* SECURITY UPDATE: arbitrary file overwrite or code execution with
crafted file names
- debian/patches/CVE-2022-1271.patch: fix escaping of malicious
filenames in src/scripts/xzgrep.in.
- CVE-2022-1271
* Non-maintainer upload.
* Force a constant /bin/sh for installed scripts. This helps the build
be reproducible; /bin/sh on Debian is always POSIX. (Closes: #806331)
* Non-maintainer upload.
* link against libfreebsd-glue on kfreebsd-* (Closes: #840063)
* Non-maintainer upload.
* switch to git-dpm for packaging (closes: #540405)
* New Upstream (closes: #731634)
- no more "xzless error in line 49" (closes: #693537)
- xzgrep -h works (closes: #780268)
* update symbol file
* enable threads for the "normal build"
[ Helmut Grohne ]
* Non-maintainer upload.
[ Colin Watson ]
* Remove build-dependency on perl; we use no non-trivial Perl modules so
the Essential perl-base is perfectly adequate, and an unadorned
build-dependency on perl is problematic for cross-building.
Closes: #697328.
* Apply fixes from 5.1.2alpha. Closes: #685220.
- liblzma: report a LZMA_DATA_ERROR when range encoded data starts
with a nonzero byte. This is a sanity check to catch malformed
files that no known encoders produce.
- xz -v -v --list: Support for decompressing blocks with
zero-length uncompressed data was added in xz 5.0.2, not 5.0.3.
- xz.1: "xz --robot -v -v --list" gained a "minimum xz version to
decompress" field.
* xz-utils/README.Debian: Document differences from upstream.
Closes: #685217.
* New snapshot, taken from upstream commit f1675f76.
- liblzma: BCJ filters would return a spurious LZMA_BUF_ERROR
result in certain circumstances. As a result, the xz tool
could produce inappropriate "Compressed data is corrupt" or
"Unexpected end of input" failures (reported in XZ Embedded as
Fedora bug 735408).
- "xz -v -v --list" prints the minimal XZ Utils version needed
to decompress a stream.
- "xz --robot -v --list" formats filenames more plainly.
- xzgrep does not fail unconditionally when the decompressor
dies with SIGPIPE due to unconsumed output any more. This
makes the exit status from commands such as "xzgrep -q" and
"xzgrep -l" more predictable and convenient for scripts.
- examples/xz_pipe_decomp.c did not check correctly for
truncated input.
- There is a new set of sample programs. The old ones have
been renamed to examples_old but are still maintained.
* liblzma:
- If dlopen() indicates that liblzma.so.2 is loaded, check fewer
reserved fields in the stream argument to the lzma_code()
function. This prevents out-of-bounds reads when liblzma5
functions are called by code built against liblzma2 (see
<http://sourceware.org/PR12977>;).
- Remove the lzma_code@Base compatibility symbol.
Closes: #649522. Thanks to Eduard Bloch.
- Install run-time library to /lib so it can be used before /usr
is mounted. Closes: #672120.
- Configure with --disable-threads for now to avoid needlessly
linking to libpthread and librt.
* liblzma-dev:
- Install an appropriate library for static linking instead of
the decompression-only version used to build xzdec.
Closes: #673001. Thanks to Anton Tolchanov.
- Use the liblzma2-compatible version of lzma_code() in the
static library.
- Multi-Arch: same. Thanks to Riku Voipio.
- Install new examples and revised old examples to
/usr/share/doc/liblzma-dev.
* xz-utils:
- Use update-alternatives to provide lzma, unlzma, lzcat, and
the rest of the lz* scripts without conflicting with the lzma
package.
- Conflicts: lzma versions before before 9.22-1, when it started
providing lzma, unlzma, and lzcat through the alternatives
system.
- Conflicts: and Replaces: xz-lzma.
- README.Debian: Update instructions on configuring the package
to provide lzma compatibility commands.
* Remove xz-lzma package.
* Use dpkg-buildflags to retrieve compiler flags, including
hardening options. Build-Depends: dpkg-dev (>= 1.16.1).
Closes: #653739.
* debian/rules:
- build-arch: Simplify by using a double-colon rule instead of a
dependency on a dummy noop target.
