From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-ed1-x531.google.com (mail-ed1-x531.google.com [IPv6:2a00:1450:4864:20::531]) by sourceware.org (Postfix) with ESMTPS id 7F0D93858CD1 for ; Mon, 1 Apr 2024 04:15:51 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 7F0D93858CD1 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 7F0D93858CD1 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2a00:1450:4864:20::531 ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1711944961; cv=none; b=yDDoVDMNNzx5XozVUjcuqpwR5pX8M2xxsgRaTHJ71kLXxvwQOWHzlF5vme4rvIQk/qwUAY5mYuqFTFZEyn3W11UYclS5eoU3HPCkg3YjFepij/sMbNjtPPO39aTIVE4uJgT1ip/ISBhuF5YZcC8dTzxQkwxmUdXi1nXH03+XkMI= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1711944961; c=relaxed/simple; bh=/T41MR56nNwm9N/iGlTV2MTIo8dY7EMuvTXc6QCWo4A=; h=DKIM-Signature:MIME-Version:From:Date:Message-ID:Subject:To; b=TX9IHnEiGq32up+4nZZAgkIjxO9eWMFvpXftZWZfi7mQ2g+RdP16Jc1MJnYqGChx4jOmu5NkJuqfe/jCtgzQ1pZHrUGALsTSYbz0gHmAu5H/vJSWxqm0BFYc1r7+RhoaK834POyNH4mYi1J0WYJeNp0hGWn2Ixe9+Qe1zE/EQp8= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-ed1-x531.google.com with SMTP id 4fb4d7f45d1cf-56be32b9775so4694590a12.1 for ; Sun, 31 Mar 2024 21:15:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1711944950; x=1712549750; darn=cygwin.com; h=cc:to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=UeN1FFwJNmJ5SPZqwRK3tfAh9f0jbUX7/2p9kmyOeIg=; b=fFCp18bePXxpNtbbWEBj6MCOJw2pjpvp6pgncm+tnuZXgWKeKUJS/Oq6XJOdqHjgVx gH1MUAGQVkx9dIYAWhR/95oeLDe6riYCQjxbhqYHDT/e5O0+pZCVKrtqLw8GEyscZOoS 6SJ0ZA6ilm3lHVZgtLhiBUipQxNi9+wsgLpO2PzBg9ERLSX0/x0zqaIpqdGdMy3GcA9W Tmn+2qYWquGgjP2TEZexgMn1w1yukJhLC8i1ZRUfMlQVjWMPyl8hW/iMnAB7ZRB/W7mm Pi1+JHF11J4lgtKOwTchURHF+FUpRJePPh/7K1v/KHv5mVaxtr0ZV21Hqt0E50rJjE3J owWQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1711944950; x=1712549750; h=cc:to:subject:message-id:date:from:mime-version:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=UeN1FFwJNmJ5SPZqwRK3tfAh9f0jbUX7/2p9kmyOeIg=; b=ou/8W7GGljYfOcT/0CsbCMnHtkLix7cjB9N+MwcH4pPUzHrEQN1DCfng9/xykCHsQQ UFxjabYReABlfjCOmrmaltbrYdM/Ec6upaIMTaAdeBz/KC3z6e+jcTJG/+juNo/nNq0N j+aOuQfvH6WWwPgO/8GQXLeRf3FfKRJo1ZqlwF1rBDTaTCwis/1agEMl77HZhlDcio4L axh5T29fC1VU9RmJuzv6i5QxpqnVdPTgu0pzO57Zc0zD3rxgOvy56fuMY9oEPOisFEa7 oQO4jfyBWbHiEiCVXfrSk48c+KtH+sk7x4R9zFj0TFKQR9Gwlk9Fa5AFWcDWiRT5BnXd tH6g== X-Gm-Message-State: AOJu0YyPDPk/neXkTVKAvDfM56wLFqFSXD5C1lqZFsLhBe/LGKk7ndXI 1AbHfVbDMc8RJkbmxb3AdfW/XUN5bH4v8wmlvpFzhNaAooNHf1ukOE4DJ/vbZZTcnAec2fGE+7v 337hildmNMC5kQ1SbRy8YrSpPHbA7E0SK/MWTVQ== X-Google-Smtp-Source: AGHT+IFbZCuJvJfKGeCYFRzistnLEhnNbDD2EJLBJcOx6u79BS2adM8fUz+6/DmonrgJSHr4i8wKa4+E9pPMJfBm55g= X-Received: by 2002:a17:907:940b:b0:a4e:a7a:84e0 with SMTP id dk11-20020a170907940b00b00a4e0a7a84e0mr6277511ejc.34.1711944949533; Sun, 31 Mar 2024 21:15:49 -0700 (PDT) MIME-Version: 1.0 From: Keith Thompson Date: Sun, 31 Mar 2024 21:15:38 -0700 Message-ID: Subject: Re: Linux xz issue To: The Cygwin Mailing List Cc: Keith Thompson Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-0.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS,TXREP autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org List-Id: Achim Gratz Stromeko@Nexgo.DE wrote: > Beyond that, the version 5.4.6 that everybody is currently reverting to > (and is also still available for Cygwin if you want to go back) was > already released when the presumed bad actor was co-maintainer and their > involvement goes back even farther based on the Xz developer mailing > list. The repository has been deactivated by GitHub so I can't check > there, but there is already some discussion about rolling back to 5.3.1 > or thereabouts. The GitHub repo at has been deactivated, but there's another xz repo (likely the original one) at . The most recent commit in that repo is "CMake: Fix sabotaged Landlock sandbox check.". I have no inside knowledge about any of this. I'm running the Cygwin setup right now. It reverts the xz package from 5.6.1-1 to 5.4.6-1. Only 5.4.2-1 and 5.4.6-1 are available.