[PATCH] xz: Update to version 5.8.1

[PATCH] xz: Update to version 5.8.1

[Adolf Belka]

- Update from version 5.8.0 to 5.8.1
- Update of rootfile
- Changelog
    5.8.1
	    IMPORTANT: This includes a security fix for CVE-2025-31115 which
	    affects XZ Utils from 5.3.3alpha to 5.8.0. No new 5.4.x or 5.6.x
	    releases will be made, but the fix is in the v5.4 and v5.6 branches
	    in the xz Git repository. A standalone patch for all affected
	    versions is available as well.
	    * Multithreaded .xz decoder (lzma_stream_decoder_mt()):
	        - Fix a bug that could at least result in a crash with
	          invalid input. (CVE-2025-31115)
	        - Fix a performance bug: Only one thread was used if the whole
	          input file was provided at once to lzma_code(), the output
	          buffer was big enough, timeout was disabled, and LZMA_FINISH
	          was used. There are no bug reports about this, thus it's
	          possible that no real-world application was affected.
	    * Avoid <stdalign.h> even with C11/C17 compilers. This fixes the
	      build with Oracle Developer Studio 12.6 on Solaris 10 when the
	      compiler is in C11 mode (the header doesn't exist).
	    * Autotools: Restore compatibility with GNU make versions older
	      than 4.0 by creating the package using GNU gettext 0.23.1
	      infrastructure instead of 0.24.
	    * Update Croatian translation.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
 config/rootfiles/common/xz | 2 +-
 lfs/xz                     | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/rootfiles/common/xz b/config/rootfiles/common/xz
index 3873744c8..f836d4578 100644
--- a/config/rootfiles/common/xz
+++ b/config/rootfiles/common/xz
@@ -41,7 +41,7 @@ usr/bin/xzmore
 #usr/lib/liblzma.la
 #usr/lib/liblzma.so
 usr/lib/liblzma.so.5
-usr/lib/liblzma.so.5.8.0
+usr/lib/liblzma.so.5.8.1
 #usr/lib/pkgconfig/liblzma.pc
 #usr/share/doc/xz
 #usr/share/doc/xz/AUTHORS
diff --git a/lfs/xz b/lfs/xz
index 511848c1d..1ee1faa52 100644
--- a/lfs/xz
+++ b/lfs/xz
@@ -24,7 +24,7 @@
 
 include Config
 
-VER        = 5.8.0
+VER        = 5.8.1
 
 THISAPP    = xz-$(VER)
 DL_FILE    = $(THISAPP).tar.xz
@@ -45,7 +45,7 @@ objects = $(DL_FILE)
 
 $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
 
-$(DL_FILE)_BLAKE2 = 5087c88884a857b96bc5658548fc9b07ab2f14fe9eabfaeaa19e21810e7588c97621db08353632bd56e66ae2085ec5adc421c4d6849525b630d56dadd65c9f81
+$(DL_FILE)_BLAKE2 = f11be3971e181bb49b6a92d3cc07ebb1c6b5fb53bc5d079e0952eed94f069656cffb37a2e2e8f068a5f119c6ef5ee565b3ac9978a5afa24a40d49607d492d176
 
 install : $(TARGET)
 
-- 
2.49.0

Re: [PATCH] xz: Update to version 5.8.1

[Michael Tremer]

Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>

This was obviously too late for c193, but I strongly suggest to ship this in c194.

Best,
-Michael

> On 8 Apr 2025, at 22:37, Adolf Belka <adolf.belka@ipfire.org> wrote:
> 
> - Update from version 5.8.0 to 5.8.1
> - Update of rootfile
> - Changelog
>    5.8.1
>    IMPORTANT: This includes a security fix for CVE-2025-31115 which
>    affects XZ Utils from 5.3.3alpha to 5.8.0. No new 5.4.x or 5.6.x
>    releases will be made, but the fix is in the v5.4 and v5.6 branches
>    in the xz Git repository. A standalone patch for all affected
>    versions is available as well.
>    * Multithreaded .xz decoder (lzma_stream_decoder_mt()):
>        - Fix a bug that could at least result in a crash with
>          invalid input. (CVE-2025-31115)
>        - Fix a performance bug: Only one thread was used if the whole
>          input file was provided at once to lzma_code(), the output
>          buffer was big enough, timeout was disabled, and LZMA_FINISH
>          was used. There are no bug reports about this, thus it's
>          possible that no real-world application was affected.
>    * Avoid <stdalign.h> even with C11/C17 compilers. This fixes the
>      build with Oracle Developer Studio 12.6 on Solaris 10 when the
>      compiler is in C11 mode (the header doesn't exist).
>    * Autotools: Restore compatibility with GNU make versions older
>      than 4.0 by creating the package using GNU gettext 0.23.1
>      infrastructure instead of 0.24.
>    * Update Croatian translation.
> 
> Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
> ---
> config/rootfiles/common/xz | 2 +-
> lfs/xz                     | 4 ++--
> 2 files changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/config/rootfiles/common/xz b/config/rootfiles/common/xz
> index 3873744c8..f836d4578 100644
> --- a/config/rootfiles/common/xz
> +++ b/config/rootfiles/common/xz
> @@ -41,7 +41,7 @@ usr/bin/xzmore
> #usr/lib/liblzma.la
> #usr/lib/liblzma.so
> usr/lib/liblzma.so.5
> -usr/lib/liblzma.so.5.8.0
> +usr/lib/liblzma.so.5.8.1
> #usr/lib/pkgconfig/liblzma.pc
> #usr/share/doc/xz
> #usr/share/doc/xz/AUTHORS
> diff --git a/lfs/xz b/lfs/xz
> index 511848c1d..1ee1faa52 100644
> --- a/lfs/xz
> +++ b/lfs/xz
> @@ -24,7 +24,7 @@
> 
> include Config
> 
> -VER        = 5.8.0
> +VER        = 5.8.1
> 
> THISAPP    = xz-$(VER)
> DL_FILE    = $(THISAPP).tar.xz
> @@ -45,7 +45,7 @@ objects = $(DL_FILE)
> 
> $(DL_FILE) = $(DL_FROM)/$(DL_FILE)
> 
> -$(DL_FILE)_BLAKE2 = 5087c88884a857b96bc5658548fc9b07ab2f14fe9eabfaeaa19e21810e7588c97621db08353632bd56e66ae2085ec5adc421c4d6849525b630d56dadd65c9f81
> +$(DL_FILE)_BLAKE2 = f11be3971e181bb49b6a92d3cc07ebb1c6b5fb53bc5d079e0952eed94f069656cffb37a2e2e8f068a5f119c6ef5ee565b3ac9978a5afa24a40d49607d492d176
> 
> install : $(TARGET)
> 
> -- 
> 2.49.0
> 
>