- build-indep: Assume doxygen is available, instead of trying to
get by by assuming the caller meant to invoke build-arch when
it is missing. Build-Depends: dpkg-dev (>= 1.16.2).
- Rearrange for clarity.
* debian/symbols: Bump the minimal version for lzma_code(),
lzma_raw_buffer_decode(), and lzma_raw_buffer_encode().
* Use machine-readable copyright-format 1.0.
* Update copyright file.
* Standards-Version: 3.9.3 (checked).
* debian/changelog.upstream.sh: Use ‘git rev-list | git diff-tree’
instead of ‘git log’ to avoid depending on the build system’s
configuration.
* liblzma: Match upstream ABI.
- Remove the lzma_chunk_size() function.
- A few ABI tweaks to reserved space in structures.
- Enable ELF symbol versioning.
- Bump soname to 5.
- Continue to leave out threading support, since the relevant
interfaces in liblzma are not yet stable.
* xz-utils/README.Debian: Remove note on ABI differences.
* Remove liblzma/README.Debian.
* liblzma: Introduce a lzma_code@Base compatibility symbol to ensure
programs linked against unversioned symbols from liblzma2 can
share a process image with liblzma5 without breaking.
* debian/symbols: XZ_5.0 symbols come from liblzma5. Build-Depends:
dpkg-dev (>= 1.15.6); thanks to Jakub Wilk for a reminder.
* debian/symbols: The lzma_code@Base symbol is not guaranteed to
continue to exist in the future, so tell dpkg-shlibdeps to produce
an error if some package manages to use it.
* debian/rules build-arch: Do not trigger an infinite "make"
recursion loop when DEB_BUILD_OPTIONS=nocheck. Closes: #638071.
Thanks to Thorsten Glaser.
* New snapshot, taken from upstream commit 5c5b225.
- liblzma:
- lzma_stream_encoder() leaked memory.
- The LZMA2 decoder rejected streams that decompress to a
zero-length string.
- lzma_easy_buffer_encode() and lzma_stream_buffer_encode()
used to write such streams when asked to compress a 0-length
buffer.
- lzma_index_init() would segfault on allocation failure.
- liblzma: Various functions check their arguments (especially
choice of integrity check) better, making it harder to create
a corrupt .xz file instead of receiving an error.
- xz and scripts:
- "xz -v -v --list" would read and try to free() uninitialized
memory, continuing past the end of an on-stack array, when
asked to describe certain corrupted XZ files.
- xz -S.suf now refuses to compress a file whose name already
ends with the suffix “.suf”.
- xz --force can be used to compress setuid, setgid, sticky,
and multiply linked files.
- xz uses posix_fadvise() to speed up sequential input.
- xz --block-size forces a full flush periodically during
compression, for better random-access reading support and to
make simple parallelism possible in the future.
- unxz: The new --single-stream option discards trailing
garbage after the end of the first stream.
- xzdiff can read gzip- and bzip2-compressed files.
- xzdiff and xzgrep can read lzop-compressed files.
- xzegrep and xzfgrep perform extended regex and fixed-string
matches, respectively. (The previous behavior was to always
use basic regexes.)
- xzgrep -l (= --files-with-match) works.
- The Czech “xz --help” output uses a more correct term for
files with holes. Thanks to Petr Hubený. Closes: #605762.
- xz: New Polish and French translations.
- The Doxygen-generated documentation uses short, relative paths
to name source files. Closes: #572273.
* Update copyright file.
* Remove example programs from debian/examples. They are included
in the upstream source package now.
* Move liblzma to an architecture-specific directory, so the
native library and foreign-architecture versions can be installed
simultaneously.
- liblzma2: Pre-Depends: multiarch-support.
- Use debhelper compatibility level 9. This requires passing
the dh sequence name before other options when invoking dh in
debian/rules. Build-Depends: debhelper (>= 8.1.3).
- liblzma2, liblzma-dev: Install files under /usr/lib/<triplet>
instead of /usr/lib.
- Thanks to Steve Langasek for explaining the process on the
Debian wiki.
* Standards-Version: 3.9.2 (checked).
