build.opensuse.org Open in urlscan Pro
2a07:de40:b250:131:10:151:131:20  Public Scan

URL: https://build.opensuse.org/request/show/1163302
Submission: On March 30 via api from IN — Scanned from DE

Form analysis 2 forms found in the DOM

GET /search?name=1&package=1&project=1

<form class="my-auto" action="/search?name=1&amp;package=1&amp;project=1" accept-charset="UTF-8" method="get"><input aria-label="Search" class="form-control w-100" name="search_text" placeholder="Search" type="text">
</form>

POST https://build.opensuse.org/ICSLogin/auth-up

<form enctype="application/x-www-form-urlencoded" action="https://build.opensuse.org/ICSLogin/auth-up" accept-charset="UTF-8" method="post"><input type="hidden" name="authenticity_token"
    value="muwmKhn__h9a3_V9USD858rcqFSu0FmAaAIlKG1u07cpc9O2xu2oIQs0_M3sF2qudPfVb2PhF8HNG5JGGTl7Vg" autocomplete="off"><input type="hidden" name="context" id="context" value="default" autocomplete="off">
  <input type="hidden" name="proxypath" id="proxypath" value="reserve" autocomplete="off">
  <input type="hidden" name="message" id="message" value="Please log in" autocomplete="off">
  <div class="mb-3">
    <input type="text" name="username" id="username" required="required" class="form-control" placeholder="Username">
  </div>
  <div class="mb-3">
    <input type="password" name="password" id="password" required="required" class="form-control" placeholder="Password">
  </div>
  <div class="clearfix">
    <input type="submit" name="commit" value="Log In" class="btn btn-success w-100" data-disable-with="Log In">
  </div>
</form>

