vcswatch reports that
this package seems to have new commits in its VCS but has
not yet updated debian/changelog. You should consider updating
the Debian changelog and uploading this new version into the archive.
Here are the relevant commit logs:
commit bb78758523bd4a130278633000efc2378b009a39
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Fri Oct 3 18:37:03 2025 +0200
Prepare 5.8.1-2
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit 4b769547816fbf896d2728c437fb44c20f2fc866
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Fri Oct 3 18:31:08 2025 +0200
d: Remove the symlinks from -dev package.
THANKS pointed to a non-existing file because it got compressed. I think
those symlinks are usefull, drop them.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit a39f34283198b75e89068b47b0dc5a6be8ad9c24
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Fri Oct 3 18:26:22 2025 +0200
Correct the nocheck build profile
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit 1b806b8dc25b6ad18a923e4d58da935521212203
Author: Matthias Klose <doko@debian.org>
Date: Thu Sep 4 11:21:01 2025 +0200
Import Debian changes 5.8.1-1.1
xz-utils (5.8.1-1.1) unstable; urgency=medium
.
* Non-maintainer upload.
* Sourceful no-change upload for IEEE long double on ppc64el.
commit b1cad34bb84c2f83862f9a6fdd44a90cfe3b9151
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Thu Apr 3 23:03:26 2025 +0200
Prepare 5.8.1-1
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit a8646015b44ebc7523f979c11851388ee4d1ad7d
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Thu Apr 3 22:59:52 2025 +0200
Import 5.8.1
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit 2808ec2d7c32b7736550fc89626a60f57f9bc7eb
Merge: a6b54dde fa1e8796
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Thu Apr 3 22:58:39 2025 +0200
Update upstream source from tag 'upstream/5.8.1'
Update to upstream version '5.8.1'
with Debian dir 47e92108682392e2f00c9daf753a0099d6cba32b
commit fa1e8796dabd91a0f667b9e90f9841825225413a
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Thu Apr 3 22:58:39 2025 +0200
New upstream version 5.8.1
commit a522a226545730551f7e7c2685fab27cf567746c
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Apr 3 14:34:43 2025 +0300
Bump version and soname for 5.8.1
commit 1c462c2ad86ff85766928638431029cd0b0dc995
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Apr 3 14:34:43 2025 +0300
Add NEWS for 5.8.1
commit 513cabcf7f5ce1c3ed0619e791393fc53d1dbbd0
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Apr 3 14:34:43 2025 +0300
Tests: Call lzma_code() in smaller chunks in fuzz_common.h
This makes it easy to crash fuzz_decode_stream_mt when tested
against the code from 5.8.0.
Obviously this might make it harder to reach some other code path now.
The previous code has been in use since 2018 when fuzzing was added
in 106d1a663d4b ("Tests: Add a fuzz test program and a config file
for OSS-Fuzz.").
commit 48440e24a25911ae59e8518b67a1e0f6f1c293bf
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Apr 3 14:34:43 2025 +0300
Tests: Add a fuzzing target for the multithreaded .xz decoder
It doesn't seem possible to trigger the CVE-2025-31115 bug with this
fuzzing target at the moment. It's because the code in fuzz_common.h
passes the whole input buffer to lzma_code() at once.
commit 0c80045ab82c406858d9d5bcea9f48ebc3d0a81d
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Apr 3 14:34:42 2025 +0300
liblzma: mt dec: Fix lack of parallelization in single-shot decoding
Single-shot decoding means calling lzma_code() by giving it the whole
input at once and enough output buffer space to store the uncompressed
data, and combining this with LZMA_FINISH and no timeout
(lzma_mt.timeout = 0). This way the file is decoded with a single
lzma_code() call if possible.
The bug prevented the decoder from starting more than one worker thread
in single-shot mode. The issue was noticed when reviewing the code;
there are no bug reports. Thus maybe few have tried this mode.
