Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package zpaqfranz for openSUSE:Factory checked in at 2026-08-09 21:44:43 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/zpaqfranz (Old) and /work/SRC/openSUSE:Factory/.zpaqfranz.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "zpaqfranz" Sun Aug 9 21:44:43 2026 rev:9 rq:1370361 version:64.8 Changes: -------- --- /work/SRC/openSUSE:Factory/zpaqfranz/zpaqfranz.changes 2025-05-05 23:00:54.971871624 +0200 +++ /work/SRC/openSUSE:Factory/.zpaqfranz.new.16738/zpaqfranz.changes 2026-08-09 21:46:44.353598336 +0200 @@ -1,0 +2,64 @@ +Sat Aug 8 20:29:02 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 64.8: + * New -turbo switch for the add command, using a different + algorithm that can be up to 50% faster in favourable cases. + Upstream marks it as under active development and it has to be + requested explicitly + * New -recover extraction mode, which reads the archive in random + order and writes the extracted files strictly sequentially. This + is aimed at extracting onto high-latency media and often recovers + more files from a damaged archive + * New -recover switch for the consolidate command, which + regenerates the .index and .txt files of a multipart backup + * The dump command was rewritten and now handles archives of any + size + * SFTP transfers can be bandwidth-limited across threads with the + new -bandwidth switch + * New -huge switch, an alternative file preparation algorithm for + very large files on filesystems without sparse file support + * New work fc command for a binary comparison of two files, and + new work crc32 and work ispasswordok commands + * New -stdinsize switch to give an accurate ETA when creating an + archive from -stdin + * The dir command gained -nodir to list files only, the hash + command gained -norecursion, and the new -always switch forces + adding files whose timestamp has not changed + * Improved handling of local time, including negative UTC offsets + * Fixed deprecated streamed ZPAQ files being misdetected as + standard ZPAQ files + * The autotest command now runs a quick hash check by default and + reports more detail under -all + * Added the experimental FRANZEN encrypted format, enabled with + -franzen. Upstream states it is not suitable for anything beyond + experimentation and has no backward compatibility + * Source changes to avoid heuristic false positives from some + antivirus products + * The jump from the 61.x to the 62.x numbering was made by + upstream to unstick Homebrew users, not to mark a large change +- Add a %check section running the upstream autotest command + followed by an archive create and verify round trip. +- Install the man page that upstream ships in man/. +- Pass the distribution linker flags: the compiler was invoked with + the optflags but never with LDFLAGS, so the binary was built + without the standard link hardening. +- Build with -DIPV6 so IPv4 is no longer forced. +- Replace the unsatisfiable "Suggests: libcurl" with Recommends on + libcurl4 and libssh4, which are the libraries the binary actually + dlopens by name at run time. +- Declare the bundled blake3, highwayhash, libdivsufsort-lite, lz4 + and xxhash copies with bundled() Provides. +- Correct the License tag to + Apache-2.0 AND BSD-2-Clause AND MIT AND SUSE-Public-Domain AND Zlib + AND Unlicense AND Ferguson-Twofish, derived from the credits block + that upstream maintains in zpaqfranz.cpp. The previous tag named + only two of the licences of the 25 bundled components. The + derivation is recorded in a Legal-Review-Notice comment above the + tag. +- Normalise the CRLF line endings of CHANGELOG.md and COPYING. +- This version is not affected by CVE-2025-50327 (boo#1272902): the + flaw is a failure to propagate the Windows Mark-of-the-Web to + extracted files, a mechanism that does not exist on Linux, and the + report covers 61.3 and earlier in any case. + +------------------------------------------------------------------- Old: ---- zpaqfranz-62.2.tar.gz New: ---- zpaqfranz-64.8.