COPYING;md5=d38d562f6112174de93a9677682231b2 \
> -	file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
> +	file://COPYING.GPLv2;md5=570a9b3749dd0463a1778803b12a6dce \
>  	file://COPYING.GPLv3;md5=1ebbd3e34237af26da5dc08a4e440464 \
> -	file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c
> +	file://COPYING.LGPLv2.1;md5=4bf661c1e3793e55c8d1051bc5e0ae21
>  
>  # ----------------------------------------------------------------------------
>  # Prepare
> 
> base-commit: 32189152b5ddb01bf113a5c88c3efa8196acfeb5
> -- 
> 2.47.3
> 
> 
> 

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

Re: [ptxdist] [PATCH] xz: version bump 5.8.1 -> 5.8.4

[Alexander Dahl via ptxdist]

Hello Michael,

Am Sat, Sep 19, 2026 at 09:05:28AM +0200 schrieb Michael Olbrich:
> On Mon, Sep 14, 2026 at 05:00:55PM +0200, Alexander Dahl via ptxdist wrote:
[…]
> > Notes:
> >     Not sure what security gain we have from tarballs created by GitHub?
> 
> It helps detecting supply chain attacks. The "make dist" archive is
> basically impossible to reproduce, so we need to trust the uploader that it
> was not modified. For the git tarball, all changes are visible in the
> commit history. While someone still needs to look, it's much easier to spot
> something.
> And that is not theoretical: The xz backdoor did just that with a modified
> build-to-host.m4.
> 
> >     This just makes packaging harder.
> 
> I'm not sure what you mean with that.

Usually upstream publishes sha256 sums and gpg signatures along a
tarball release.  I usually check those, and compare with the sums
other distributions (e.g. buildroot) have in their packages.  If we
take the generated tarball from git, those checks are impossible.

Greets
Alex

Re: [ptxdist] [PATCH] xz: version bump 5.8.1 -> 5.8.4

[Sven Püschel]

Hi Alexander,

On 9/21/26 08:18, Alexander Dahl via ptxdist wrote:
> Hello Michael,
>
> Am Sat, Sep 19, 2026 at 09:05:28AM +0200 schrieb Michael Olbrich:
>> On Mon, Sep 14, 2026 at 05:00:55PM +0200, Alexander Dahl via ptxdist wrote:
> […]
>>> Notes:
>>>      Not sure what security gain we have from tarballs created by GitHub?
>> It helps detecting supply chain attacks. The "make dist" archive is
>> basically impossible to reproduce, so we need to trust the uploader that it
>> was not modified. For the git tarball, all changes are visible in the
>> commit history. While someone still needs to look, it's much easier to spot
>> something.
>> And that is not theoretical: The xz backdoor did just that with a modified
>> build-to-host.m4.
>>
>>>      This just makes packaging harder.
>> I'm not sure what you mean with that.
> Usually upstream publishes sha256 sums and gpg signatures along a
> tarball release.  I usually check those, and compare with the sums
> other distributions (e.g. buildroot) have in their packages.  If we
> take the generated tarball from git, those checks are impossible.

I can totally understand both sides. In the end the question is what 
thread we want to protect against?
Your thread model is that GitHub or someone with access to GitHub does 
bad things. Michael's thread model is against a bad/compromised 
maintainer trying to hide the actual attack.
Both are correct and neither guarantees security, as a bad actor could 
also simply hide his stuff in some commit. For best security one would 
have to review the whole (commit) diff between the releases.

But given that xz also has PGP signed commit, you could also verify it 
in the following way:

(clone xz repo and verify signature of the given tag)
$ git archive --format=tar --prefix=xz-5.8.4/ v5.8.4 | sha256sum
ac47844373932e3fed48d7d791fdea426005894592578eaba3f878394d62bfa3 -
$ wcurl 
https://github.com/tukaani-project/xz/archive/refs/tags/v5.8.4.tar.gz
(...)
$ gzip --decompress --stdout v5.8.4.tar.gz | sha256sum
ac47844373932e3fed48d7d791fdea426005894592578eaba3f878394d62bfa3 -


Sidenote: From an operational point of view GitHub btw. also disagrees 
from using their auto generated archives, as they cannot guarantee that 
they are reproducible [1], but they do their best to not break anything [2].

[1] https://github.com/github/docs/issues/31141#issuecomment-1899101631
[2] https://github.com/github/docs/issues/31141#issuecomment-1899166346

Sincerely
     Sven

>
> Greets
> Alex