Received: by mail.netbsd.org (Postfix, from userid 605) id 40C2184F8F; Wed, 24 Aug 2022 06:58:16 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by mail.netbsd.org (Postfix) with ESMTP id 7A59384F8D for ; Wed, 24 Aug 2022 06:58:15 +0000 (UTC) X-Virus-Scanned: amavisd-new at netbsd.org Received: from mail.netbsd.org ([IPv6:::1]) by localhost (mail.netbsd.org [IPv6:::1]) (amavisd-new, port 10025) with ESMTP id Ck7BbpepE5nD for ; Wed, 24 Aug 2022 06:58:14 +0000 (UTC) Received: from cvs.NetBSD.org (ivanova.NetBSD.org [IPv6:2001:470:a085:999:28c:faff:fe03:5984]) by mail.netbsd.org (Postfix) with ESMTP id 2AB1284C71 for ; Wed, 24 Aug 2022 06:58:14 +0000 (UTC) Received: by cvs.NetBSD.org (Postfix, from userid 500) id 1E700FB1A; Wed, 24 Aug 2022 06:58:14 +0000 (UTC) Content-Transfer-Encoding: 7bit Content-Type: multipart/mixed; boundary="_----------=_1661324294166260" MIME-Version: 1.0 Date: Wed, 24 Aug 2022 06:58:14 +0000 From: "Adam Ciarcinski" Subject: CVS commit: pkgsrc/archivers/xz To: pkgsrc-changes@NetBSD.org Reply-To: adam@netbsd.org X-Mailer: log_accum Message-Id: <20220824065814.1E700FB1A@cvs.NetBSD.org> Sender: pkgsrc-changes-owner@NetBSD.org List-Id: Precedence: bulk List-Unsubscribe: This is a multi-part message in MIME format. --_----------=_1661324294166260 Content-Disposition: inline Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset="US-ASCII" Module Name: pkgsrc Committed By: adam Date: Wed Aug 24 06:58:14 UTC 2022 Modified Files: pkgsrc/archivers/xz: Makefile PLIST builtin.mk distinfo Log Message: xz: updated to 5.2.6 5.2.6 (2022-08-12) * xz: - The --keep option now accepts symlinks, hardlinks, and setuid, setgid, and sticky files. Previously this required using --force. - When copying metadata from the source file to the destination file, don't try to set the group (GID) if it is already set correctly. This avoids a failure on OpenBSD (and possibly on a few other OSes) where files may get created so that their group doesn't belong to the user, and fchown(2) can fail even if it needs to do nothing. - Cap --memlimit-compress to 2000 MiB instead of 4020 MiB on MIPS32 because on MIPS32 userspace processes are limited to 2 GiB of address space. * liblzma: - Fixed a missing error-check in the threaded encoder. If a small memory allocation fails, a .xz file with an invalid Index field would be created. Decompressing such a file would produce the correct output but result in an error at the end. Thus this is a "mild" data corruption bug. Note that while a failed memory allocation can trigger the bug, it cannot cause invalid memory access. - The decoder for .lzma files now supports files that have uncompressed size stored in the header and still use the end of payload