* debian/control: liblzma2 is Multi-Arch: same, while xz-utils
and xzdec are Multi-Arch: foreign. Closes: #637883. Thanks to
Riku Voipio.
* debian/symbols: Bump the minimal version for LZMA2 encoder
functions that reject more bad arguments and skip empty blocks.
* debian/rules: ./configure --disable-symbol-versions for now.
* debian/rules: Provide build-arch and build-indep targets that
only build the code and the API documentation, respectively.
Thanks to Roger Leigh for suggesting it through lintian.
Build-Depends: debhelper (>= 8.9.0).
* debian/rules: Treat DEB_BUILD_OPTIONS=nocheck as a request not to
run build-time tests. Thanks to Thorsten Glaser for a reminder.
Closes: #627209.
* Upload to unstable.
* liblzma2, liblzma-dev, xz-lzma: Install release notes.
* debian/symbols: Bump the minimal versions for lzma_index_encoder,
lzma_index_decoder to the version in which they gained LZMA_FINISH
support.
* xz-utils/README.Debian: Document differences from upstream ABI.
* debian/changelog.upstream.sh: Avoid empty changelog entries when
multiple Debian revisions match an upstream tag.
* Upload to experimental.
* New stable upstream release. Closes: #592298.
- xz avoids SA_RESTART. This should not have a visible effect
because xz already blocked signals during operations that
would be difficult to resume after interruption.
- liblzma: The coders returned by lzma_index_encoder() and
lzma_index_decoder() support an LZMA_FINISH action, with
identical semantics to LZMA_RUN.
- The printable (PDF and PS) versions of the manual are easier
to read.
- Many documentation and build system cleanups.
* liblzma: Back out upstream ABI tweaks.
* liblzma/README.Debian: Document ABI differences from upstream.
* Copy sample code not included in the release tarball from
the development upstream repository to debian/examples.
* debian/rules clean: Remove some files not included in the
release tarball.
* copyright: List new INSTALL.generic license.
* debian/rules clean: Take new build-aux scripts into account.
* debian/rules: Adapt for upstream build system changes.
Closes: #540443.
* xz-utils, xzdec: Install release notes.
* New snapshot, taken from upstream commit cec0ddc.
- liblzma: The meaning of --extreme has been tweaked to address
cases in which it made the compression ratio worse. Some files
might benefit slightly less from --extreme.
- xz: Table columns are not misaligned any more in messages with
multi-byte characters (e.g., file sizes with LANG=fi_FI.UTF-8).
- xz: New German and Italian translations.
- Various documentation, message, and translation updates.
* Update copyright file.
* debian/rules get-orig-source: Update upstream Git URL.
* xz-utils/README.Debian: Advertise XZ_DEFAULTS.
* New snapshot, taken from upstream commit 373ee26.
- liblzma: The settings for compression levels 0 through 5
(used by xz -0/.../-5) have been tweaked. This affects the
speed, compression ratio, and memory usage at compression and
decompression time.
- Does not search so hard for a match when a low "nice match
length" setting is specified without a depth.
- xz: The -1/.../-9 preset options override any previously
specified filters, rather than vice versa. To mix presets
with filter options, use the --lzma2=preset=n option.
- xz: Warns about --memlimit-compress settings that result in
compression settings changing even if no explicit -1/.../-9,
--lzma1, or --lzma2 option was used.
- "xz -v -v --compress" now prints an estimate of the memory
required to decompress a file.
* debian/copyright: Update upstream Git URL.
* debian/changelog.upstream.sh: Permit terser changelog lines.
* Standards-Version: 3.9.1 (checked).
* New upstream snapshot, taken from upstream commit d5653ba8a.
- xz: The memory usage limiter is now disabled by default.
- xz: Support for an XZ_DEFAULTS environment variable was added.
It contains user-specific default settings, such as memory usage
limits, and can be overridden by the command line and XZ_OPT.
- xz: The new --memlimit-compress and --memlimit-decompress
options allow the memory usage limit to be set separately for
compression and decompression. A new --memlimit alias has been
added for the existing --memory option.
- xz: The --info-memory option (with or without --robot) now prints
how much RAM is installed in addition to the compression and
decompression memory limits.
* liblzma-doc: Simplify package description.