Fixes: 64b6d496dc81 ("liblzma: Threaded decoder: Always wait for output if LZMA_FINISH is used.")
commit 8188048854e8d11071b8a50d093c74f4c030acc9
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Apr 3 14:34:42 2025 +0300
liblzma: mt dec: Don't modify thr->in_size in the worker thread
Don't set thr->in_size = 0 when returning the thread to the stack of
available threads. Not only is it useless, but the main thread may
read the value in SEQ_BLOCK_THR_RUN. With valid inputs, it made
no difference if the main thread saw the original value or 0. With
invalid inputs (when worker thread stops early), thr->in_size was
no longer modified after the previous commit with the security fix
("Don't free the input buffer too early").
So while the bug appears harmless now, it's important to fix it because
the variable was being modified without proper locking. It's trivial
to fix because there is no need to change the value. Only main thread
needs to set the value in (in SEQ_BLOCK_THR_INIT) when starting a new
Block before the worker thread is activated.
Fixes: 4cce3e27f529 ("liblzma: Add threaded .xz decompressor.")
Reviewed-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Thanks-to: Sam James <sam@gentoo.org>
commit d5a2ffe41bb77b918a8c96084885d4dbe4bf6480
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Apr 3 14:34:42 2025 +0300
liblzma: mt dec: Don't free the input buffer too early (CVE-2025-31115)
The input buffer must be valid as long as the main thread is writing
to the worker-specific input buffer. Fix it by making the worker
thread not free the buffer on errors and not return the worker thread to
the pool. The input buffer will be freed when threads_end() is called.
With invalid input, the bug could at least result in a crash. The
effects include heap use after free and writing to an address based
on the null pointer plus an offset.
The bug has been there since the first committed version of the threaded
decoder and thus affects versions from 5.3.3alpha to 5.8.0.
As the commit message in 4cce3e27f529 says, I had made significant
changes on top of Sebastian's patch. This bug was indeed introduced
by my changes; it wasn't in Sebastian's version.
Thanks to Harri K. Koskinen for discovering and reporting this issue.
Fixes: 4cce3e27f529 ("liblzma: Add threaded .xz decompressor.")
Reported-by: Harri K. Koskinen <x64nop@nannu.org>
Reviewed-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Thanks-to: Sam James <sam@gentoo.org>
commit c0c835964dfaeb2513a3c0bdb642105152fe9f34
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Apr 3 14:34:42 2025 +0300
liblzma: mt dec: Simplify by removing the THR_STOP state
The main thread can directly set THR_IDLE in threads_stop() which is
called when errors are detected. threads_stop() won't return the stopped
threads to the pool or free the memory pointed by thr->in anymore, but
it doesn't matter because the existing workers won't be reused after
an error. The resources will be cleaned up when threads_end() is
called (reinitializing the decoder always calls threads_end()).
Reviewed-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Thanks-to: Sam James <sam@gentoo.org>
commit 831b55b971cf579ee16a854f177c36b20d3c6999
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Apr 3 14:34:42 2025 +0300
liblzma: mt dec: Fix a comment
Reviewed-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Thanks-to: Sam James <sam@gentoo.org>
commit b9d168eee4fb6393b4fe207c0aeb5faee316ca1a
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Apr 3 14:34:30 2025 +0300
liblzma: Add assertions to lzma_bufcpy()
commit c8e0a4897b4d0f906966f5d4d4f662221d64f3ae
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Wed Apr 2 16:40:22 2025 +0300
DOS: Update Makefile to fix the build
commit 307c02ed698a69763ef1c9c0df4ff24727442118
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sat Mar 29 12:41:32 2025 +0200
sysdefs.h: Avoid <stdalign.h> even with C11 compilers
Oracle Developer Studio 12.6 on Solaris 10 claims C11 support in
__STDC_VERSION__ and supports _Alignas. However, <stdalign.h> is missing.
We only need alignas, so define it to _Alignas with C11/C17 compilers.
If something included <stdalign.h> later, it shouldn't cause problems.
Thanks to Ihsan Dogan for reporting the issue and testing the fix.
Fixes: c0e7eaae8d6eef1e313c9d0da20ccf126ec61f38
commit 7ce38b318339d6c01378a77585e08169ca3a604e
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sat Mar 29 12:32:05 2025 +0200
Update THANKS
commit 688e51bde4c987589717b2be1a1fde9576c604fc
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sat Mar 29 12:21:51 2025 +0200
Translations: Update the Croatian translation
commit a6b54ddef7ab60b4b199d3f3ec51395392a2485a
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Wed Mar 26 23:01:31 2025 +0100
Prepare 5.8.0-1.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit 77d9470ff01acac116af14c28bd037cdf0f3e640
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Wed Mar 26 23:00:50 2025 +0100
Add 5.8 symbols.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit 9268eb661a48d9ed9d2ffa5c02c3fb313c85cc62
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Wed Mar 26 22:00:20 2025 +0100
Import 5.8.0
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit 6f85ef4f50749c16f1f25ff6fa85f7030a5d080f
Merge: 5d38473c afba662b
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Wed Mar 26 21:59:21 2025 +0100
Update upstream source from tag 'upstream/5.8.0'
Update to upstream version '5.8.0'
with Debian dir 8e35d19f7b9149f95ccc9d08f3cdbc0095a55867
commit afba662b1d54409422eb3e63895059cd98608395
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Wed Mar 26 21:59:21 2025 +0100
New upstream version 5.8.0
commit 5d38473c809f208ed2cb38cb81ab0212eb7d45ff
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Wed Mar 26 21:56:36 2025 +0100
Switch v5.8 series.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit 173fb5c68b08a8c1369550267be258132b7760c6
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue Mar 25 18:23:57 2025 +0200
doc/SHA256SUMS: Add 5.8.0
commit db9258e828bc2cd96e3954f1ddcc9d3530589025
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue Mar 25 15:18:32 2025 +0200
Bump version and soname for 5.8.0
Also remove the LZMA_UNSTABLE macro.
commit bfb752a38f89ed03fc93d54f11c09f43fda64bc2
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue Mar 25 15:18:32 2025 +0200
Add NEWS for 5.8.0
commit 6ccbb904da851eb0c174c8dbd43e84da31739720
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue Mar 25 15:18:31 2025 +0200
Translations: Run "make -C po update-po"
POT-Creation-Date is set to match the timestamp in 5.7.2beta which
in the Translation Project is known as 5.8.0-pre1. The strings
haven't changed since 5.7.1alpha but a few comments have.
This is a very noisy commit, but this helps keeping the PO files
similar between the Git repository and stable release tarballs.
commit 891a5f057a6bb2dd2e3ce5e3bdd7a1f1ee03b800
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue Mar 25 15:18:31 2025 +0200
Translations: Run po4a/update-po
Also remove the trivial obsolete messages like man page dates.
This is a noisy commit, but this helps keeping the PO files similar
between the Git repository and stable release tarballs.
commit 4f52e7387012cb3510b01c937dd9b3a0c6a3ac6c
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue Mar 25 15:18:31 2025 +0200
Translations: Partially fix overtranslation in Serbian man pages
Names of environment variables and some other strings must be present
in the original form. The translator couldn't be reached so I'm
changing some of the strings myself. In the "Robot mode" section,
occurrences in the middle of sentences weren't changed to reduce
the chance of grammar breakage, but I kept the translated strings in
parenthesis in the headings. It's not ideal, but now people shouldn't
need to look at the English man page to find the English strings.
commit ff5d944749b99eb5ab35e2ebaf01d05a59e7169b
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue Mar 25 15:18:31 2025 +0200
liblzma: Count the extra bytes in LZMA/LZMA2 decoder memory usage
commit 943b012d09f717f7b44284c4e4976ea41264c731
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue Mar 25 15:18:31 2025 +0200
liblzma: Use SSE2 intrinsics instead of memcpy() in dict_repeat()
SSE2 is supported on every x86-64 processor. The SSE2 code is used on
32-bit x86 if compiler options permit unconditional use of SSE2.
dict_repeat() copies short random-sized unaligned buffers. At least
on glibc, FreeBSD, and Windows (MSYS2, UCRT, MSVCRT), memcpy() is
clearly faster than byte-by-byte copying in this use case. Compared
to the memcpy() version, the new SSE2 version reduces decompression
time by 0-5 % depending on the machine and libc. It should never be
slower than the memcpy() version.
