FYI xz 5.4.1 in Fedora updates (F36, F37, Rawhide)

[Richard W.M. Jones]

F36: https://bodhi.fedoraproject.org/updates/FEDORA-2023-d823c8dfb8

F37: https://bodhi.fedoraproject.org/updates/FEDORA-2023-8362bcf475

One package which is known to depend on the exact version of xz is
perl-Compress-Raw-Lzma.  The updates above should do the right thing.

As far as I'm aware there are no other packages that depend on the
exact version of xz (or liblzma) and no breaking changes to liblzma,
but if there are please let us know.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-top is 'top' for virtual machines.  Tiny program with many
powerful monitoring features, net stats, disk stats, logging, etc.
http://people.redhat.com/~rjones/virt-top

[Miro Hrončok]

On 23. 01. 23 15:39, Richard W.M. Jones wrote:
>  
>  F36: https://bodhi.fedoraproject.org/updates/FEDORA-2023-d823c8dfb8
>  
>  F37: https://bodhi.fedoraproject.org/updates/FEDORA-2023-8362bcf475
>  
>  One package which is known to depend on the exact version of xz is
>  perl-Compress-Raw-Lzma.  The updates above should do the right thing.
>  
>  As far as I'm aware there are no other packages that depend on the
>  exact version of xz (or liblzma) and no breaking changes to liblzma,
>  but if there are please let us know. 
For the record, Pythons now FTBFS with:

======================================================================
FAIL: test_unzip_zipfile (test.test_shutil.TestArchives.test_unzip_zipfile)
----------------------------------------------------------------------
Traceback (most recent call last):
   File "/builddir/build/BUILD/Python-3.12.0a4/Lib/test/test_shutil.py", line 
1514, in test_unzip_zipfile
     subprocess.check_output(zip_cmd, stderr=subprocess.STDOUT)
   File "/builddir/build/BUILD/Python-3.12.0a4/Lib/subprocess.py", line 466, in

check_output
     return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
   File "/builddir/build/BUILD/Python-3.12.0a4/Lib/subprocess.py", line 571, in
run
     raise CalledProcessError(retcode, process.args,
subprocess.CalledProcessError: Command '['unzip', '-t', 
'/builddir/build/BUILD/Python-3.12.0a4/build/debug/build/test_python_64979æ/tmpau1avwr6/archive.zip']'

returned non-zero exit status 80.
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
   File "/builddir/build/BUILD/Python-3.12.0a4/Lib/test/test_shutil.py", line 
1520, in test_unzip_zipfile
     self.fail(msg.format(exc, details))
AssertionError: Command '['unzip', '-t', 
'/builddir/build/BUILD/Python-3.12.0a4/build/debug/build/test_python_64979æ/tmpau1avwr6/archive.zip']'

returned non-zero exit status 80.
**Unzip Output**
Archive: 
/builddir/build/BUILD/Python-3.12.0a4/build/debug/build/test_python_64979æ/tmpau1avwr6/archive.zip
*** buffer overflow detected ***: terminated
----------------------------------------------------------------------


I have not yet verified this is cuased by new xz, but it is one of the suspects.

https://koschei.fedoraproject.org/package/python3.12?collection=f38


-- 
Miro Hrončok
-- 
Phone: [phone]
IRC: mhroncok

[Miro Hrončok]

On 24. 01. 23 16:20, Miro Hrončok wrote:
>  On 23. 01. 23 15:39, Richard W.M. Jones wrote:
> >
> > F36: https://bodhi.fedoraproject.org/updates/FEDORA-2023-d823c8dfb8
> >
> > F37: https://bodhi.fedoraproject.org/updates/FEDORA-2023-8362bcf475
> >
> > One package which is known to depend on the exact version of xz is
> > perl-Compress-Raw-Lzma.  The updates above should do the right thing.
> >
> > As far as I'm aware there are no other packages that depend on the
> > exact version of xz (or liblzma) and no breaking changes to liblzma,
> > but if there are please let us know.
>  
>  For the record, Pythons now FTBFS with:
>  
>  ======================================================================
>  FAIL: test_unzip_zipfile (test.test_shutil.TestArchives.test_unzip_zipfile)
>  ----------------------------------------------------------------------
>  Traceback (most recent call last):
>     File "/builddir/build/BUILD/Python-3.12.0a4/Lib/test/test_shutil.py", line 
>  1514, in test_unzip_zipfile
>       subprocess.check_output(zip_cmd, stderr=subprocess.STDOUT)
>     File "/builddir/build/BUILD/Python-3.12.0a4/Lib/subprocess.py", line 466, in
>
>  check_output
>       return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
>              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>     File "/builddir/build/BUILD/Python-3.12.0a4/Lib/subprocess.py", line 571, in
>
>  run
>       raise CalledProcessError(retcode, process.args,
>  subprocess.CalledProcessError: Command '['unzip', '-t', 
>
> '/builddir/build/BUILD/Python-3.12.0a4/build/debug/build/test_python_64979æ/tmpau1avwr6/archive.zip']'
> returned non-zero exit status 80.
>  During handling of the above exception, another exception occurred:
>  Traceback (most recent call last):
>     File "/builddir/build/BUILD/Python-3.12.0a4/Lib/test/test_shutil.py", line 
>  1520, in test_unzip_zipfile
>       self.fail(msg.format(exc, details))
>  AssertionError: Command '['unzip', '-t', 
>
> '/builddir/build/BUILD/Python-3.12.0a4/build/debug/build/test_python_64979æ/tmpau1avwr6/archive.zip']'
> returned non-zero exit status 80.
>  **Unzip Output**
>  Archive: 
>
> /builddir/build/BUILD/Python-3.12.0a4/build/debug/build/test_python_64979æ/tmpau1avwr6/archive.zip
>  *** buffer overflow detected ***: terminated
>  ----------------------------------------------------------------------
>  
>  
>  I have not yet verified this is cuased by new xz, but it is one of the suspects.
>  
>  https://koschei.fedoraproject.org/package/python3.12?collection=f38 
I cannot reproduce this in mock just by updating xz, so it seems it is unrelated.

-- 
Miro Hrončok
-- 
Phone: [phone]
IRC: mhroncok

[Miro Hrončok]

On 24. 01. 23 17:21, Miro Hrončok wrote:
>  On 24. 01. 23 16:20, Miro Hrončok wrote:
> > On 23. 01. 23 15:39, Richard W.M. Jones wrote:
> >>
> >> F36: https://bodhi.fedoraproject.org/updates/FEDORA-2023-d823c8dfb8
> >>
> >> F37: https://bodhi.fedoraproject.org/updates/FEDORA-2023-8362bcf475
> >>
> >> One package which is known to depend on the exact version of xz is
> >> perl-Compress-Raw-Lzma.  The updates above should do the right thing.
> >>
> >> As far as I'm aware there are no other packages that depend on the
> >> exact version of xz (or liblzma) and no breaking changes to liblzma,
> >> but if there are please let us know.
> >
> > For the record, Pythons now FTBFS with:
> >
> > ======================================================================
> > FAIL: test_unzip_zipfile (test.test_shutil.TestArchives.test_unzip_zipfile)
> > ----------------------------------------------------------------------
> > Traceback (most recent call last):
> >    File "/builddir/build/BUILD/Python-3.12.0a4/Lib/test/test_shutil.py",
> line 
> > 1514, in test_unzip_zipfile
> >      subprocess.check_output(zip_cmd, stderr=subprocess.STDOUT)
> >    File "/builddir/build/BUILD/Python-3.12.0a4/Lib/subprocess.py", line
> 466, 
> > in check_output
> >      return run(*popenargs, stdout=PIPE, timeout=timeout, check=True,
> >             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> >    File "/builddir/build/BUILD/Python-3.12.0a4/Lib/subprocess.py", line
> 571, 
> > in run
> >      raise CalledProcessError(retcode, process.args,
> > subprocess.CalledProcessError: Command '['unzip', '-t', 
> >
> '/builddir/build/BUILD/Python-3.12.0a4/build/debug/build/test_python_64979æ/tmpau1avwr6/archive.zip']'
> returned non-zero exit status 80.
> > During handling of the above exception, another exception occurred:
> > Traceback (most recent call last):
> >    File "/builddir/build/BUILD/Python-3.12.0a4/Lib/test/test_shutil.py",
> line 
> > 1520, in test_unzip_zipfile
> >      self.fail(msg.format(exc, details))
> > AssertionError: Command '['unzip', '-t', 
> >
> '/builddir/build/BUILD/Python-3.12.0a4/build/debug/build/test_python_64979æ/tmpau1avwr6/archive.zip']'
> returned non-zero exit status 80.
> > **Unzip Output**
> > Archive: 
> >
> /builddir/build/BUILD/Python-3.12.0a4/build/debug/build/test_python_64979æ/tmpau1avwr6/archive.zip
> > *** buffer overflow detected ***: terminated
> > ----------------------------------------------------------------------
> >
> >
> > I have not yet verified this is cuased by new xz, but it is one of the suspects.
> >
> > https://koschei.fedoraproject.org/package/python3.12?collection=f38
>  
>  I cannot reproduce this in mock just by updating xz, so it seems it is unrelated. 
I forgot to follow up. It is unzip:

