Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package hatchzip for openSUSE:Factory checked in at 2026-11-10 14:44:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/hatchzip (Old) and /work/SRC/openSUSE:Factory/.hatchzip.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "hatchzip" Tue Nov 10 14:44:10 2026 rev:3 rq:1396477 version:0.1.10 Changes: -------- --- /work/SRC/openSUSE:Factory/hatchzip/hatchzip.changes 2026-11-06 20:03:50.726002182 +0100 +++ /work/SRC/openSUSE:Factory/.hatchzip.new.3759290/hatchzip.changes 2026-11-10 14:45:43.798911589 +0100 @@ -1,0 +2,19 @@ +Tue Nov 10 07:35:58 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 0.1.10: + * Security: refuse entries whose names fold to the same file + (e.g. Unicode variants), which could overwrite each other + (GHSA-rrfc-2x66-j7xh) + * Decode LZ4 and Brotli in 7z archives made with 7-Zip ZS + * Restore folder permissions and mtimes on extraction + * Refuse 7z archives with undecodable methods before changing + anything, instead of stopping with the archive partly freed + * Allow ':' in entry names outside Windows + * GUI: actions stay reachable at minimum window size; Spanish + translation + * Vendor the locked dependency tree (new brotli, lz4_flex, + twox-hash and unicode-normalization crates; main package + License gains Unicode-3.0 for unicode-normalization) + * Rebase hatchzip-no-unrar.patch for the new Cargo feature layout + +------------------------------------------------------------------- Old: ---- hatchzip-0.1.9.tar.zst New: ---- hatchzip-0.1.10.tar.zst ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ hatchzip.spec ++++++ --- /var/tmp/diff_new_pack.fpYgmo/_old 2026-11-10 14:45:45.710991693 +0100 +++ /var/tmp/diff_new_pack.fpYgmo/_new 2026-11-10 14:45:45.711991734 +0100 @@ -17,13 +17,13 @@ Name: hatchzip -Version: 0.1.9 +Version: 0.1.10 Release: 0 Summary: Archive extractor that needs free space for the extracted files only # Legal-Review-Notice: UnRAR is not built or shipped: unrar-ng-sys is # left out of vendor.tar.zst. Its licence text (LICENSE-UNRAR, # packaging/linux/copyright) is in the source tarball only. -License: MIT AND Apache-2.0 AND BSD-3-Clause AND MIT-0 AND Zlib AND bzip2-1.0.6 +License: MIT AND Apache-2.0 AND BSD-3-Clause AND MIT-0 AND Unicode-3.0 AND Zlib AND bzip2-1.0.6 URL: https://github.com/xevrion/hatchzip Source0: %{name}-%{version}.tar.zst # cargo_vendor's output without UnRAR, whose licence is not open source: @@ -31,9 +31,9 @@ # Codec and fuzz-corpus test archives embed a Windows game/tool.exe fixture; # the libloading crate ships its Windows-only test DLLs. All are read only # by tests, never built, loaded or shipped on Linux. -# Source-Binary-Exception: hatchzip-0.1.9.tar.zst:**/tests/fixtures/** -- test-data: upstream codec and RAR test vectors, read only by the test suite -# Source-Binary-Exception: hatchzip-0.1.9.tar.zst:**/src/archive/fixtures/** -- test-data: upstream xz decoder test vectors, read only by unit tests -# Source-Binary-Exception: hatchzip-0.1.9.tar.zst:**/fuzz/corpus/** -- test-data: fuzz corpus archives, read only by fuzz targets and tests +# Source-Binary-Exception: hatchzip-0.1.10.tar.zst:**/tests/fixtures/** -- test-data: upstream codec and RAR test vectors, read only by the test suite +# Source-Binary-Exception: hatchzip-0.1.10.tar.zst:**/src/archive/fixtures/** -- test-data: upstream xz decoder test vectors, read only by unit tests +# Source-Binary-Exception: hatchzip-0.1.10.tar.zst:**/fuzz/corpus/** -- test-data: fuzz corpus archives, read only by fuzz