Text Content

Sign Up
Log In
Log In


--------------------------------------------------------------------------------

or
Sign Up

PLACES

 * All Projects
 * Status Monitor

 * Collapse sidebar

 1. Request 1163302

OVERVIEW


REQUEST 1163302 ACCEPTED

downgrade

 * Created by msmeissn 2 days ago
 * In state accepted

 * Submit xz

Loading...
Submit package Base:System / xz to package openSUSE:Factory / xz

--------------------------------------------------------------------------------

Expand all Collapse all
View file
xz.changes Changed

  1@@ -1,101 +1,4 @@
  2 -------------------------------------------------------------------
  3-Sun Mar 10 11:43:13 UTC 2024 - Andreas Stieger <andreas.stieger@gmx.de>
  4-
  5-- update to 5.6.1:
  6-  * liblzma: Fix start-up crashes with -fprofile-generate
  7-  * liblzma: Fix false positive invalid write Valgrind report
  8-  * xz: Change the messages for thread reduction due to memory
  9-    constraints to only appear under the highest verbosity level
 10-
 11--------------------------------------------------------------------
 12-Tue Mar  5 11:25:55 UTC 2024 - Dirk Müller <dmueller@suse.com>
 13-
 14-- update to 5.6.0:
 15-  * This bumps the minor version of liblzma because new
 16-    features were added. The API and ABI are still backward
 17-    compatible with liblzma 5.4.x and 5.2.x and 5.0.x.
 18-  * liblzma:
 19-    - Disabled the branchless C variant in the LZMA
 20-    decoder based on the benchmark results from the community.
 21-    - Disabled x86-64 inline assembly on x32 to fix the
 22-    build.
 23-  * Sandboxing support in xz:
 24-    - Landlock is now used even when xz needs to create
 25-    files.
 26-    - Landlock and pledge(2) are now stricter when
 27-    reading from more than one input file and only writing to
 28-    standard output.
 29-    - Added support for Landlock ABI version 4.
 30-    - Now builds lzmainfo and lzmadec.
 31-    - xzdiff, xzgrep, xzless, xzmore, and their symlinks
 32-    are now installed. The scripts are also tested during "make
 33-    test".
 34-    - Added translation support for xz, lzmainfo, and the
 35-      man pages.
 36-    - Minimum required CMake version is now 3.14.
 37-  * liblzma:
 38-    - LZMA decoder: Speed optimizations to the C code and
 39-    added GCC & Clang compatible inline assembly for
 40-    x86-64.
 41-    - Added lzma_mt_block_size() to recommend a Block
 42-    size for multithreaded encoding.
 43-    - Added CLMUL-based CRC32 on x86-64 and E2K with
 44-    runtime processor detection. Similar to CRC64, on 32-bit
 45-    x86 it isn't available unless --disable-assembler is used.
 46-    - Optimized the CRC32 calculation on ARM64 platforms
 47-    using the CRC32 instructions. Runtime detection for the
 48-    instruction is used on GNU/Linux, FreeBSD, Windows, and macOS.
 49-    - Added definitions of mask values like
 50-      LZMA_INDEX_CHECK_MASK_CRC32 to <lzma/index.h>.
 51-  * Licensing change: The core components are now under the
 52-  *  BSD Zero Clause License (0BSD). In XZ Utils 5.4.6 and
 53-    older and 5.5.1alpha these components are in the public
 54-    domain and obviously remain so; the change affects the new
 55-    releases only.
 56-  * 0BSD is an extremely permissive license which doesn't
 57-    require retaining or reproducing copyright or license notices
 58-    when distributing the code, thus in practice there is
 59-    extremely little difference to public domain.
 60-  * liblzma
 61-    - Significant speed optimizations to the LZMA decoder
 62-    were made. There are now three variants that can be
 63-    chosen at build time:
 64-  * Basic C version: This is a few percent faster than
 65-    5.4.x due to some new optimizations.
 66-  * Branchless C: This is currently the default on platforms
 67-    for which there is no assembly code. This should be a few
 68-    percent faster than the basic C version.
 69-  * x86-64 inline assembly. This works with GCC and Clang.
 70-    The default choice can currently be overridden by
 71-    setting LZMA_RANGE_DECODER_CONFIG in CPPFLAGS: 0 means the
 72-    basic version and 3 means that branchless C version.
 73-  * Added a new filter for RISC-V binaries. The filter can be
 74-    used for 32-bit and 64-bit binaries with either little or
 75-    big endianness. In liblzma, the Filter ID is
 76-    LZMA_FILTER_RISCV (0x0B)
 77-    - Implemented GNU indirect function (IFUNC) as a
 78-    runtime function dispatching method for CRC32 and CRC64
 79-    fast implementations on x86. Only GNU/Linux (glibc) and
 80-  * xz:
 81-  - Multithreaded mode is now the default. This
 82-    improves compression speed and creates .xz files that can be
 83-    decompressed multithreaded at the cost of increased
 84-    memory usage and slightly worse compression ratio.
 85-  - Added new command line option --filters to set the
 86-    filter chain using liblzma filter string syntax.
 87-  - Added new command line options --filters1 ...
 88-    --filters9 to set additional filter chains using liblzma filter
 89-    string syntax. The --block-list option now allows
 90-    specifying filter chains that were set using these new options.
 91-  - Added support for Linux Landlock as a sandboxing
 92-    method.
 93-  - xzdec now supports pledge(2), Capsicum, and Linux
 94-    Landlock as sandboxing methods.
 95-- enable y2038 mode
 96-- enable zstd compression, we no longer have bootstrap
 97-  issues as xz is no longer used
 98-
 99--------------------------------------------------------------------
100 Mon Jan 29 21:36:02 UTC 2024 - Danilo Spinella <danilo.spinella@suse.com>
101 
102 - Build static library on SLE