marker (end of stream marker) at the end of the LZMA stream. Such files are rare but, according to the documentation in LZMA SDK, they are valid. doc/lzma-file-format.txt was updated too. - Improved 32-bit x86 assembly files: * Support Intel Control-flow Enforcement Technology (CET) * Use non-executable stack on FreeBSD. - Visual Studio: Use non-standard _MSVC_LANG to detect C++ standard version in the lzma.h API header. It's used to detect when "noexcept" can be used. * xzgrep: - Fixed arbitrary command injection via a malicious filename (CVE-2022-1271, ZDI-CAN-16587). A standalone patch for this was released to the public on 2022-04-07. A slight robustness improvement has been made since then and, if using GNU or *BSD grep, a new faster method is now used that doesn't use the old sed-based construct at all. This also fixes bad output with GNU grep >= 3.5 (2020-09-27) when xzgrepping binary files. This vulnerability was discovered by: cleemy desu wayo working with Trend Micro Zero Day Initiative - Fixed detection of corrupt .bz2 files. - Improved error handling to fix exit status in some situations and to fix handling of signals: in some situations a signal didn't make xzgrep exit when it clearly should have. It's possible that the signal handling still isn't quite perfect but hopefully it's good enough. - Documented exit statuses on the man page. - xzegrep and xzfgrep now use "grep -E" and "grep -F" instead of the deprecated egrep and fgrep commands. - Fixed parsing of the options -E, -F, -G, -P, and -X. The problem occurred when multiple options were specied in a single argument, for example, echo foo | xzgrep -Fe foo treated foo as a filename because -Fe wasn't correctly split into -F -e. - Added zstd support. * xzdiff/xzcmp: - Fixed wrong exit status. Exit status could be 2 when the correct value is 1. - Documented on the man page that exit status of 2 is used for decompression errors. - Added zstd support. * xzless: - Fix less(1) version detection. It failed if the version number from "less -V" contained a dot. * Translations: - Added new translations: Catalan, Croatian, Esperanto, Korean, Portuguese, Romanian, Serbian, Spanish, Swedish, and Ukrainian - Updated the Brazilian Portuguese translation. - Added French man page translation. This and the existing German translation aren't complete anymore because the English man pages got a few updates and the translators weren't reached so that they could update their work. * Build systems: - Windows: Fix building of resource files when config.h isn't used. CMake + Visual Studio can now build liblzma.dll. - Various fixes to the CMake support. Building static or shared liblzma should work fine in most cases. In contrast, building the