linux/poky.git/meta/recipes-extended/xz, branch yocto-4.0.5

xz: update 5.2.5 -> 5.2.6

2022-08-31T15:54:17+00:00

5.2.6 (2022-08-12) * xz: - The --keep option now accepts symlinks, hardlinks, and setuid, setgid, and sticky files. Previously this required using --force. - When copying metadata from the source file to the destination file, don't try to set the group (GID) if it is already set correctly. This avoids a failure on OpenBSD (and possibly on a few other OSes) where files may get created so that their group doesn't belong to the user, and fchown(2) can fail even if it needs to do nothing. - Cap --memlimit-compress to 2000 MiB instead of 4020 MiB on MIPS32 because on MIPS32 userspace processes are limited to 2 GiB of address space. * liblzma: - Fixed a missing error-check in the threaded encoder. If a small memory allocation fails, a .xz file with an invalid Index field would be created. Decompressing such a file would produce the correct output but result in an error at the end. Thus this is a "mild" data corruption bug. Note that while a failed memory allocation can trigger the bug, it cannot cause invalid memory access. - The decoder for .lzma files now supports files that have uncompressed size stored in the header and still use the end of payload marker (end of stream marker) at the end of the LZMA stream. Such files are rare but, according to the documentation in LZMA SDK, they are valid. doc/lzma-file-format.txt was updated too. - Improved 32-bit x86 assembly files: * Support Intel Control-flow Enforcement Technology (CET) * Use non-executable stack on FreeBSD. - Visual Studio: Use non-standard _MSVC_LANG to detect C++ standard version in the lzma.h API header. It's used to detect when "noexcept" can be used. * xzgrep: - Fixed arbitrary command injection via a malicious filename (CVE-2022-1271, ZDI-CAN-16587). A standalone patch for this was released to the public on 2022-04-07. A slight robustness improvement has been made since then and, if using GNU or *BSD grep, a new faster method is now used that doesn't use the old sed-based construct at all. This also fixes bad output with GNU grep >= 3.5 (2020-09-27) when xzgrepping binary files. This vulnerability was discovered by: cleemy desu wayo working with Trend Micro Zero Day Initiative - Fixed detection of corrupt .bz2 files. - Improved error handling to fix exit status in some situations and to fix handling of signals: in some situations a signal didn't make xzgrep exit when it clearly should have. It's possible that the signal handling still isn't quite perfect but hopefully it's good enough. - Documented exit statuses on the man page. - xzegrep and xzfgrep now use "grep -E" and "grep -F" instead of the deprecated egrep and fgrep commands. - Fixed parsing of the options -E, -F, -G, -P, and -X. The problem occurred when multiple options were specied in a single argument, for example, echo foo | xzgrep -Fe foo treated foo as a filename because -Fe wasn't correctly split into -F -e. - Added zstd support. * xzdiff/xzcmp: - Fixed wrong exit status. Exit status could be 2 when the correct value is 1. - Documented on the man page that exit status of 2 is used for decompression errors. - Added zstd support. * xzless: - Fix less(1) version detection. It failed if the version number from "less -V" contained a dot. * Translations: - Added new translations: Catalan, Croatian, Esperanto, Korean, Portuguese, Romanian, Serbian, Spanish, Swedish, and Ukrainian - Updated the Brazilian Portuguese translation. - Added French man page translation. This and the existing German translation aren't complete anymore because the English man pages got a few updates and the translators weren't reached so that they could update their work. * Build systems: - Windows: Fix building of resource files when config.h isn't used. CMake + Visual Studio can now build liblzma.dll. - Various fixes to the CMake support. Building static or shared liblzma should work fine in most cases. In contrast, building the command line tools with CMake is still clearly incomplete and experimental and should be used for testing only. (From OE-Core rev: b2af2fd0dbb3edac0257adc4edfa9bcab4941f92) Signed-off-by: Alexander Kanavin Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie (cherry picked from commit 7e3782f4d66973cb7ab922d4bbc6ef6241756ed2) Signed-off-by: Steve Sakoman Signed-off-by: Richard Purdie