However, on musl 1.2.5 on x86-64, the memcpy() version is the slowest.
Compared to the memcpy() version:
- The byte-by-version takes 6-7 % less time to decompress.
- The SSE2 version takes 16-18 % less time to decompress.
The numbers are from decompressing a Linux kernel source tarball in
single-threaded mode on older AMD and Intel systems. The tarball
compresses well, and thus dict_repeat() performance matters more
than with some other files.
commit bc14e4c94e788d42eeab984298391fc0ca46f969
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue Mar 25 15:18:31 2025 +0200
liblzma: Add "restrict" to a few functions in lz_decoder.h
This doesn't make any difference in practice because compilers can
already see that writing through the dict->buf pointer cannot modify
the contents of *dict itself: The LZMA decoder makes a local copy of
the lzma_dict structure, and even if it didn't, the pointer to
lzma_dict in the LZMA decoder is already "restrict".
It's nice to add "restrict" anyway. uint8_t is typically unsigned char
which can alias anything. Without the above conditions or "restrict",
compilers could need to assume that writing through dict->buf might
modify *dict. This would matter in dict_repeat() because the loops
refer to dict->buf and dict->pos instead of making local copies of
those members for the duration of the loops. If compilers had to
assume that writing through dict->buf can affect *dict, then compilers
would need to emit code that reloads dict->buf and dict->pos after
every write through dict->buf.
commit e82ee090c567e560f51a056775a17f534d159d65
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue Mar 25 15:18:30 2025 +0200
liblzma: Define LZ_DICT_INIT_POS for initial dictionary position
It's more readable.
commit 8e7cd0091e5239334437decbe1989662d45a2f47
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue Mar 25 15:18:30 2025 +0200
Windows: Update README-Windows.txt about UCRT
commit 2c24292d341e505e5579fccac3bce5bc71d839ef
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Tue Mar 25 15:18:15 2025 +0200
Update THANKS
commit 48053c90898fa191a216aefca01626520a7413f4
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon Mar 17 15:33:25 2025 +0200
Translations: Update the Italian translation
commit 8d6f06a65f50358fad13567f5dd8af41ef1d2b58
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon Mar 17 15:28:56 2025 +0200
Translations: Update the Portuguese translation
The language tag in the Translation Project is pt, not pt_PT,
thus I changed the "Language:" line to pt.
commit c3439b039f46fe547ad603e16dc3bd63c1ca9b0c
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Fri Mar 14 13:02:21 2025 +0200
Translations: Update the Italian translation
commit 79b4ab8d79528dd633a84df2d29e63f5d13ccbdf
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Wed Mar 12 20:48:39 2025 +0200
Translations: Update the Italian man page translations
Only trivial additions but this keeps the file in sync with the TP.
commit 515b6fc8557825e1335012b3b1c8cf71e2c38775
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Wed Mar 12 19:38:54 2025 +0200
Translations: Update the Italian man page translations
commit 333b7c0b776295f0941269b4e6cdb1a0ba5f6218
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon Mar 10 21:00:31 2025 +0200
Translations: Update the Korean man page translations
commit ae52ebd27dc0be5e1ba62fb0c45255d8563fcd88
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon Mar 10 20:56:57 2025 +0200
Translations: Update the German man page translations
commit 1028e52c93d2292b44ff7bae8e721025d2f2c94d
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon Mar 10 13:13:30 2025 +0200
CMake: Fix tuklib_use_system_extensions
Revert back to a macro so that list(APPEND CMAKE_REQUIRED_DEFINITIONS)
will affect the calling scope. I had forgotten that while CMake
functions inherit the variables from the parent scope, the changes
to them are local unless using set(... PARENT_SCOPE).