command line tools with CMake is still clearly incomplete and experimental and should be used for testing only. To generate a diff of this commit: cvs rdiff -u -r1.30 -r1.31 pkgsrc/archivers/xz/Makefile cvs rdiff -u -r1.10 -r1.11 pkgsrc/archivers/xz/PLIST cvs rdiff -u -r1.8 -r1.9 pkgsrc/archivers/xz/builtin.mk cvs rdiff -u -r1.22 -r1.23 pkgsrc/archivers/xz/distinfo Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files. --_----------=_1661324294166260 Content-Disposition: inline Content-Length: 7813 Content-Transfer-Encoding: binary Content-Type: text/x-diff; charset=us-ascii Modified files: Index: pkgsrc/archivers/xz/Makefile diff -u pkgsrc/archivers/xz/Makefile:1.30 pkgsrc/archivers/xz/Makefile:1.31 --- pkgsrc/archivers/xz/Makefile:1.30 Fri Apr 8 06:29:56 2022 +++ pkgsrc/archivers/xz/Makefile Wed Aug 24 06:58:13 2022 @@ -1,15 +1,10 @@ -# $NetBSD: Makefile,v 1.30 2022/04/08 06:29:56 wiz Exp $ +# $NetBSD: Makefile,v 1.31 2022/08/24 06:58:13 adam Exp $ -DISTNAME= xz-5.2.5 -PKGREVISION= 1 +DISTNAME= xz-5.2.6 CATEGORIES= archivers MASTER_SITES= https://tukaani.org/xz/ EXTRACT_SUFX= .tar.bz2 -PATCH_SITES= https://tukaani.org/xz/ -PATCHFILES= xzgrep-ZDI-CAN-16587.patch -PATCH_DIST_STRIP= -p1 - MAINTAINER= pkgsrc-users@NetBSD.org HOMEPAGE= https://tukaani.org/xz/ COMMENT= General-purpose data compression software @@ -18,7 +13,6 @@ LICENSE= public-domain AND gnu-gpl-v2 USE_LIBTOOL= yes GNU_CONFIGURE= yes PKGCONFIG_OVERRIDE= src/liblzma/liblzma.pc.in - TEST_TARGET= check CONFLICTS= lzma-[0-9]* lzma-utils-[0-9]* lzmalib-[0-9]* Index: pkgsrc/archivers/xz/PLIST diff -u pkgsrc/archivers/xz/PLIST:1.10 pkgsrc/archivers/xz/PLIST:1.11 --- pkgsrc/archivers/xz/PLIST:1.10 Sun May 3 10:10:44 2020 +++ pkgsrc/archivers/xz/PLIST Wed Aug 24 06:58:13 2022 @@ -1,4 +1,4 @@ -@comment $NetBSD: PLIST,v 1.10 2020/05/03 10:10:44 adam Exp $ +@comment $NetBSD: PLIST,v 1.11 2022/08/24 06:58:13 adam Exp $ bin/lzcat bin/lzcmp bin/lzdiff @@ -42,9 +42,6 @@ lib/pkgconfig/liblzma.pc ${PLIST.nls}man/de/man1/lzcat.1 ${PLIST.nls}man/de/man1/lzcmp.1 ${PLIST.nls}man/de/man1/lzdiff.1 -${PLIST.nls}man/de/man1/lzegrep.1 -${PLIST.nls}man/de/man1/lzfgrep.1 -${PLIST.nls}man/de/man1/lzgrep.1 ${PLIST.nls}man/de/man1/lzless.1 ${PLIST.nls}man/de/man1/lzma.1 ${PLIST.nls}man/de/man1/lzmadec.1 @@ -56,11 +53,24 @@ ${PLIST.nls}man/de/man1/xzcat.1 ${PLIST.nls}man/de/man1/xzcmp.1 ${PLIST.nls}man/de/man1/xzdec.1 ${PLIST.nls}man/de/man1/xzdiff.1 -${PLIST.nls}man/de/man1/xzegrep.1 -${PLIST.nls}man/de/man1/xzfgrep.1 -${PLIST.nls}man/de/man1/xzgrep.1 ${PLIST.nls}man/de/man1/xzless.1 ${PLIST.nls}man/de/man1/xzmore.1 +${PLIST.nls}man/fr_FR/man1/lzcat.1 +${PLIST.nls}man/fr_FR/man1/lzcmp.1 +${PLIST.nls}man/fr_FR/man1/lzdiff.1 +${PLIST.nls}man/fr_FR/man1/lzless.1 +${PLIST.nls}man/fr_FR/man1/lzma.1 +${PLIST.nls}man/fr_FR/man1/lzmadec.1 +${PLIST.nls}man/fr_FR/man1/lzmore.1 +${PLIST.nls}man/fr_FR/man1/unlzma.1 +${PLIST.nls}man/fr_FR/man1/unxz.1 +${PLIST.nls}man/fr_FR/man1/xz.1 +${PLIST.nls}man/fr_FR/man1/xzcat.1 +${PLIST.nls}man/fr_FR/man1/xzcmp.1 +${PLIST.nls}man/fr_FR/man1/xzdec.1 +${PLIST.nls}man/fr_FR/man1/xzdiff.1 +${PLIST.nls}man/fr_FR/man1/xzless.1 +${PLIST.nls}man/fr_FR/man1/xzmore.1 man/man1/lzcat.1 man/man1/lzcmp.1 man/man1/lzdiff.1 @@ -103,15 +113,25 @@ share/doc/xz/faq.txt share/doc/xz/history.txt share/doc/xz/lzma-file-format.txt share/doc/xz/xz-file-format.txt +${PLIST.nls}share/locale/ca/LC_MESSAGES/xz.mo ${PLIST.nls}share/locale/cs/LC_MESSAGES/xz.mo ${PLIST.nls}share/locale/da/LC_MESSAGES/xz.mo ${PLIST.nls}share/locale/de/LC_MESSAGES/xz.mo +${PLIST.nls}share/locale/eo/LC_MESSAGES/xz.mo +${PLIST.nls}share/locale/es/LC_MESSAGES/xz.mo ${PLIST.nls}share/locale/fi/LC_MESSAGES/xz.mo ${PLIST.nls}share/locale/fr/LC_MESSAGES/xz.mo +${PLIST.nls}share/locale/hr/LC_MESSAGES/xz.mo ${PLIST.nls}share/locale/hu/LC_MESSAGES/xz.mo ${PLIST.nls}share/locale/it/LC_MESSAGES/xz.mo +${PLIST.nls}share/locale/ko/LC_MESSAGES/xz.mo ${PLIST.nls}share/locale/pl/LC_MESSAGES/xz.mo +${PLIST.nls}share/locale/pt/LC_MESSAGES/xz.mo ${PLIST.nls}share/locale/pt_BR/LC_MESSAGES/xz.mo +${PLIST.nls}share/locale/ro/LC_MESSAGES/xz.mo +${PLIST.nls}share/locale/sr/LC_MESSAGES/xz.mo +${PLIST.nls}share/locale/sv/LC_MESSAGES/xz.mo +${PLIST.nls}share/locale/uk/LC_MESSAGES/xz.mo ${PLIST.nls}share/locale/vi/LC_MESSAGES/xz.mo ${PLIST.nls}share/locale/zh_CN/LC_MESSAGES/xz.mo ${PLIST.nls}share/locale/zh_TW/LC_MESSAGES/xz.mo Index: pkgsrc/archivers/xz/builtin.mk diff -u pkgsrc/archivers/xz/builtin.mk:1.8 pkgsrc/archivers/xz/builtin.mk:1.9 --- pkgsrc/archivers/xz/builtin.mk:1.8 Fri Jul 22 16:06:34 2022 +++ pkgsrc/archivers/xz/builtin.mk Wed Aug 24 06:58:13 2022 @@ -1,4 +1,4 @@ -# $NetBSD: builtin.mk,v 1.8 2022/07/22 16:06:34 wiz Exp $ +# $NetBSD: builtin.mk,v 1.9 2022/08/24 06:58:13 adam Exp $ BUILTIN_PKG:= xz @@ -25,8 +25,7 @@ MAKEVARS+= IS_BUILTIN.xz ### If there is a built-in implementation, then set BUILTIN_PKG. to ### a package name to represent the built-in package. ### -.if !defined(BUILTIN_PKG.xz) && \ - !empty(IS_BUILTIN.xz:M[yY][eE][sS]) +.if !defined(BUILTIN_PKG.xz) && ${IS_BUILTIN.xz:M[yY][eE][sS]} BUILTIN_VERSION.xz!= \ ${AWK} 'BEGIN { M = "0" } \ /\#define[ ]+LZMA_VERSION_MAJOR/ { M = $$3 } \ @@ -53,13 +52,12 @@ MAKEVARS+= BUILTIN_PKG.xz USE_BUILTIN.xz= no . else USE_BUILTIN.xz= ${IS_BUILTIN.xz} -. if defined(BUILTIN_PKG.xz) && \ - !empty(IS_BUILTIN.xz:M[yY][eE][sS]) +. if defined(BUILTIN_PKG.xz) && ${IS_BUILTIN.xz:M[yY][eE][sS]} USE_BUILTIN.xz= yes . for _dep_ in ${BUILDLINK_API_DEPENDS.xz} -. if !empty(USE_BUILTIN.xz:M[yY][eE][sS]) +. if ${USE_BUILTIN.xz:M[yY][eE][sS]} USE_BUILTIN.xz!