targets and tests # Source-Binary-Exception: vendor.tar.zst:vendor/libz-rs-sys-*/src/test-data/* -- test-data: libz-rs-sys gzip decoder test vector, read only by its tests # Source-Binary-Exception: vendor.tar.zst:vendor/libloading-*/tests/*.dll -- test-data: fixtures loaded only by libloading's Windows-only tests, never on Linux # Source-Binary-Exception: vendor.tar.zst:vendor/sevenz-rust2-*/tests/** -- test-data: sevenz-rust2's own test archives, read only by its test suite ++++++ _service ++++++ --- /var/tmp/diff_new_pack.fpYgmo/_old 2026-11-10 14:45:45.746993201 +0100 +++ /var/tmp/diff_new_pack.fpYgmo/_new 2026-11-10 14:45:45.750993368 +0100 @@ -2,7 +2,7 @@ <service name="obs_scm" mode="manual"> <param name="url">https://github.com/xevrion/hatchzip.git</param> <param name="scm">git</param> - <param name="revision">refs/tags/v0.1.9</param> + <param name="revision">refs/tags/v0.1.10</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> </service> ++++++ hatchzip-0.1.9.tar.zst -> hatchzip-0.1.10.tar.zst ++++++ ++++ 3985 lines of diff (skipped) ++++++ hatchzip-no-unrar.patch ++++++ --- /var/tmp/diff_new_pack.fpYgmo/_old 2026-11-10 14:45:45.993003507 +0100 +++ /var/tmp/diff_new_pack.fpYgmo/_new 2026-11-10 14:45:46.001003842 +0100 @@ -1,9 +1,10 @@ +diff -uNr a/crates/core/Cargo.toml b/crates/core/Cargo.toml --- a/crates/core/Cargo.toml +++ b/crates/core/Cargo.toml -@@ -29,12 +29,6 @@ - serde_json.workspace = true - sevenz-rust2.workspace = true - tar.workspace = true +@@ -32,12 +32,6 @@ + # Comparing names the way filesystems fold them: APFS, HFS+ and casefolded + # ext4 folders treat the NFC and NFD forms of a name as one. + unicode-normalization = "0.1.24" -# The UnRAR decoder, bound without the safe wrapper: it needs the data -# callback, which the safe crates don't expose. The bindings are MIT or -# Apache; the UnRAR C++ source they build is under its own license, see @@ -13,7 +14,7 @@ # The RAR 5 password check value and header key, PBKDF2-HMAC-SHA256, and # AES-CBC for encrypted RAR headers; all already in the tree through zip and # sevenz-rust2. -@@ -51,7 +45,7 @@ +@@ -75,7 +69,7 @@ # RAR archives, decoded by UnRAR. Off by default: without it the build is # open source throughout and needs no C++ compiler, and a RAR archive is # refused before anything is touched. The release builds turn it on. @@ -22,6 +23,7 @@ [target."cfg(unix)".dependencies] libc = "0.2.191" +diff -uNr a/packaging/linux/io.github.xevrion.hatchzip.desktop b/packaging/linux/io.github.xevrion.hatchzip.desktop --- a/packaging/linux/io.github.xevrion.hatchzip.desktop +++ b/packaging/linux/io.github.xevrion.hatchzip.desktop @@ -7,5 +7,5 @@ @@ -31,6 +33,7 @@ -MimeType=application/zip;application/x-zip-compressed;application/x-7z-compressed;application/x-tar;application/x-compressed-tar;application/x-xz-compressed-tar;application/vnd.rar;application/x-rar;application/x-rar-compressed; +MimeType=application/zip;application/x-zip-compressed;application/x-7z-compressed;application/x-tar;application/x-compressed-tar;application/x-xz-compressed-tar; Keywords=zip;7z;tar;unzip;extract;archive;split; +diff -uNr a/packaging/linux/io.github.xevrion.hatchzip.metainfo.xml b/packaging/linux/io.github.xevrion.hatchzip.metainfo.xml --- a/packaging/linux/io.github.xevrion.hatchzip.metainfo.xml +++ b/packaging/linux/io.github.xevrion.hatchzip.metainfo.xml @@ -24,7 +24,7 @@ ++++++ vendor.tar.zst ++++++ /work/SRC/openSUSE:Factory/hatchzip/vendor.tar.zst /work/SRC/openSUSE:Factory/.hatchzip.new.3759290/vendor.tar.zst differ: char 8, line 1
