URL moved back to direct tarball download. PGP signed artifacts are present on release pages at GitHub/Codeberg/Sourceforge, and download section on authors site links to GitHub anyways. Checksums should match checksums from other distributions again.
5.8.2 fixed mainly minor build issues. Announcement for 5.8.3: > IMPORTANT: This includes a fix for CVE-2026-34743 which affects all XZ > Utils versions since 5.0.0. No new 5.2.x, 5.4.x, or 5.6.x releases will > be made, but the fix is in the v5.2, v5.4, and v5.6 branches in the xz > Git repository. Announcement for 5.8.4: > IMPORTANT: This includes a fix for a security issue that affects all XZ > Utils versions since 5.0.0. This and a few other fixes have also been > committed to the old stable branches (v5.2, v5.4, and v5.6) in the xz > Git repository. Those fixes are marked below. No new 5.2.x, 5.4.x, or > 5.6.x releases will be made. Contact address of Free Software Foundation changed in license files, otherwise unchanged. Link: https://tukaani.org/xz/#_stable Link: https://github.com/tukaani-project/xz/releases#release-v5.8.2 Link: https://github.com/tukaani-project/xz/releases#release-v5.8.3 Link: https://github.com/tukaani-project/xz/releases#release-v5.8.4 Signed-off-by: Alexander Dahl <[email protected]> --- Notes: Not sure what security gain we have from tarballs created by GitHub? This just makes packaging harder. rules/xz.make | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/rules/xz.make b/rules/xz.make index fa8b544e5..d93ff2cf8 100644 --- a/rules/xz.make +++ b/rules/xz.make @@ -14,19 +14,19 @@ PACKAGES-$(PTXCONF_XZ) += xz # # Paths and names # -XZ_VERSION := 5.8.1 -XZ_SHA256 := bdbc23fbf9098843357e71e49685724fda2c320c29cb1b25fd90505f14bb0b3d +XZ_VERSION := 5.8.4 +XZ_SHA256 := 0014c7886930454fe8bd4228665b51af55eeae560ea135c9c4cd33f55b2591d9 XZ := xz-$(XZ_VERSION) XZ_SUFFIX := tar.gz -XZ_URL := https://github.com/tukaani-project/xz/archive/refs/tags/v$(XZ_VERSION).$(XZ_SUFFIX) +XZ_URL := https://github.com/tukaani-project/xz/releases/download/v$(XZ_VERSION)/$(XZ).$(XZ_SUFFIX) XZ_SOURCE := $(SRCDIR)/$(XZ).$(XZ_SUFFIX) XZ_DIR := $(BUILDDIR)/$(XZ) XZ_LICENSE := 0BSD AND public_domain AND LGPL-2.1-or-later AND GPL-2.0-or-later AND GPL-3.0-or-later XZ_LICENSE_FILES := \ file://COPYING;md5=d38d562f6112174de93a9677682231b2 \ - file://COPYING.GPLv2;md5=b234ee4d69f5fce4486a80fdaf4a4263 \ + file://COPYING.GPLv2;md5=570a9b3749dd0463a1778803b12a6dce \ file://COPYING.GPLv3;md5=1ebbd3e34237af26da5dc08a4e440464 \ - file://COPYING.LGPLv2.1;md5=4fbd65380cdd255951079008b364516c + file://COPYING.LGPLv2.1;md5=4bf661c1e3793e55c8d1051bc5e0ae21 # ---------------------------------------------------------------------------- # Prepare base-commit: 32189152b5ddb01bf113a5c88c3efa8196acfeb5 -- 2.47.3