View file
xz.spec Changed

 1@@ -22,8 +22,9 @@
 2 %else
 3 %bcond_with static
 4 %endif
 5+%define _binary_payload w9.bzdio
 6 Name:           xz
 7-Version:        5.6.1
 8+Version:        5.4.6
 9 Release:        0
10 Summary:        A Program for Compressing Files with the Lempel–Ziv–Markov algorithm
11 License:        0BSD AND GPL-2.0-or-later AND GPL-3.0-or-later AND LGPL-2.1-or-later
12@@ -99,11 +100,6 @@
13 %if %{with static}
14 %configure \
15   --with-pic \
16-  --enable-year2038 \
17-  --enable-symbol-versions \
18-  --enable-sandbox=landlock \
19-  --enable-ifunc \
20-  --enable-external-sha256 \
21   --docdir=%{_docdir}/%{name} \
22   --disable-shared CONFIG_SHELL=/bin/sh
23 %make_build
24@@ -212,6 +208,7 @@
25 
26 %if %{with static}
27 %files static-devel
28+%defattr(-, root, root)
29 %{_libdir}/liblzma.a
30 %endif
31 


View file
xz-5.6.1.tar.gz -> xz-5.4.6.tar.gz Changed
View file
xz-5.4.6.tar.gz.sig Added
View file
xz-5.6.1.tar.gz.sig Deleted
 * Build Results
 * RPM Lint

Refresh
Show 8 excluded/disabled results

XZ

openSUSE_Factory
armv7l
succeeded

Package has built successfully and can be used to build further packages.

Build jobs exist for the repository
ppc64le
succeeded

Package has built successfully and can be used to build further packages.

Build jobs exist for the repository
riscv64
succeeded

Package has built successfully and can be used to build further packages.

Build jobs exist for the repository
s390x
succeeded

Package has built successfully and can be used to build further packages.

Build jobs exist for the repository
x86_64
succeeded

Package has built successfully and can be used to build further packages.

Build jobs exist for the repository
aarch64
succeeded

Package has built successfully and can be used to build further packages.

Build jobs exist for the repository
openSUSE_Tumbleweed
i586
succeeded

Package has built successfully and can be used to build further packages.

Repository has been published
x86_64
succeeded

Package has built successfully and can be used to build further packages.

Repository has been published
aarch64
succeeded

Package has built successfully and can be used to build further packages.

Repository has been published
Refresh
15.5 15.6 openSUSE_Factory openSUSE_Tumbleweed aarch64 x86_64 i586 aarch64
x86_64 s390x riscv64 ppc64le armv7l ppc64le aarch64 s390x x86_64 ppc64le x86_64
s390x aarch64

No rpmlint log

 * Comments for request 1163302 2

--------------------------------------------------------------------------------

Andreas Schneider (gladiac) - about 8 hours ago


@msmeissn are you sure that that code doesn't have any other backdoors. The bad
actor already released version 5.4 and signed it! I think you have to go further
back.

--------------------------------------------------------------------------------

Andreas Schneider (gladiac) - about 2 hours ago


https://tukaani.org/xz-backdoor/

Login required, please login in order to comment

REQUEST HISTORY

msmeissn created request 2 days ago

downgrade

--------------------------------------------------------------------------------

factory-auto added opensuse-review-team as a reviewer 2 days ago

Please review sources

--------------------------------------------------------------------------------

factory-auto accepted review 2 days ago

Check script succeeded

--------------------------------------------------------------------------------

dimstar_suse accepted review 2 days ago

skiptit - rapid action

--------------------------------------------------------------------------------

dimstar accepted review 2 days ago

--------------------------------------------------------------------------------

licensedigger accepted review 2 days ago

ok

--------------------------------------------------------------------------------

licensedigger approved review 2 days ago

ok

--------------------------------------------------------------------------------

anag+factory accepted request 2 days ago

OK

PACKAGE MAINTAINERS

OK
Locations
 * Projects
 * Search
 * Status Monitor

Help
 * OpenBuildService.org
 * Documentation
 * API Documentation
 * Code of Conduct

Contact
 * Support
 * @OBShq
 * Terms

openSUSE Build Service is sponsored by


The Open Build Service is an openSUSE project.

 * Sign Up
 * Log In
 * Places

PLACES

 * All Projects
 * Status Monitor