This also means that the commit message in 5bb77d0920dc is wrong. The
commit itself is still fine, making it clearer that -DHAVE_SYS_PARAM_H
is only needed for specific check_c_source_compiles() calls.
Fixes: c1ea7bd0b60eed6ebcdf9a713ca69034f6f07179
commit 80e48836024ec2d7cbd557575be6da3d1f055cba
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon Mar 10 11:38:55 2025 +0200
INSTALL: Document -bmaxdata on AIX
This is based on a pull request and AIX docs. I haven't tested the
instructions myself.
Closes: https://github.com/tukaani-project/xz/pull/137
commit ab319186b6d0454285ff4941a777ac95e580f60f
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon Mar 10 11:37:19 2025 +0200
Update THANKS
commit 4434671a04436038f88ab0feaa251cc8d7abb683
Author: Collin Funk <collin.funk1@gmail.com>
Date: Sun Mar 9 19:14:31 2025 -0700
tuklib_physmem: Silence -Wsign-conversion on AIX
Closes: https://github.com/tukaani-project/xz/pull/168
commit 18bcaa4fafc935d89ffde94301fa6427907306bf
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Mar 9 22:10:38 2025 +0200
Translations: Update the Romanian man page translations
commit 1e17b7f42fe2f9df279f44ad7043d3753cd00363
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Mar 9 21:28:15 2025 +0200
Translations: Update the Croatian translation
commit ff85e6130d5940896915cdbb99aa9ece9d41240b
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Mar 9 21:23:34 2025 +0200
Translations: Update the Romanian translation
commit a5bfb33f30f77e656723d365db8b06e089d3de61
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Mar 9 21:11:34 2025 +0200
Translations: Update the Ukrainian man page translations
commit 5bb77d0920dcf949d8eb04eb19204b7b199e42df
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Mar 9 14:43:07 2025 +0200
CMake: Use cmake_push_check_state in tuklib_cpucores and tuklib_physmem
Now the changes to CMAKE_REQUIRED_DEFINITIONS are temporary and don't
leak to the calling code.
commit c1ea7bd0b60eed6ebcdf9a713ca69034f6f07179
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Mar 9 14:06:35 2025 +0200
CMake: Revise tuklib_use_system_extensions
Define NetBSD and Darwin/macOS feature test macros. Autoconf defines
these too (and a few others).
Define the macros on Windows except with MSVC. The _GNU_SOURCE macro
makes a difference with mingw-w64.
Use a function instead of a macro. Don't take the TARGET_OR_ALL argument
because there's always global effect because the global variable
CMAKE_REQUIRED_DEFINITIONS is modified.
commit 4243c45a48ef8c103d77b75d9f93d48adcb631db
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sat Mar 8 14:54:29 2025 +0200
doc/SHA256SUMS: Add 5.7.2beta
commit cc7f2fc1cf9f3c63cbce90ee92bfbb004f98140b
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sat Mar 8 14:29:57 2025 +0200
Bump version and soname for 5.7.2beta
commit 62e44b36167de27541776dcf677ed04077c9fd19
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sat Mar 8 14:24:38 2025 +0200
Add NEWS for 5.7.2beta
commit 70f1f203789433b5d7b8b22e1655abc465d659f7
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sat Mar 8 14:23:00 2025 +0200
COPYING: Remove the note about old releases
commit db9827dc38ff79de747a6fc7a99619e961dbc5e6
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sat Mar 8 14:22:28 2025 +0200
xz: Update the man page about the environment variables again
commit 99c584891bd1d946561cebded2226df9b83f1efb
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Mar 6 19:26:09 2025 +0200
liblzma: Edit spelling in a comment
It was found with codespell.
commit 7a234c8c05a8f64efde013cd6a6d31a90b7d0d28
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Mar 6 19:14:23 2025 +0200
xz: Update the man page about the environment variables
commit 808f05af3ef40730d40b3798666757bd866484f1
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Mar 6 17:37:39 2025 +0200
Docs: Add a few TRANSLATORS comments to man pages
All translators know that --command-line-options must not be translated.