* debian/control: Build-Depends: autopoint | gettext (<< 0.18-1),
autopoint | cvs instead of autopoint, to help with backporting.
Thanks to Thorsten Glaser for a report.
[ Thorsten Glaser ]
* Explicitly depend on autoconf (>= 2.64~) due to AC_PREREQ,
discovered during backporting.
[ Jonathan Nieder ]
* Upload to unstable.
* New upstream snapshot, taken from upstream commit a540198f.
- xz: The new --no-adjust option can be used to error out if there
is insufficient memory for the chosen compression level.
* liblzma-dev: Install examples to /usr/share/doc/liblzma-dev.
* Update copyright file.
* Drop unpack-time conflicts in favor of configuration-time
conflicts (Replaces + Breaks):
- xz-utils: against old xz-lzma (for lzmainfo).
- xzdec: against old xz-lzma (for lzmadec).
- xz-lzma: against lzip 1.7 (for lzdiff and lzgrep).
* Standards-Version: 3.9.0.
* debian/autogen.sh: Don’t regenerate upstream changelog when it is
not out of date.
* debian/rules get-orig-source: Use gzip --no-name --rsyncable.
* New upstream snapshot, taken from upstream commit d8b41eed.
- The output from "xz -v --list" and "xz -v -v --list" has been
improved.
"xz -v -v --list" can be used to obtain an estimate for the memory
required to decompress a file.
- The xz manual page has some new material, including examples.
Closes: #578465.
- liblzma: The lzma_block_compressed_size() function no longer
returns LZMA_DATA_ERROR for valid Blocks.
* debian/symbols: Bump minimal version for lzma_block_compressed_size.
* Correct the 4.999.9beta+20100307-1 changelog entry to describe
which public functions were affected.
* Add new xz-lzma package to allow xz to provide lzma and related
commands. Conflicts: and Provides: lzma.
* xz-utils: Suggests: xz-lzma.
* xz-utils/README.Debian: Take xz-lzma into account.
* New upstream snapshot, taken from upstream commit a334348dc.
- Show both elapsed time and estimated remaining time in xz -v.
Thanks to Trent W. Buck for the idea. Closes: #574583.
- liblzma: Remove the Subblock filter from the public API
(the ABI is unchanged).
* liblzma-dev.NEWS: Update.
* xz-utils: Update Czech translation.
* Change priority of xz-utils and liblzma2 to required and
xzdec to extra.
* New upstream snapshot, taken from upstream commit f4b2b526.
- liblzma: The stream initialization functions were not correctly
initializing the internal allow_buffer_error flag. As a result,
ever since 4.999.9beta-1 in rare circumstances when decompressing
LZMA files, the xz tool would produce spurious "Unexpected end
of input" failures (Gentoo bug 305591).
- The default memory usage limit on low-memory systems has been
increased.
* debian/copyright: Clarify.
* debian/control: Build-Depends: autopoint instead of cvs.
Closes: #572481.
* debian/copyright: Clean up and include more details.
* debian/rules get-orig-source: Unindent comment lines.
* xz-utils: include Czech translation.
* liblzma-dev: Remove unneeded .la file.
* xz-utils: Dynamically link the xz binary.
* Do not waste time installing and running doxygen on buildds that
are not going to build arch-all packages.
Build-Depends-Indep: doxygen. Closes: #540444.
* Split off xzdec and lzmadec commands into new xzdec package.
Thanks to Guillem Jover for the idea. Closes: #571060.
* xz-utils.NEWS: advertise this change.
* New upstream snapshot, taken from upstream commit eb7d51a3f.
- xz --force compresses symlinks without complaint now.
- liblzma: the optimized CRC32 implementation for x86 no longer
misdetects the Hurd as Mac OS X.
* debian/rules: ./configure --enable-assembler on the Hurd.
* xz-utils: Simplify NEWS.Debian.gz.
* liblzma-dev: Add a NEWS file to keep track of future API changes.
* Drop unnecessary build-time conflict with autoconf2.13.
* Add a blank line to the end of all NEWS files.
(Works around: #247356)
* debian/README.source: Leave out “-I -i” options. Ignoring version
control cruft is the default behavior with dpkg source format 3.0.
