Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package hatchzip for openSUSE:Factory checked in at 2026-11-06 19:57:37 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/hatchzip (Old) and /work/SRC/openSUSE:Factory/.hatchzip.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "hatchzip" Fri Nov 6 19:57:37 2026 rev:2 rq:1395752 version:0.1.9 Changes: -------- --- /work/SRC/openSUSE:Factory/hatchzip/hatchzip.changes 2026-11-03 17:55:05.029112366 +0100 +++ /work/SRC/openSUSE:Factory/.hatchzip.new.3759290/hatchzip.changes 2026-11-06 20:03:50.726002182 +0100 @@ -1,0 +2,21 @@ +Fri Nov 6 07:57:02 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 0.1.9: + * Security: dot-only archive names can no longer escape the + output folder; crafted 34-byte RAR refused as damaged; + hard-linked archives refused in place; batch files verified + on disk before the archive bytes are freed + * Extract tar.xz, in place one block at a time + * Read tar mtimes from pax records, ZIP mtimes from NTFS + fields in the local time zone + * Extract names differing only in case where kept apart + * GUI: browse archive contents as a folder tree; Hindi + translation + * Drop upstream-adopted patches (all in 0.1.9): + hatchzip-verify-files-before-truncate.patch, + hatchzip-refuse-hard-linked-in-place.patch, + hatchzip-tar-pax-mtime.patch, hatchzip-zip-ntfs-mtime.patch + * Vendor the locked dependency tree (keep upstream-tested + sevenz-rust2 0.24.1; a floated 0.24.2 breaks a crafted test) + +------------------------------------------------------------------- Old: ---- hatchzip-0.1.8.tar.zst hatchzip-refuse-hard-linked-in-place.patch hatchzip-tar-pax-mtime.patch hatchzip-verify-files-before-truncate.patch hatchzip-zip-ntfs-mtime.patch New: ---- hatchzip-0.1.9.tar.zst ----------(Old B)---------- Old: hatchzip-verify-files-before-truncate.patch, hatchzip-refuse-hard-linked-in-place.patch, hatchzip-tar-pax-mtime.patch, hatchzip-zip-ntfs-mtime.patch Old: hatchzip-refuse-hard-linked-in-place.patch, hatchzip-tar-pax-mtime.patch, hatchzip-zip-ntfs-mtime.patch * Vendor the locked dependency tree (keep upstream-tested Old: * Drop upstream-adopted patches (all in 0.1.9): hatchzip-verify-files-before-truncate.patch, hatchzip-refuse-hard-linked-in-place.patch, Old: hatchzip-refuse-hard-linked-in-place.patch, hatchzip-tar-pax-mtime.patch, hatchzip-zip-ntfs-mtime.patch * Vendor the locked dependency tree (keep upstream-tested ----------(Old E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ hatchzip.spec ++++++ --- /var/tmp/diff_new_pack.Axs2VW/_old 2026-11-06 20:03:53.369112870 +0100 +++ /var/tmp/diff_new_pack.Axs2VW/_new 2026-11-06 20:03:53.371112954 +0100 @@ -17,7 +17,7 @@ Name: hatchzip -Version: 0.1.8 +Version: 0.1.9 Release: 0 Summary: Archive extractor that needs free space for the extracted files only # Legal-Review-Notice: UnRAR is not built or shipped: unrar-ng-sys is @@ -28,17 +28,19 @@ Source0: %{name}-%{version}.tar.zst # cargo_vendor's output without UnRAR, whose licence is not open source: # zstd -d --rm vendor.tar.zst && tar --delete -f vendor.tar --wildcards 'vendor/unrar-ng-sys-*' && zstd -19 --rm vendor.tar +# Codec and fuzz-corpus test archives embed a Windows game/tool.exe fixture; +# the libloading crate ships its Windows-only test DLLs. All are read only +# by tests, never built, loaded or shipped on Linux. +# Source-Binary-Exception: hatchzip-0.1.9.tar.zst:**/tests/fixtures/** -- test-data: upstream codec and RAR test vectors, read only by the test suite +# Source-Binary-Exception: hatchzip-0.1.9.tar.zst:**/src/archive/fixtures/** -- test-data: upstream xz decoder test vectors, read only by unit tests +# Source-Binary-Exception: hatchzip-0.1.9.tar.zst:**/fuzz/corpus/** -- test-data: fuzz corpus archives, read only by fuzz targets and tests +# Source-Binary-Exception: vendor.tar.zst:vendor/libz-rs-sys-*/src/test-data/* -- test-data: libz-rs-sys gzip decoder test vector, read only by its tests +# Source-Binary-Exception: vendor.tar.zst:vendor/libloading-*/tests/*.dll -- test-data: fixtures loaded only by libloading's Windows-only tests, never on Linux +# Source-Binary-Exception: vendor.tar.zst:vendor/sevenz-rust2-*/tests/** -- test-data: sevenz-rust2's own test archives, read only by its test suite +# Source-Binary-Exception: vendor.tar.zst:vendor/sevenz-rust2-*/examples/** -- test-data: sevenz-rust2 example input archive, read only by its examples Source1: vendor.tar.zst # PATCH-FIX-OPENSUSE hatchzip-no-unrar.patch -- Build without UnRAR, and claim no RAR support in the desktop metadata Patch0: hatchzip-no-unrar.patch -# PATCH-FIX-UPSTREAM hatchzip-verify-files-before-truncate.patch https://github.com/xevrion/hatchzip/pull/37 -- Check the extracted files are on disk before cutting a batch off the archive -Patch1: hatchzip-verify-files-before-truncate.patch -# PATCH-FIX-UPSTREAM hatchzip-refuse-hard-linked-in-place.patch https://github.com/xevrion/hatchzip/pull/48 -- Refuse to extract a hard-linked archive in place -Patch2: hatchzip-refuse-hard-linked-in-place.patch -# PATCH-FIX-UPSTREAM hatchzip-tar-pax-mtime.patch https://github.com/xevrion/hatchzip/pull/42 -- Read the modified time from a pax record -Patch3: hatchzip-tar-pax-mtime.patch -# PATCH-FIX-UPSTREAM hatchzip-zip-ntfs-mtime.patch https://github.com/xevrion/hatchzip/pull/49 -- Restore ZIP modified times from the NTFS extra field -Patch4: hatchzip-zip-ntfs-mtime.patch BuildRequires: cargo-packaging # %%check: the GUI tests need a font BuildRequires: google-noto-sans-fonts @@ -51,7 +53,8 @@ BuildRequires: pkgconfig(libzstd) %description -HatchZip extracts ZIP, 7z, tar, tar.gz and split archives in place: the +HatchZip extracts ZIP, 7z, tar, tar.gz, tar.xz and split archives +in place: the archive shrinks as the files come out, so the extraction needs free space for the extracted files only. It can be stopped, or crash, at any point and continues where it left off. The archive is gone once the @@ -82,8 +85,8 @@ Recommends: xdg-desktop-portal %description gui -The HatchZip desktop app extracts ZIP, 7z, tar, tar.gz and split -archives in place, freeing the archive as it goes, and can add itself +The HatchZip desktop app extracts ZIP, 7z, tar, tar.gz, tar.xz and +split archives in place, freeing the archive as it goes, and can add itself to the file manager's right-click menu. %package bash-completion ++++++ _service ++++++ --- /var/tmp/diff_new_pack.Axs2VW/_old 2026-11-06 20:03:53.459116639 +0100 +++ /var/tmp/diff_new_pack.Axs2VW/_new 2026-11-06 20:03:53.469117058 +0100 @@ -2,7 +2,7 @@ <service name="obs_scm" mode="manual"> <param name="url">https://github.com/xevrion/hatchzip.git</param> <param name="scm">git</param> - <param name="revision">refs/tags/v0.1.8</param> + <param