With some other strings it's not obvious when the untranslated string
must be preserved. These comments hopefully help.
commit 051de255f00dda331e2a6fa189a6e7fe56a7c69b
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Mar 6 16:34:32 2025 +0200
Scripts: Mark the LZMA Utils script aliases as deprecated
The deprecated aliases are lzcmp, lzdiff, lzless, lzmore,
lzgrep, lzegrep, and lzfgrep. The commands that start with
the xz prefix have identical behavior, for example, both
lzgrep and xzgrep handle all supported file formats.
This doesn't affect lzma, unlzma, lzcat, lzmadec, or lzmainfo.
The last release of LZMA Utils was made in 2008, but the lzma
compatibility alias for the gzip-like tool is still in common use.
Deprecating it would cause unnecessary breakage.
commit 4941ea454c02cf15a64d6434a0778fc2a81282fc
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Mar 2 21:13:04 2025 +0200
Translations: Add Serbian man page translations
commit d142d96f24daa451edaabfca8594e202932b3c0b
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Mar 2 20:42:14 2025 +0200
Translations: Update Georgian translation
commit f970b141d10e70d0091d485e2c57af365761ab82
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Sat Mar 1 21:53:07 2025 +0100
Prepare 5.6.4-1.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit eba57c874fb91015c8ea27f83190be1d26bf6948
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Sat Mar 1 17:24:34 2025 +0100
d: Update standards version of the package.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit 08146c6669b0fbc2d64cc5c2707194fcd0ba3714
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Sat Mar 1 17:09:49 2025 +0100
d: Update expired key.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit 43363699cd5881a7197e90563d00fe064557914e
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Sat Mar 1 14:33:58 2025 +0100
d: Limit watchfile to the 5.6 series.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit 85f3afafda62a50764f17d0127b41acee5e15f83
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Sat Mar 1 14:09:39 2025 +0100
d: Sync output before removing source.
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit 9b7e45d841195c8fd8d286e26f810df28c53dd16
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Fri Feb 28 21:07:21 2025 +0200
Update THANKS
commit 9351592710e0df3238b09d39c545a643c50ac88f
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sat Feb 22 16:04:58 2025 +0200
Update THANKS
commit 9023be7831faca2f28def55e16c39e3a42e1e262
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Wed Feb 19 16:33:52 2025 +0200
Translations: Update the Croatian translation
commit 2eaf242c56e8c65db83d48b018fa44aeafeb33a5
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon Feb 17 21:46:15 2025 +0200
Build: Fix out-of-tree builds when using the replacement getopt_long
Nowaways $(top_builddir)/lib/getopt.h depends on headers in
$(top_srcdir)/lib, so both have to be in the include path.
CMake-based build already did this.
Fixes: 7e884c00d0093c38339f17fb1d280eec493f42ca
commit 41322b2c60cd2c67a1053cb40d27e573420185b7
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon Feb 17 18:25:52 2025 +0200
m4/getopt.m4: Remove an outdated comment
commit 03c23a4952bce1b50a1d213ca2d1c15acd76a489
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon Feb 17 18:11:58 2025 +0200
Build: Allow forcing the use of the replacement getopt_long
Now one can pass gl_replace_getopt=yes to configure to force the use
of GNU getopt_long from the lib directory. This only checks that the
value of gl_replace_getopt is non-empty, so one cannot force the
replacement to be disabled.