* debian/changelog.upstream.sh: Pass ‘git log’ an explicit --format
option to avoid problems if format.pretty is set in gitconfig.
* Correct the 4.999.9beta+20100117-1 changelog entry. It said:
+ The user-specified memory usage limit was not being honored in
some cases.
No such bug was observed, so describe the change instead.
* New upstream snapshot, taken from upstream commit f9dd797a.
+ xz: the --list option to display information about a compressed
file (e.g., its uncompressed size) is now functional. The output
of the xz --robot --list command still may change in future
versions.
* xz-utils: NEWS.Debian.gz: Clarify how interleaved output can
go wrong.
* debian/rules: Simplify:
- remove support for comma as a delimiter for $(DEB_BUILD_OPTIONS).
- rely on dh --parallel instead of tricky logic of our own to
handle parallel builds. Build-Depends: debhelper (>= 7.4.10).
* Correct some typos in the 4.999.9beta+20100117-1 changelog entry.
* Standards-Version: 3.8.4 (checked).
* Update copyright file.
* New upstream snapshot, taken from upstream commit 07a11dad.
+ Fix some logic errors in the internal memory usage configuration
API.
+ xz will no longer compress or decompress special files in place,
even with --force.
--force still enables compression of the target of a symlink.
+ xz will no longer read compressed data from a terminal or write
it to a terminal, even with --force.
+ liblzma: many Index handling API improvements:
- An lzma_index includes more useful metadata that is not
actually from the Index. This is particularly helpful for
describing multiple-stream files.
* lzma_index_cat() does not take a stream padding argument
any more; use lzma_index_stream_padding() instead.
* lzma_index_memusage() takes two arguments now.
The new lzma_index_memused() convenience function
calculates the total memory usage of an lzma_index.
* lzma_index_count() has been replaced with
lzma_index_block_count() and lzma_index_stream_count().
* The new lzma_index_stream_flags() allows storing Stream
Flags (e.g., checksum types) with the Index information.
* The new lzma_index_checks() function indicates the list of
checksum types in use.
* lzma_index_equal() has been removed. Its semantics were
unclear, and something approximately equivalent can be
implemented by iterating over Blocks in application code.
- An lzma_index no longer represents a position within an Index.
The new lzma_index_iter type can be used for that purpose.
* Certain functions generate an iterator on demand now rather
than clobbering their lzma_index arguments. Using a single
lzma_index for multiple concurrent invocations is safe now:
lzma_index_buffer_encode(), lzma_index_encoder()
* Functions that used to specify a Record by modifying an
lzma_index argument have been renamed and taught to write
an lzma_index_iter instead:
lzma_index_locate() -> lzma_index_iter_locate()
lzma_index_rewind() -> lzma_index_iter_rewind()
lzma_index_read() -> lzma_index_iter_next()
* The lzma_index_record type used by lzma_index_read() for
complex seeks is no more. lzma_index_iter_next() instead
takes a parameter of the new lzma_index_iter_mode type.
* New function: lzma_index_iter_init()
* lzma_index_init() cannot reuse memory from an existing
lzma_index any more. The signature changed accordingly.
+ xz: support for decompressing to a sparse file
- Try to write a sparse file if the decompressed stream contains
long runs of null bytes.
- The new --no-sparse option disables this behavior.
+ xz: add Czech translation.
+ liblzma-dev: lzma_filters_copy() and lzma_filters_update() are
declared not to throw exceptions.
* liblzma: bump soname.
* xz-utils: Add NEWS.Debian describing the sparse file support.
* debian/rules: Stop explicitly disabling assembler optimizations on
the Hurd. The configure script will check if a platform is
supported.
* debian/rules: Update clean target to handle comments and wildcards
in .gitignore.
* Build-Depends: perl.
* debian/rules: Speed up build by using autoreconf --symlink.
* Remove debian/dirs lists.
* Update copyright file and fix a small typo.
* New upstream snapshot, taken from upstream commit d315ca4.
+ liblzma: add some new functions:
- lzma_filters_copy() to copy a filter chain;
- lzma_filters_update() to change compression options mid-stream;
- lzma_physmem() to retrieve the total quantity of installed RAM.