name="revision">refs/tags/v0.1.9</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> </service> @@ -15,7 +15,7 @@ <service name="cargo_vendor" mode="manual"> <param name="srcdir">hatchzip</param> <param name="compression">zst</param> - <param name="update">true</param> + <param name="update">false</param> <param name="filter">true</param> </service> <service name="cargo_audit" mode="manual"/> ++++++ hatchzip-0.1.8.tar.zst -> hatchzip-0.1.9.tar.zst ++++++ ++++ 12704 lines of diff (skipped) ++++++ hatchzip-no-unrar.patch ++++++ --- /var/tmp/diff_new_pack.Axs2VW/_old 2026-11-06 20:03:53.797130795 +0100 +++ /var/tmp/diff_new_pack.Axs2VW/_new 2026-11-06 20:03:53.802131004 +0100 @@ -1,6 +1,6 @@ --- a/crates/core/Cargo.toml +++ b/crates/core/Cargo.toml -@@ -23,12 +23,6 @@ +@@ -29,12 +29,6 @@ serde_json.workspace = true sevenz-rust2.workspace = true tar.workspace = true @@ -13,7 +13,7 @@ # The RAR 5 password check value and header key, PBKDF2-HMAC-SHA256, and # AES-CBC for encrypted RAR headers; all already in the tree through zip and # sevenz-rust2. -@@ -45,7 +39,7 @@ +@@ -51,7 +45,7 @@ # RAR archives, decoded by UnRAR. Off by default: without it the build is # open source throughout and needs no C++ compiler, and a RAR archive is # refused before anything is touched. The release builds turn it on. @@ -28,8 +28,8 @@ Icon=io.github.xevrion.hatchzip Terminal=false Categories=Utility;Archiving;Compression; --MimeType=application/zip;application/x-zip-compressed;application/x-7z-compressed;application/x-tar;application/x-compressed-tar;application/vnd.rar;application/x-rar;application/x-rar-compressed; -+MimeType=application/zip;application/x-zip-compressed;application/x-7z-compressed;application/x-tar;application/x-compressed-tar; +-MimeType=application/zip;application/x-zip-compressed;application/x-7z-compressed;application/x-tar;application/x-compressed-tar;application/x-xz-compressed-tar;application/vnd.rar;application/x-rar;application/x-rar-compressed; ++MimeType=application/zip;application/x-zip-compressed;application/x-7z-compressed;application/x-tar;application/x-compressed-tar;application/x-xz-compressed-tar; Keywords=zip;7z;tar;unzip;extract;archive;split; --- a/packaging/linux/io.github.xevrion.hatchzip.metainfo.xml +++ b/packaging/linux/io.github.xevrion.hatchzip.metainfo.xml @@ -37,15 +37,15 @@ <li>Checks that the extraction fits before it changes anything</li> <li>Keeps a margin of free space the whole way through</li> <li>Can be stopped or crash at any moment and continues where it left off</li> -- <li>Reads ZIP, 7z, tar, tar.gz, RAR and split archives</li> -+ <li>Reads ZIP, 7z, tar, tar.gz and split archives</li> +- <li>Reads ZIP, 7z, tar, tar.gz, tar.xz, RAR and split archives</li> ++ <li>Reads ZIP, 7z, tar, tar.gz, tar.xz and split archives</li> </ul> <p> The archive is gone when the extraction finishes. For an archive that -@@ -62,9 +62,6 @@ - <mediatype>application/x-7z-compressed</mediatype> +@@ -63,9 +63,6 @@ <mediatype>application/x-tar</mediatype> <mediatype>application/x-compressed-tar</mediatype> + <mediatype>application/x-xz-compressed-tar</mediatype> - <mediatype>application/vnd.rar</mediatype> - <mediatype>application/x-rar</mediatype> - <mediatype>application/x-rar-compressed</mediatype> ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/hatchzip/vendor.tar.zst /work/SRC/openSUSE:Factory/.hatchzip.new.3759290/vendor.tar.zst differ: char 8, line 1