xz: fix CVE-2022-1271

2022-04-10T07:31:17+00:00

Malicious filenames can make xzgrep to write to arbitrary files or (with a GNU sed extension) lead to arbitrary code execution. Upstream-Status: Backport [https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch] CVE: CVE-2022-1271 (From OE-Core rev: 97bf86ccde4417daec8ef3945071a50a09134bc6) Signed-off-by: Ralph Siemsen Signed-off-by: Richard Purdie

meta, meta-selftest: Replace more non-SPDX license identifiers

2022-03-01T23:44:59+00:00

In commit ceda3238 (meta/meta-selftest/meta-skeleton: Update LICENSE variable to use SPDX license identifiers) all LICENSE variables were updated to only use SPDX license identifiers. This does the same for comments and other variables where it is appropriate to use the official SPDX license identifiers. There are still references to, e.g., "GPLv3", but they are then typically in descriptive text where they refer to the license in a generic sense. (From OE-Core rev: 165759dced7fbe73b1db2ede67047896071dc6d0) Signed-off-by: Peter Kjellerstedt Signed-off-by: Richard Purdie

meta/meta-selftest/meta-skeleton: Update LICENSE variable to use SPDX license identifiers

2022-02-20T16:45:25+00:00

An automated conversion using scripts/contrib/convert-spdx-licenses.py to convert to use the standard SPDX license identifiers. Two recipes in meta-selftest were not converted as they're that way specifically for testing. A change in linux-firmware was also skipped and may need a more manual tweak. (From OE-Core rev: ceda3238cdbf1beb216ae9ddb242470d5dfc25e0) Signed-off-by: Richard Purdie

Convert to new override syntax

2021-08-02T14:44:10+00:00

This is the result of automated script conversion: scripts/contrib/convert-overrides.py converting the metadata to use ":" as the override character instead of "_". (From OE-Core rev: 42344347be29f0997cc2f7636d9603b1fe1875ae) Signed-off-by: Richard Purdie

meta/recipes-extended: Add HOMEPAGE / DESCRIPTION

2021-03-06T22:39:04+00:00

Added HOMEPAGE and DESCRIPTION for recipes with missing decriptions or homepage [YOCTO #13471] (From OE-Core rev: cc6c7af900ae0196a62b7fa1375c55bbcd8e68b4) Signed-off-by: Dorinda Bassey Signed-off-by: Richard Purdie

xz: upgrade 5.2.4 -> 5.2.5

2020-05-19T21:57:27+00:00

(From OE-Core rev: 39a68420e3af58b3b57a7046709e83408f39205e) Signed-off-by: Denys Dmytriyenko Signed-off-by: Richard Purdie

xz: Fix shell after autotools changes

2020-01-28T11:11:20+00:00

After changing autotools.bbclass, CONFIG_SHELL setting no longer works resulting in: xz-5.2.4-r0 do_package_qa: QA Issue: /usr/bin/xzmore contained in package xz requires /bin/bash, but no providers found in RDEPENDS_xz? [file-rdeps] The script can use /bin/sh so set this specifically. (From OE-Core rev: 790be4ace4da2e2d7597d4e8ccf75ed7f711184d) Signed-off-by: Richard Purdie

recipes: change SRC_URI to use https

2019-12-06T14:41:28+00:00

Change all recipes to https where we get an http 301 permanent redirect. (From OE-Core rev: e514acda9e12bccde6d3974e0fd1a37b3837191a) Signed-off-by: Stefan Müller-Klieser Signed-off-by: Richard Purdie

xz: upgrade 5.2.3 -> 5.2.4

2018-07-24T10:52:26+00:00

(From OE-Core rev: 0529b8c88a2cd6c21737023d757f44eebc5a0547) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie