.gitignore

@@ -1 +1 @@
-SOURCES/xz-5.2.5.tar.xz
+/xz-5.2.4.tar.xz

.xz.metadata

@@ -1 +0,0 @@
-0b9d1e06b59f7fe0796afe1d93851b9306b4a3b6 SOURCES/xz-5.2.5.tar.xz

SOURCES/xz-5.2.5-cve-2022-1271.patch

@@ -1,94 +0,0 @@
-From 69d1b3fc29677af8ade8dc15dba83f0589cb63d6 Mon Sep 17 00:00:00 2001
-From: Lasse Collin <lasse.collin@tukaani.org>
-Date: Tue, 29 Mar 2022 19:19:12 +0300
-Subject: [PATCH] xzgrep: Fix escaping of malicious filenames (ZDI-CAN-16587).
-
-Malicious filenames can make xzgrep to write to arbitrary files
-or (with a GNU sed extension) lead to arbitrary code execution.
-
-xzgrep from XZ Utils versions up to and including 5.2.5 are
-affected. 5.3.1alpha and 5.3.2alpha are affected as well.
-This patch works for all of them.
-
-This bug was inherited from gzip's zgrep. gzip 1.12 includes
-a fix for zgrep.
-
-The issue with the old sed script is that with multiple newlines,
-the N-command will read the second line of input, then the
-s-commands will be skipped because it's not the end of the
-file yet, then a new sed cycle starts and the pattern space
-is printed and emptied. So only the last line or two get escaped.
-
-One way to fix this would be to read all lines into the pattern
-space first. However, the included fix is even simpler: All lines
-except the last line get a backslash appended at the end. To ensure
-that shell command substitution doesn't eat a possible trailing
-newline, a colon is appended to the filename before escaping.
-The colon is later used to separate the filename from the grep
-output so it is fine to add it here instead of a few lines later.
-
-The old code also wasn't POSIX compliant as it used \n in the
-replacement section of the s-command. Using \<newline> is the
-POSIX compatible method.
-
-LC_ALL=C was added to the two critical sed commands. POSIX sed
-manual recommends it when using sed to manipulate pathnames
-because in other locales invalid multibyte sequences might
-cause issues with some sed implementations. In case of GNU sed,
-these particular sed scripts wouldn't have such problems but some
-other scripts could have, see:
-
-    info '(sed)Locale Considerations'
-
-This vulnerability was discovered by:
-cleemy desu wayo working with Trend Micro Zero Day Initiative
-
-Thanks to Jim Meyering and Paul Eggert discussing the different
-ways to fix this and for coordinating the patch release schedule
-with gzip.
----
- src/scripts/xzgrep.in | 20 ++++++++++++--------
- 1 file changed, 12 insertions(+), 8 deletions(-)
-
-diff --git a/src/scripts/xzgrep.in b/src/scripts/xzgrep.in
-index b180936..e5186ba 100644
---- a/src/scripts/xzgrep.in
-+++ b/src/scripts/xzgrep.in
-@@ -180,22 +180,26 @@ for i; do
-          { test $# -eq 1 || test $no_filename -eq 1; }; then
-       eval "$grep"
-     else
-+      # Append a colon so that the last character will never be a newline
-+      # which would otherwise get lost in shell command substitution.
-+      i="$i:"
-+
-+      # Escape & \ | and newlines only if such characters are present
-+      # (speed optimization).
-       case $i in
-       (*'
- '* | *'&'* | *'\'* | *'|'*)
--        i=$(printf '%s\n' "$i" |
--            sed '
--              $!N
--              $s/[&\|]/\\&/g
--              $s/\n/\\n/g
--            ');;
-+        i=$(printf '%s\n' "$i" | LC_ALL=C sed 's/[&\|]/\\&/g; $!s/$/\\/');;
-       esac
--      sed_script="s|^|$i:|"
-+
-+      # $i already ends with a colon so don't add it here.
-+      sed_script="s|^|$i|"
- 
-       # Fail if grep or sed fails.
-       r=$(
-         exec 4>&1
--        (eval "$grep" 4>&-; echo $? >&4) 3>&- | sed "$sed_script" >&3 4>&-
-+        (eval "$grep" 4>&-; echo $? >&4) 3>&- |
-+            LC_ALL=C sed "$sed_script" >&3 4>&-
-       ) || r=2
-       exit $r
-     fi >&3 5>&-
--- 
-2.35.1
-