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ zpaqfranz.spec ++++++ --- /var/tmp/diff_new_pack.3yEDGE/_old 2026-08-09 21:46:45.709644578 +0200 +++ /var/tmp/diff_new_pack.3yEDGE/_new 2026-08-09 21:46:45.725645123 +0200 @@ -1,7 +1,7 @@ # # spec file for package zpaqfranz # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -17,15 +17,45 @@ Name: zpaqfranz -Version: 62.2 +Version: 64.8 Release: 0 Summary: A journaling, incremental, deduplicating archiver -License: MIT AND SUSE-Public-Domain -Group: Productivity/Archiving/Compression +# Legal-Review-Notice: zpaqfranz is a single-translation-unit program that +# embeds a large amount of third-party code. Upstream enumerates every piece +# in the "Credits and copyrights and licenses" block of zpaqfranz.cpp +# (25 entries); the tag below is the union of what that block declares, +# after electing the permissive side of the two dual-licensed pieces: +# - zpaqfranz itself and libdivsufsort, Embedded Artistry, nilsimsa, zsfx +# and ascii-art: MIT (LICENSE is the MIT text), +# - zpaq, libtomcrypt AES, salsa20, unzpaq206, the encode.su modifications, +# Whirlpool, SHA-Intrinsics and the man page: public domain, +# - Crc32, hash-library (MD5/SHA-3) and crc32c: Zlib, +# - wyhash: Unlicense, +# - xxHash and LZ4: BSD-2-Clause, +# - HighwayHash: Apache-2.0, and BLAKE3 is "CC0-1.0 OR Apache-2.0" - we +# elect Apache-2.0, which is already required by HighwayHash, so no +# CC0-1.0 obligation is taken on, +# - the libtomcrypt AES is "public domain OR WTFPL" - we elect public domain, +# - Twofish by Niels Ferguson: Ferguson-Twofish. +# The bundled curl.h is licensed under the curl licence, but only the header +# is present: libcurl and libssh are dlopened at run time and no curl or +# libssh code is linked into the binary, so it is not part of this tag. +# The Sha1Opt.asm / 7zAsm.asm public-domain code (entry 5) is Windows-only +# and never compiled here. +License: Apache-2.0 AND BSD-2-Clause AND MIT AND SUSE-Public-Domain AND Zlib AND Unlicense AND Ferguson-Twofish URL: https://github.com/fcorbelli/zpaqfranz Source0: https://github.com/fcorbelli/zpaqfranz/archive/refs/tags/%{version}.tar.gz#/%{name}-%{version}.tar.gz BuildRequires: gcc-c++ -Suggests: libcurl +# libcurl and libssh are dlopened by name at run time for the URL and SFTP +# features; the binary does not link them, so these stay weak dependencies. +Recommends: libcurl4 +Recommends: libssh4 +# Third-party code bundled into the single zpaqfranz.cpp translation unit. +Provides: bundled(blake3) +Provides: bundled(highwayhash) +Provides: bundled(libdivsufsort-lite) = 2.00 +Provides: bundled(lz4) +Provides: bundled(xxhash) %description Swiss army knife for backup and disaster recovery, like 7z or RAR on @@ -34,23 +64,43 @@ %prep %autosetup +# Upstream ships these two with CRLF line endings, which rpmlint rejects. +sed -i 's/\r$//' CHANGELOG.md COPYING %build -g++ %{optflags} \ - %ifarch %ix86 - -Dunix -DHWSHA2 \ - %elifarch s390x \ - -Dunix -DNOJIT -DBIG \ - %else - -Dunix -DNOJIT -DSFTP \ - %endif - zpaqfranz.cpp -o zpaqfranz -pthread -lstdc++ -lm +%{set_build_flags} +# Upstream's Makefile does not know about s390x and strips the executable, so +# the single translation unit is compiled directly. +g++ $CXXFLAGS $LDFLAGS \ + -Dunix \ + -DIPV6 \ +%ifarch %{ix86} + -DHWSHA2 \ +%else + -DNOJIT \ +%endif +%ifarch s390x + -DBIG \ +%else + -DSFTP \ +%endif + zpaqfranz.cpp -o zpaqfranz -pthread -ldl -lm %install install -Dpm 0755 zpaqfranz %{buildroot}%{_bindir}/%{name} +install -Dpm 0644 man/%{name}.1 %{buildroot}%{_mandir}/man1/%{name}.1 + +%check +# Upstream's built-in self test, then a create/verify round trip. Both run +# against the build directory copy, which is still unstripped - upstream notes +# that stripping the binary loses the autotest capability. +./zpaqfranz autotest +./zpaqfranz a test.zpaq LICENSE +./zpaqfranz v test.zpaq %files -%doc README.md +%doc CHANGELOG.md README.md TODO.md %license LICENSE COPYING %{_bindir}/%{name} +%{_mandir}/man1/%{name}.1%{?ext_man} ++++++ zpaqfranz-62.2.tar.gz -> zpaqfranz-64.8.tar.gz ++++++ ++++ 188255 lines of diff (skipped)
