From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Sat, 19 Sep 2026 09:05:47 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1x7p8s-003rpu-38 for lore@lore.pengutronix.de; Sat, 19 Sep 2026 09:05:46 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1x7p8s-0003Uw-14; Sat, 19 Sep 2026 09:05:46 +0200 Received: from mx1.white.stw.pengutronix.de ([2a0a:edc0:0:b01:1d::107]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1x7p8a-0003Up-Fm for ptxdist@pengutronix.de; Sat, 19 Sep 2026 09:05:28 +0200 Received: from drehscheibe.grey.stw.pengutronix.de (drehscheibe.grey.stw.pengutronix.de [IPv6:2a0a:edc0:0:c01:1d::a2]) (Authenticated sender: relay-from-drehscheibe.grey.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id 6C3E7200A6A; Sat, 19 Sep 2026 09:05:28 +0200 (CEST) Received: from pty.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::c5]) by drehscheibe.grey.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1x7p8a-001hH4-1B; Sat, 19 Sep 2026 09:05:28 +0200 Received: from mol by pty.whiteo.stw.pengutronix.de with local (Exim 4.98.2) (envelope-from ) id 1x7p8a-00000006dhN-18FR; Sat, 19 Sep 2026 09:05:28 +0200 Date: Sat, 19 Sep 2026 09:05:28 +0200 From: Michael Olbrich To: Alexander Dahl via ptxdist Message-ID: Mail-Followup-To: Alexander Dahl via ptxdist , Alexander Dahl , Sven =?utf-8?Q?P=C3=BCschel?= References: <20260914150055.317620-1-ada@thorsis.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260914150055.317620-1-ada@thorsis.com> X-Sent-From: Pengutronix Hildesheim X-URL: http://www.pengutronix.de/ X-Accept-Language: de,en X-Accept-Content-Type: text/plain X-IRC: #ptxdist @freenode Subject: Re: [ptxdist] [PATCH] xz: version bump 5.8.1 -> 5.8.4 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Alexander Dahl , Sven =?utf-8?Q?P=C3=BCschel?= Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false On Mon, Sep 14, 2026 at 05:00:55PM +0200, Alexander Dahl via ptxdist wrote: > URL moved back to direct tarball download. PGP signed artifacts are > present on release pages at GitHub/Codeberg/Sourceforge, and download > section on authors site links to GitHub anyways. > Checksums should match checksums from other distributions again. > > 5.8.2 fixed mainly minor build issues. > > Announcement for 5.8.3: > > > IMPORTANT: This includes a fix for CVE-2026-34743 which affects all XZ > > Utils versions since 5.0.0. No new 5.2.x, 5.4.x, or 5.6.x releases will > > be made, but the fix is in the v5.2, v5.4, and v5.6 branches in the xz > > Git repository. > > Announcement for 5.8.4: > > > IMPORTANT: This includes a fix for a security issue that affects all XZ > > Utils versions since 5.0.0. This and a few other fixes have also been > > committed to the old stable branches (v5.2, v5.4, and v5.6) in the xz > > Git repository. Those fixes are marked below. No new 5.2.x, 5.4.x, or > > 5.6.x releases will be made. > > Contact address of Free Software Foundation changed in license files, > otherwise unchanged. > > Link: https://tukaani.org/xz/#_stable > Link: https://github.com/tukaani-project/xz/releases#release-v5.8.2 > Link: https://github.com/tukaani-project/xz/releases#release-v5.8.3 > Link: https://github.com/tukaani-project/xz/releases#release-v5.8.4 > Signed-off-by: Alexander Dahl > --- > > Notes: > Not sure what security gain we have from tarballs created by GitHub? It helps detecting supply chain attacks. The "make dist" archive is basically impossible to reproduce, so we need to trust the uploader that it was not modified. For the git tarball, all changes are visible in the commit history. While someone still needs to look, it's much easier to spot something. And that is not theoretical: The xz backdoor did just that with a modified build-to-host.m4. > This just makes packaging harder. I'm not sure what you mean with that. Michael > > rules/xz.make | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > > diff --git a/rules/xz.make b/rules/xz.make > index fa8b544e5..d93ff2cf8 100644 > --- a/rules/xz.make > +++ b/rules/xz.make > @@ -14,19 +14,19 @@ PACKAGES-$(PTXCONF_XZ) += xz > # > # Paths and names > # > -XZ_VERSION := 5.8.1 > -XZ_SHA256 := bdbc23fbf9098843357e71e49685724fda2c320c29cb1b25fd90505f14bb0b3d > +XZ_VERSION := 5.8.4 > +XZ_SHA256 := 0014c7886930454fe8bd4228665b51af55eeae560ea135c9c4cd33f55b2591d9 > XZ := xz-$(XZ_VERSION) > XZ_SUFFIX := tar.gz > -XZ_URL := https://github.com/tukaani-project/xz/archive/refs/tags/v$(XZ_VERSION).$(XZ_SUFFIX) > +XZ_URL := https://github.com/tukaani-project/xz/releases/download/v$(XZ_VERSION)/$(XZ).$(XZ_SUFFIX) > XZ_SOURCE := $(SRCDIR)/$(XZ).$(XZ_SUFFIX) > XZ_DIR := $(BUILDDIR)/$(XZ) > XZ_LICENSE := 0BSD AND public_domain AND LGPL-2.1-or-later AND GPL-2.0-or-later AND GPL-3.0-or-later > XZ_LICENSE_FILES := \ > file://COPYING;md5=d38d562f6112174de93a9677682231b2 \ > - file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \ > + file://COPYING.GPLv2;md5=570a9b3749dd0463a1778803b12a6dce \ > file://COPYING.GPLv3;md5=1ebbd3e34237af26da5dc08a4e440464 \ > - file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c > + file://COPYING.LGPLv2.1;md5=4bf661c1e3793e55c8d1051bc5e0ae21 > > # ---------------------------------------------------------------------------- > # Prepare > > base-commit: 32189152b5ddb01bf113a5c88c3efa8196acfeb5 > -- > 2.47.3 > > > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |