Dear all,
I'd like to propose replacing p7zip (already replaced by 7zip in Fedora) in EPEL 9.
Background: p7zip was the Unix port of 7-zip, but Unix support is eventually added. p7zip has not been updated since... 2016: https://sourceforge.net/projects/p7zip/
This is not quite a drop-in replacement - notably we're not shipping a GUI.
For Fedora, when we introduced 7-zip we only updated Rawhide, to limit the impact on stable releases -- apart from some packaging issues that are now mostly fixed, the only remaining issue is slower performance on x86_64 compared to the upstream binary since we currently don't have the assembler it needs packaged.
There are a lot of CVE issues that are basically unfixable affecting this old codebase - even for the newer 7zip we are basically forced to always ship the latest because releases tend to be driven by security issues.
See bugz.fedoraproject.org/p7zip
Just to pick one bug in particular, this references *two* high-severity vulnerabilities: https://bugzilla.redhat.com/show_bug.cgi?id=2403091
Given that we can retire packages even for lack of maintainer time, and definitely in case there are severe vulnerabilities -- I'm hoping a mostly-compatible update would be preferable.
Best regards,
On Tue, 2026-06-16 at 22:28 +0100, Michel Lind wrote:
Dear all,
I'd like to propose replacing p7zip (already replaced by 7zip in Fedora) in EPEL 9.
Correction: EPEL 8 and EPEL 9 - there are security bugs filed against EPEL 8 so it clearly has users affected by this
I have filed the issue for the steering committee to evaluate: https://forge.fedoraproject.org/epel/steering/issues/367
Best regards,
epel-devel@lists.fedoraproject.org
-
Michel Lind