= \ - if ${PKG_ADMIN} pmatch ${_dep_:Q} ${BUILTIN_PKG.xz:Q}; then \ + if ${PKG_ADMIN} pmatch ${_dep_:Q} ${BUILTIN_PKG.xz}; then \ ${ECHO} yes; \ else \ ${ECHO} no; \ @@ -81,7 +79,7 @@ MAKEVARS+= USE_BUILTIN.xz # implementation. # .if defined(USE_XZ) -. if !empty(IS_BUILTIN.xz:M[nN][oO]) +. if ${IS_BUILTIN.xz:M[nN][oO]} USE_BUILTIN.xz= no . endif .endif @@ -92,15 +90,15 @@ USE_BUILTIN.xz= no ### CHECK_BUILTIN.xz?= no -.if !empty(CHECK_BUILTIN.xz:M[nN][oO]) +.if ${CHECK_BUILTIN.xz:M[nN][oO]} -. if !empty(USE_BUILTIN.xz:M[yY][eE][sS]) +. if ${USE_BUILTIN.xz:M[yY][eE][sS]} BUILDLINK_FILES.xz+= lib/pkgconfig/liblzma.pc . endif # Fake pkg-config for builtin xz on NetBSD -. if !empty(USE_BUILTIN.xz:M[yY][eE][sS]) +. if ${USE_BUILTIN.xz:M[yY][eE][sS]} . if !empty(USE_TOOLS:C/:.*//:Mpkg-config) do-configure-pre-hook: override-liblzma-pkgconfig @@ -114,7 +112,7 @@ override-message-liblzma-pkgconfig: override-liblzma-pkgconfig: ${RUN} \ dst=${BLKDIR_PKGCFG}/${LIBLZMA_PKGCFGF}; \ - src=${BUILDLINK_PREFIX.xz:Q}/lib${LIBABISUFFIX}/pkgconfig/liblzma.pc; \ + src=${BUILDLINK_PREFIX.xz}/lib${LIBABISUFFIX}/pkgconfig/liblzma.pc; \ if [ ! -f $${dst} ]; then \ if [ -f $${src} ]; then \ ${ECHO_BUILDLINK_MSG} "Symlinking $${src}"; \ Index: pkgsrc/archivers/xz/distinfo diff -u pkgsrc/archivers/xz/distinfo:1.22 pkgsrc/archivers/xz/distinfo:1.23 --- pkgsrc/archivers/xz/distinfo:1.22 Fri Apr 8 06:29:56 2022 +++ pkgsrc/archivers/xz/distinfo Wed Aug 24 06:58:13 2022 @@ -1,9 +1,6 @@ -$NetBSD: distinfo,v 1.22 2022/04/08 06:29:56 wiz Exp $ +$NetBSD: distinfo,v 1.23 2022/08/24 06:58:13 adam Exp $ -BLAKE2s (xz-5.2.5.tar.bz2) = 0734b879a0da3d0a893428c0783bbd38cf22b2c4dbe9125bb9962961573c8e66 -SHA512 (xz-5.2.5.tar.bz2) = 89e25ddf72427ee9608cbf2e9dbc24d592cb67a27f44ccf7d47e4d9405774444e9cfcd02ac4bcb92064860371ed31d3cfbecd5fe063f296ead607714c0a664a1 -Size (xz-5.2.5.tar.bz2) = 1473322 bytes -BLAKE2s (xzgrep-ZDI-CAN-16587.patch) = 73d70cf735d08be52703ff2dfda48323105381a0a186df98ba2e6cc75e265fa1 -SHA512 (xzgrep-ZDI-CAN-16587.patch) = 52b16268e333399444f433a11ccf3a9b020a6914ed23fc8e082128fec596011d7c6863d47414d4c0f245d20ebed4b3a50b422599b4b88d66f6c6eb2e74b9a939 -Size (xzgrep-ZDI-CAN-16587.patch) = 3488 bytes +BLAKE2s (xz-5.2.6.tar.bz2) = 065f16f168e8b385699c77b61ee88a68fbd7ba4c38db98df1d5ccf09533f58cc +SHA512 (xz-5.2.6.tar.bz2) = 5b3e314c3d2ba9a1529c4007bfebf1f3d9bdb7007d79c36c1662dea8583fa869938309e26ff0cdd5e5d423f24b45c6c158b1e168a6b54770d69de339e8dbb76c +Size (xz-5.2.6.tar.bz2) = 1658182 bytes SHA1 (patch-src_xz_Makefile.in) = b9360c7b2b34159028fb8b84339aa2faf3922287 --_----------=_1661324294166260--