CVS commit: pkgsrc/archivers/xz

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Oct  2 17:58:29 UTC 2024

Modified Files:
        pkgsrc/archivers/xz: Makefile distinfo

Log Message:
xz: updated to 5.6.3

5.6.3 (2024-10-01)

IMPORTANT: This includes a Windows-specific security fix to
the command line tools. liblzma isn't affected by this issue.

* liblzma:

    - Fix x86-64 inline assembly compatibility with GNU Binutils
      older than 2.27.

    - Fix the build with GCC 4.2 on OpenBSD/sparc64.

* xzdec: Display an error instead of failing silently if the
  unsupported option -M is specified.

* lzmainfo: Fix integer overflows when rounding the dictionary and
  uncompressed sizes to the nearest mebibyte.

* Windows (except Cygwin and MSYS2): Add an application manifest to
  xz, xzdec, lzmadec, and lzmainfo executables:

    - Declare them compatible with Vista/7/8/8.1/10/11. This way
      the programs won't needlessly use Operating System Context
      of Vista when running on later Windows versions. This setting
      doesn't mean that the executables cannot run on even older
      versions if otherwise built that way.

    - Declare them as UAC-compliant. MSVC added this by default
      already but it wasn't done with MinGW-w64, at least not
      with all toolchain variants.

    - Declare them long path aware. This makes long path names
      work on Windows 10 and 11 if the feature has been enabled
      in the Windows registry.

    - Use the UTF-8 code page on Windows 10 version 1903 and later.

        * Now command line tools can access files whose names
          contain characters that don't exist in the current
          legacy code page.

        * The options --files and --files0 now expect file lists
          to be in UTF-8 instead of the legacy code page.

        * This fixes a security issue: If a command line contains
          Unicode characters (for example, filenames) that don't
          exist in the current legacy code page, the characters are
          converted to similar-looking characters with best-fit
          mapping. Some best-fit mappings result in ASCII
          characters that change the meaning of the command line,
          which can be exploited with malicious filenames to do
          argument injection or directory traversal attacks.
          UTF-8 avoids best-fit mappings and thus fixes the issue.

          Forcing the process code page to UTF-8 is possible only
          on Windows 10 version 1903 and later. The command line
          tools remain vulnerable if used on an old older
          version of Windows.

          This issue was discovered by Orange Tsai and splitline
          from DEVCORE Research Team.

          A related smaller issue remains: Windows filenames may
          contain unpaired surrogates (invalid UTF-16). These are
          converted to the replacement character U+FFFD in the
          UTF-8 code page. Thus, filenames with different unpaired
          surrogates appear identical and aren't distinguishable
          from filenames that contain the actual replacement
          character U+FFFD.

        * When building with MinGW-w64, it is recommended to use
          UCRT version instead of the old MSVCRT. For example,
          non-ASCII characters from filenames won't print
          correctly in messages to console with MSVCRT with
          the UTF-8 code page (a cosmetic issue). liblzma-only
          builds are still fine with MSVCRT.

    - Cygwin and MSYS2 process command line options differently and
      the above issues don't exist. There is no need to replace the
      default application manifest on Cygwin and MSYS2.

* Autotools-based build:

    - Fix feature checks with link-time optimization (-flto).

    - Solaris: Fix a compatibility issue in version.sh. It matters
      if one wants to regenerate configure by running autoconf.

* CMake:

    - Use paths relative to ${prefix} in liblzma.pc when possible.
      This is done only with CMake >= 3.20.

    - MSVC: Install liblzma.pc as it can be useful with MSVC too.

    - Windows: Fix liblzma filename prefix, for example:

        * Cygwin: The DLL was incorrectly named liblzma-5.dll.
          Now it is cyglzma-5.dll.

        * MSVC: Rename import library from liblzma.lib to lzma.lib
          while keeping liblzma.dll name as is. This helps with
          "pkgconf --msvc-syntax --libs liblzma" because it mungles
          "-llzma" in liblzma.pc to "lzma.lib".

        * MinGW-w64: No changes.

    - Windows: Use the correct resource file for lzmadec.exe.
      Previously the resource file for xzdec.exe was used for both.
      Autotools-based build isn't affected.

    - Prefer a C11 compiler over a C99 compiler but accept both.

    - Link Threads::Threads against liblzma using PRIVATE so that
      -pthread and such flags won't unnecessarily get included in
      the usage requirements of shared liblzma. That is,
      target_link_libraries(foo PRIVATE liblzma::liblzma) no
      longer adds -pthread if using POSIX threads and linking
      against shared liblzma. The threading flags are still added
      if linking against static liblzma.

* Updated translations: Catalan, Chinese (simplified), and
  Brazilian Portuguese.


To generate a diff of this commit:
cvs rdiff -u -r1.50 -r1.51 pkgsrc/archivers/xz/Makefile
cvs rdiff -u -r1.37 -r1.38 pkgsrc/archivers/xz/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/archivers/xz/Makefile
diff -u pkgsrc/archivers/xz/Makefile:1.50 pkgsrc/archivers/xz/Makefile:1.51
--- pkgsrc/archivers/xz/Makefile:1.50   Wed May 29 20:22:25 2024
+++ pkgsrc/archivers/xz/Makefile        Wed Oct  2 17:58:28 2024
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.50 2024/05/29 20:22:25 adam Exp $
+# $NetBSD: Makefile,v 1.51 2024/10/02 17:58:28 adam Exp $
 
-DISTNAME=      xz-5.6.2
+DISTNAME=      xz-5.6.3
 CATEGORIES=    archivers
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=tukaani-project/}
 GITHUB_RELEASE=        v${PKGVERSION_NOREV}

Index: pkgsrc/archivers/xz/distinfo
diff -u pkgsrc/archivers/xz/distinfo:1.37 pkgsrc/archivers/xz/distinfo:1.38
--- pkgsrc/archivers/xz/distinfo:1.37   Wed May 29 20:22:25 2024
+++ pkgsrc/archivers/xz/distinfo        Wed Oct  2 17:58:28 2024
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.37 2024/05/29 20:22:25 adam Exp $
+$NetBSD: distinfo,v 1.38 2024/10/02 17:58:28 adam Exp $
 
-BLAKE2s (xz-5.6.2.tar.bz2) = 922b5b9bf3508579172870f552f4cb5693093146e6f45a807174830137742516
-SHA512 (xz-5.6.2.tar.bz2) = 9b4fb06e5ae2aacdb2d3656aaf40297998b0432ea764fe7362097d0fae3d55c2c447bcd02c9cbf2cccf524bc3b6445901e3be157afa9e6cfe1b6416218f3c602
-Size (xz-5.6.2.tar.bz2) = 1702029 bytes
+BLAKE2s (xz-5.6.3.tar.bz2) = ed1b8562b6b9dcc3e264c8842442ceb1c90110df9ad8b56cb7f5befbf6ff3061
+SHA512 (xz-5.6.3.tar.bz2) = 89f79d58f2b81e09c905ea5e067a8e7beaf46ff959506da6da41214e202ba66b1387b19d5e9ed98a6ef0fd4e80e5649ee4329791377dee44d0678cdc1bf7bbf8
+Size (xz-5.6.3.tar.bz2) = 1728468 bytes
 SHA1 (patch-src_xz_Makefile.in) = b9360c7b2b34159028fb8b84339aa2faf3922287