+ Fix a design error in liblzma API.
- Stop requiring caller to maintain filter chain during
compression. The library used to read it for new compression
options. Callers that need to change options mid-stream should
use lzma_filters_update() instead.
- Remove 'persistent' member from struct lzma_options_lzma.
+ xz: add --robot --info-memory options, for front-ends to use to
read the memory usage limit.
* liblzma: bump soname; add README.Debian explaining why soname
differs from upstream.
* Use source format 3.0 (quilt).
* Update and clarify copyright file.
* New upstream snapshot, taken from upstream commit 78e92c1.
* Drop xzmore.1 patch, applied upstream.
* debian/rules: Disable assembler optimizations on hurd. (Closes: #553331)
* debian/control: Clarify binary package descriptions. Thanks to
Justin B Rye and Ben Finney for the text.
* debian/rules get-orig-source: Use commit date (instead of last patch
date) to name snapshots.
* Upload to unstable. (Closes: #543562)
* New upstream snapshot, taken from upstream commit ebfb2c5.
* Patch xzmore.1 to use dashes instead of minus signs.
* debian/control: Conflicts: xz-lzma. (Closes: #550249)
* liblzma-doc: Register Doxygen-generated docs with doc-base.
* debian/changelog.upstream.sh: Declare local variables.
* debian/changelog.upstream.sh: Cope with multiple Debian revisions per
upstream version.
* debian/rules: Use ":=" where appropriate.
* Add watch file.
* New upstream snapshot, taken from upstream commit 29fd321.
* debian/control: Build-Depends: cvs (for autopoint).
[ Jonathan Nieder ]
* New upstream release.
- Fix a data corruption in the compression code. (Closes: #544872)
- xzdiff: Fix comparing two compressed files. (Closes: #540543)
- Most of XZ Utils is now in the public domain. (Closes: #541391)
- Add doc/history.txt to the distributed tarball. (Closes: #541540)
* Update and clarify copyright file.
* Drop lzma compatibility commands for now. (Closes: #542060, #540232)
Add instructions to README.Debian for installing them locally.
* debian/control: Add information about the packaging Git repository.
* debian/control: Clarify package descriptions.
* debian/README.source: Clarify build instructions.
* Add debian/.gitignore listing build products.
* Build xz-utils with static liblzma.
- debian/rules: Use configure --enable-dynamic=mixed.
* Optimize xzdec for size, following suggestion in PACKAGERS.
- debian/rules: Build xzdec separately so it can be optimized for size.
- debian/control: Build-Depends: debhelper (>= 7.3.0).
* Generate upstream changelog instead of shipping placeholder.
- debian/README.source: Add instructions for regenerating upstream
changelog file.
- debian/changelog.upstream.sh: New script.
- debian/rules: Install generated changelog file.
* liblzma-doc: Drop documentation already shipped in
/usr/share/doc/xz-utils.
* liblzma-dev, liblzma-doc: Add short README.Debian with pointers to
development documentation.
* Drop debian/xzdec.1, since upstream ships a better man page.
* Run autotools at build time.
+ debian/control:
- Build-Depends: autoconf, automake, libtool, gettext
- Build-Conflicts: autoconf2.13, automake1.4
+ debian/rules:
- configure: autoreconf -fi
- clean: remove autotools-generated files to avoid .diff.gz
changes when built twice in a row.
* debian/rules: Add get-orig-source target.
* Prepare for upload to experimental.
[ Cristian Greco ]
* debian/copyright: refer to versioned GPL-3 file.
* debian/control: remove duplicate field ‘section’ in package xz-utils.
[ Jonathan Nieder ]
* Initial package for Debian. (Closes: #518803)
+ debian/rules:
- add minimal rules file (using Debhelper 7), a control file
describing the binary packages, and an appropriate compat file.
- use configure --enable-dynamic; use up-to-date config.guess and
config.sub files.
- do not run automake and so on on autobuilders. Instead, we can
run them ourselves when we build the source package.
+ debian/README.source:
- add informations about the packaging GIT repository.
* Add liblzma-doc package with Doxygen-generated API docs.
[ Mohammed Adnène Trojette ]
* Prepare for upload to experimental.