https://bugzilla.redhat.com/show_bug.cgi?id=2164068

-- 
Miro Hrončok
-- 
Phone: [phone]
IRC: mhroncok

[Zbigniew Jędrzejewski-Szmek]

On Tue, Jan 24, 2023 at 04:20:41PM +0100, Miro Hrončok wrote:
>  subprocess.CalledProcessError: Command '['unzip',
> '-t',
> '/builddir/build/BUILD/Python-3.12.0a4/build/debug/build/test_python_64979æ/tmpau1avwr6/archive.zip']'
>  returned non-zero exit status 80. 
>  **Unzip Output**
>  Archive:
> /builddir/build/BUILD/Python-3.12.0a4/build/debug/build/test_python_64979æ/tmpau1avwr6/archive.zip
>  *** buffer overflow detected ***: terminated
>  ---------------------------------------------------------------------- 
>  I have not yet verified this is cuased by new xz, but it is one of
> the suspects.
>  
>  https://koschei.fedoraproject.org/package/python3.12?collection=f38 
It seems that 'unzip' fails, so not related to xz?
My guess would be that this is _FORTIFY_SOURCE=3 catching some bug in unzip.

Zbyszek

[Miro Hrončok]

On 25. 01. 23 11:16, Zbigniew Jędrzejewski-Szmek wrote:
>  On Tue, Jan 24, 2023 at 04:20:41PM +0100, Miro Hrončok wrote:
> > subprocess.CalledProcessError: Command '['unzip', '-t',
> '/builddir/build/BUILD/Python-3.12.0a4/build/debug/build/test_python_64979æ/tmpau1avwr6/archive.zip']'
> > returned non-zero exit status 80.
>  
> > **Unzip Output**
> > Archive:
> /builddir/build/BUILD/Python-3.12.0a4/build/debug/build/test_python_64979æ/tmpau1avwr6/archive.zip
> > *** buffer overflow detected ***: terminated
> > ----------------------------------------------------------------------
>  
> > I have not yet verified this is cuased by new xz, but it is one of the suspects.
> >
> > https://koschei.fedoraproject.org/package/python3.12?collection=f38
>  
>  It seems that 'unzip' fails, so not related to xz? 
Correct: https://bugzilla.redhat.com/show_bug.cgi?id=2164068

>  My guess would be that this is _FORTIFY_SOURCE=3 catching some bug in
> unzip. 
That is a possibility.

-- 
Miro Hrončok
-- 
Phone: [phone]
IRC: mhroncok