linux/poky.git/meta/recipes-extended/libarchive, branch styhead-5.1.4

libarchive: fix CVE-2024-48957 & CVE-2024-48958

2024-12-17T20:58:10+00:00

Backport fixes for: * CVE-2024-48957 - Upstream-Status: Backport from https://github.com/libarchive/libarchive/commit/3006bc5d02ad3ae3c4f9274f60c1f9d2d834734b * CVE-2024-48958 - Upstream-Status: Backport from https://github.com/libarchive/libarchive/commit/a1cb648d52f5b6d3f31184d9b6a7cbca628459b7 (From OE-Core rev: 8b520c3cea136591128f6601718c23334afd7a55) (From OE-Core rev: 4f6a2eea1476bc7be1d55b6b6051c4b65d4d97fa) Signed-off-by: Hitendra Prajapati Signed-off-by: Steve Sakoman Signed-off-by: Peter Marko Signed-off-by: Steve Sakoman

libarchive: upgrade 3.7.3 -> 3.7.4

2024-05-28T08:38:23+00:00

Changelog: ========= rar: Fix OOB in rar e8 filter zip: Fix out of boundary access 7zip: Limit amount of properties bsdtar: Fix error handling around strtol() usages passphrase: Improve newline handling on Windows passphrase: Never allow empty passwords rar: Fix "File CRC Error" when extracting specific rar4 archives xar: Avoid infinite link loop zip: Update AppleDouble support for directories zstd: Implement core detection (From OE-Core rev: 7aa9d2e94dd05de51384a4f5d05118c2b4308cbd) Signed-off-by: Yogita Urade Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

libarchive: upgrade 3.7.2 -> 3.7.3

2024-04-25T09:06:02+00:00

Changelog: ========== -PCRE2 support -add trailing letter b to bsdtar(1) substitute pattern -add support for long options "--group" and "--owner" to tar(1) -Fix possible vulnerability in tar error reporting introduced in f27c173 -ISO9660: preserve the natural order of links -rar5: fix decoding unicode filenames on Windows -rar5: fix infinite loop if during rar5 decompression the last block produced no data -xz filter: fix incorrect eof at the end of an lzip member -zip: fix end-of-data marker processing when decompressing zip archives -multiple bsdunzip(1) fixes -filetime truncation fix on Windows configurehack.patch refreshed for 3.7.3 (From OE-Core rev: bd4ab2025bcaffcf2802ad09c9d83e2a4d2a0f2c) Signed-off-by: Wang Mingyu Signed-off-by: Richard Purdie

libarchive: Add packageconfig knob for libb2

2023-11-10T17:44:27+00:00

automatic detection could result in inconsistent host dependencies since it will be enabled for libarchive-native if the build host has libb2 installed and this can then fail on hosts which do not have this library installed Fixes errors like recipe-sysroot-native/usr/bin/opkg: error while loading shared libraries: libb2.so.1: cannot open shared object file: No such file or directory (From OE-Core rev: 5356afef9f0ee70fb804ff9fc8746bcaa47c02ba) Signed-off-by: Khem Raj Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

libarchive: upgrade 3.7.1 -> 3.7.2

2023-09-26T09:35:27+00:00

(From OE-Core rev: 1c07d2f285a304074410ddb22f0ae6fc246ca91f) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

libarchive: upgrade 3.6.2 -> 3.7.1

2023-08-21T10:34:12+00:00

Changelog: ========= SEGV and stack buffer overflow in verbose mode of cpio bsdunzip updated to match latest upstream code miscellaneous functional bugfixes build fixes on multiple platforms bsdunzip: new tool ported from FreeBSD drop-in replacement for Info-ZIP unzip, not yet ported for Windows 7zip reader: support for Zstandard compression 7zip reader: support for ARM64 filter zstd filter: support for multi-frame zstd archives pax: fix year 2038 problem on platforms with 64-bit time_t Windows: Universal Windows Platform (UWP) fixes and improvements Windows: bcrypt usage fixes and improvements Windows: time function usage fixes and improvements (From OE-Core rev: 186bf084301b3d088dd1f100d870937b39d1389a) Signed-off-by: Wang Mingyu Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

libarchive: ignore CVE-2023-30571

2023-07-30T11:00:15+00:00

This issue was reported and discusses under [1] which is linked in NVD CVE report. It was already documented that some parts or libarchive are thread safe and some not. [2] was now merged to document that also reported function is not thread safe. So this CVE *now* reports thread race condition for non-thread-safe function. And as such the CVE report is now invalid. The issue is still not closed for 2 reasons: * better document what is and what is not thread safe * request to public if someone could make these functions thread safe This should however not invalidate above statment about ignoring this CVE. [1] https://github.com/libarchive/libarchive/issues/1876 [2] https://github.com/libarchive/libarchive/pull/1875 (From OE-Core rev: 9b5b850d6a6982bb8ff14dcfbb6769b293638293) Signed-off-by: Peter Marko Signed-off-by: Richard Purdie

autoconf: Upgrade to 2.72c

2023-07-30T06:54:44+00:00

2.72c is a prerelease version of autoconf 2.73. It contains largefile and y2038 64 bit time_t improvements for 32 bit architectures. Rather than work on the older codebase, this brings us to work with the recent autoconf upstream with the 64 bit changes. It is unclear when upstream will release 2.73 but it is easier for us to be aligned now we've done the bulk of the work needed to update. Upstream added several patches which fixed several common failures OE builds ran into (backported in the next commit). In general testing has otherwise been good for us. There is an unfortunate gnulib largefile.m4 bug. This change patches various software to workaround it, next time they update new versions of the gnulib code will be pulled in which address the issue with the official fix. There are also a couple of ordering related fixes for apr and libarchive. (From OE-Core rev: bb74a03e927b4867d885ad3539b097f0e7ed108c) Signed-off-by: Richard Purdie Signed-off-by: Khem Raj Signed-off-by: Richard Purdie

libarchive: Enable acls, xattr for native as well as target

2023-04-13T12:53:44+00:00

Libarchive is being used by OPKG package manager as default API for extracting tar files. This fix allows us to extract ipks packages with preserved ACLs and xattrs. Partially addresses [YOCTO #15091] [RP: Merge into main PACKAGECONFIG and tweak commit message] (From OE-Core rev: 913aad1ac013368aef8f6af332588ef24bba46bd) Signed-off-by: Piotr Łobacz Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

libarchive: upgrade 3.6.1 -> 3.6.2

2022-12-28T23:59:56+00:00

Use --without-iconv as otherwise autotools write a bogus iconv dependency into .pc file. (From OE-Core rev: edce1bce81fe2f47fb2c5e2b94ebda73f95cbaea) Signed-off-by: Alexander Kanavin Signed-off-by: Richard Purdie