Closes: https://github.com/tukaani-project/xz/pull/166
commit c23b837d15960ecc0d537f0260f389904e1e7f02
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Mon Feb 17 18:11:42 2025 +0200
Update THANKS
commit 712a7064004ed322ace3ea9915a5ff7cc9a0d94c
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Mon Feb 3 17:42:15 2025 +0100
Import 5.6.4
Signed-off-by: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
commit f48fdbe5e0ff759465116c4180f3f1968eb56623
Merge: 9427ff2d 51612bd3
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Mon Feb 3 17:41:38 2025 +0100
Update upstream source from tag 'upstream/5.6.4'
Update to upstream version '5.6.4'
with Debian dir 1bd0a35878d206ba4b05d6b8cef2c29a84e66f65
commit 51612bd31d65b9cfd393e6267650770d9b0290c6
Author: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Date: Mon Feb 3 17:41:38 2025 +0100
New upstream version 5.6.4
commit ac50df0d89ce73f30430b8174e578071cbb4e056
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Jan 23 11:45:07 2025 +0200
Bump version and soname for 5.6.4
commit 83ce1d42aecb280eae9212caf484ce869488dbfe
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Jan 23 11:40:46 2025 +0200
Add NEWS for 5.6.4
commit 608dec5bc6c76f5a19174a9a5789b68bd78777ae
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Jan 23 11:40:46 2025 +0200
NEWS: The security fix in 5.6.3 is known as CVE-2024-47611
(cherry picked from commit b3af3297e4d6cf0eafb48155aa97bb06c82a9228)
commit 92950088374b20a9d0a4970db1f31b1950167cd9
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Thu Jan 23 11:24:33 2025 +0200
Translations: Run po4a/update-po
commit 990c769a5ee1d2c3ba20879e350c3b69bb65d2bf
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Wed Jan 22 16:55:09 2025 +0200
windows/build.bash: Fix error message
Fixes: 1ee716f74085223c8fbcae1d5a384e6bf53c0f6a
(cherry picked from commit a04b9dd0c7c74fabd8c393d2dc68a221276d6e29)
commit 5ae7958dbcb194a3df745e4860f7fa902593c095
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Wed Jan 22 15:03:55 2025 +0200
Windows: Disable MinGW-w64's stdio functions in size-optimized builds
This only affects builds with UCRT. With legacy MSVCRT, the replacement
functions are always enabled.
Omitting the MinGW-w64 replacements saves over 20 KiB per executable.
The downside is that --enable-small or XZ_SMALL=ON disables thousand
separator support in xz messages. If someone is OK with the slower
speed of slightly smaller builds, lack of thousand separators won't
matter.
Don't override __USE_MINGW_ANSI_STDIO if it is already defined (via
CPPFLAGS or such method).
(cherry picked from commit 4eae859ae8ad7072eaa74aeaee79a2c3c12c55cb)
commit c182b9c1b398582b40ee3f8db36f32a4bf5cfe20
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Jan 19 20:11:54 2025 +0200
Update THANKS
(cherry picked from commit da359c360e986b21cd8d7b888c6a80f56b9d49c7)
commit 82df6518582be7f17990c02a145d144799c5d630
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Jan 19 19:40:32 2025 +0200
Update THANKS
(cherry picked from commit f032373561cefaf07f92ffe3fbc471ec6770456e)
commit 717bee1ec512d0e5762fee221df133c81cb9f7c4
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Wed Jan 8 19:26:29 2025 +0200
Build: Use --sort=name in TAR_OPTIONS
Use also LC_COLLATE=C to make the sorting locale-independent.
Sorting makes the file order reproducible.
(cherry picked from commit 950da11ce09c90412dcbca29689575037640667a)
commit 27a503b8dd14851d00b04b9ca74b96d77347525e
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Jan 12 13:06:17 2025 +0200
Update THANKS
(cherry picked from commit 96336b0110d47756a9fd2a103fbf0a99e905fbed)
commit f4d988bc045644788a47d8352fb26a28f4d269d5
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Jan 12 12:59:20 2025 +0200
liblzma: Fix the encoder breakage on big endian ARM64
When the 8-byte method was enabled for ARM64, a check for endianness
wasn't added. This broke the LZMA/LZMA2 encoder. Test suite caught it.
Fixes: cd64dd70d5665b6048829c45772d08606f44672e
Co-authored-by: Marcus Comstedt <marcus@mc.pp.se>
(cherry picked from commit 150356207c8d6a3e0af465b676430d19d62f884c)
commit e22c4fb2593760bbd60783e4e3f15bb4a303956f
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Jan 12 11:04:27 2025 +0200
Windows: Update manifest comments about long UTF-8 filenames
(cherry picked from commit b01b0958025a2da284b53a583f313f8140636cb5)
commit 5e77f8a9ef970ca7e3ecb3d23be6e5b866fb9aef
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Jan 12 10:47:58 2025 +0200
Windows: Update build.bash and its README-Windows.txt to UCRT
While MSVCRT builds are possible, UCRT works better with UTF-8.
A 32-bit build is included still but hopefully it's not actually
needed anymore.
(cherry picked from commit 0dfc67d37ebb038be8a9b17b536d1b561d52e81a)
commit 2133ff98396b991928c7052db0ae44585c1c8516
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Fri Jan 10 13:11:40 2025 +0200
Translations: Update Serbian translation
I rewrapped a few overlong lines. Those edits aren't in the
Translation Project. Automatic wrapping in the master branch
means that these strings need to be updated soon anyway.
commit 8eaf2cb58e56e6ae19e9c4542d23a33f4d7636ec
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Jan 5 12:10:05 2025 +0200
liblzma: Always validate the first digit of a preset string
lzma_str_to_filters() may call parse_lzma12_preset() in two ways. The
call from str_to_filters() detects the string type from the first
character(s) and as a side-effect it validates the first digit of
the preset string. So this change makes no difference there.
However, the call from parse_options() doesn't pre-validate the string.
parse_lzma12_preset() will return an invalid value which is passed to
lzma_lzma_preset() which safely rejects it. The bug still affects the
the error message:
$ xz --filters=lzma2:preset=X
xz: Error in --filters=FILTERS option:
xz: lzma2:preset=X
xz: ^
xz: Unsupported preset
After the fix:
$ xz --filters=lzma2:preset=X
xz: Error in --filters=FILTERS option:
xz: lzma2:preset=X
xz: ^
xz: Unsupported preset
The ^ now correctly points to the X and not past it because the X itself
is the problematic character.
Fixes: cedeeca2ea6ada5b0411b2ae10d7a859e837f203
(cherry picked from commit 75107217670a97b7b772833669d88c3c2f188e37)
commit 9b5a5c39f43b7f949930f3b14d80285305f5aa16
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sun Jan 5 11:40:34 2025 +0200
xz: Fix getopt_long argument type in --filters*
Forgetting the argument (or not using = to separate the option from
the argument) resulted in lzma_str_to_filters() being called with NULL
as input string argument. The function handles it fine but xz passes
the NULL to printf() too:
$ xz --filters
xz: Error in --filters=FILTERS option:
xz: (null)
xz: ^
xz: Unexpected NULL pointer argument(s) to lzma_str_to_filters()
Now it's correct:
$ xz --filters
xz: option '--filters' requires an argument
The --filters-help option doesn't take any arguments.
Fixes: 9ded880a0221f4d1256845fc4ab957ffd377c760
Fixes: d6af7f347077b22403133239592e478931307759
Fixes: a165d7df1964121eb9df715e6f836a31c865beef
(cherry picked from commit 52ff32433734d03befd85a5bf00fba77d6501455)
commit 4ddf32c92b76f32559096910afcf7528591302aa
Author: Lasse Collin <lasse.collin@tukaani.org>
Date: Sat Jan 4 20:04:56 2025 +0200
xzdec: Don't leave Landlock file descriptor open for no reason
This fix is similar to 48ff3f06521ca326996ab9a04d1b342098960427.
Fixes: d74fb5f060b76db709b50f5fd37490394e52f975
(cherry picked from commit 2655c81b5e92278b0fd51f6537c1116f8349b02a)
![[bug history graph]](https://qa.debian.org/data/bts/graphs/x/xz-utils.png){kind=link}