SOURCES/xz-5.2.5-enable_CET.patch

@@ -1,70 +0,0 @@
-From: H.J. Lu <hjl.tools@gmail.com>
-Date: Wed, 23 Dec 2020 15:49:04 +0100 (06:49 -0800)
-Subject: [PATCH] liblzma: Enable Intel CET in x86 CRC assembly codes
-
-When Intel CET is enabled, we need to include <cet.h> in assembly codes
-to mark Intel CET support and add _CET_ENDBR to indirect jump targets.
-
-Tested on Intel Tiger Lake under CET enabled Linux.
----
- src/liblzma/check/crc32_x86.S | 9 +++++++++
- src/liblzma/check/crc64_x86.S | 9 +++++++++
- 2 files changed, 18 insertions(+)
-
-diff --git a/src/liblzma/check/crc32_x86.S b/src/liblzma/check/crc32_x86.S
-index 67f68a4..e3745e6 100644
---- a/src/liblzma/check/crc32_x86.S
-+++ b/src/liblzma/check/crc32_x86.S
-@@ -51,6 +51,14 @@ init_table(void)
-  * extern uint32_t lzma_crc32(const uint8_t *buf, size_t size, uint32_t crc);
-  */
- 
-+/* When Intel CET is enabled, include <cet.h> in assembly code to mark
-+   Intel CET support.  */
-+#ifdef __CET__
-+# include <cet.h>
-+#else
-+# define _CET_ENDBR
-+#endif
-+
- /*
-  * On some systems, the functions need to be prefixed. The prefix is
-  * usually an underscore.
-@@ -83,6 +91,7 @@ init_table(void)
- 
- 	ALIGN(4, 16)
- LZMA_CRC32:
-+	_CET_ENDBR
- 	/*
- 	 * Register usage:
- 	 * %eax crc
-diff --git a/src/liblzma/check/crc64_x86.S b/src/liblzma/check/crc64_x86.S
-index f5bb84b..7ee08f6 100644
---- a/src/liblzma/check/crc64_x86.S
-+++ b/src/liblzma/check/crc64_x86.S
-@@ -41,6 +41,14 @@ init_table(void)
-  * extern uint64_t lzma_crc64(const uint8_t *buf, size_t size, uint64_t crc);
-  */
- 
-+/* When Intel CET is enabled, include <cet.h> in assembly code to mark
-+   Intel CET support.  */
-+#ifdef __CET__
-+# include <cet.h>
-+#else
-+# define _CET_ENDBR
-+#endif
-+
- /*
-  * On some systems, the functions need to be prefixed. The prefix is
-  * usually an underscore.
-@@ -73,6 +81,7 @@ init_table(void)
- 
- 	ALIGN(4, 16)
- LZMA_CRC64:
-+	_CET_ENDBR
- 	/*
- 	 * Register usage:
- 	 * %eax crc LSB
--- 
-2.26.0
-

gating.yaml

@@ -0,0 +1,6 @@
+--- !Policy
+product_versions:
+  - rhel-8
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: baseos-ci.brew-build.tier1.functional}

sources

@@ -0,0 +1 @@
+SHA512 (xz-5.2.4.tar.xz) = 00db7dd31a61541b1ce6946e0f21106f418dd1ac3f27cdb8682979cbc3bd777cd6dd1f04f9ba257a0a7e24041e15ca40d0dd5c130380dce62280af67a0beb97f

xz.spec

@@ -3,23 +3,20 @@
 
 Summary:	LZMA compression utilities
 Name:		xz
-Version:	5.2.5
+Version:	5.2.4
-Release:	8%{?dist}
+Release:	3%{?dist}
 
 # Scripts xz{grep,diff,less,more} and symlinks (copied from gzip) are
 # GPLv2+, binaries are Public Domain (linked against LGPL getopt_long but its
 # OK), documentation is Public Domain.
 License:	GPLv2+ and Public Domain
 # official upstream release
-Source0:	https://tukaani.org/%{name}/%{name}-%{version}.tar.xz
+Source0:	http://tukaani.org/%{name}/%{name}-%{version}.tar.xz
 
 Source100:	colorxzgrep.sh
 Source101:	colorxzgrep.csh
 
-Patch1:   xz-5.2.5-enable_CET.patch
+URL:		http://tukaani.org/%{name}/
-Patch2:   xz-5.2.5-cve-2022-1271.patch
-
-URL:		https://tukaani.org/%{name}/
 Requires:	%{name}-libs%{?_isa} = %{version}-%{release}
 
 # For /usr/libexec/grepconf.sh (RHBZ#1189120).
@@ -27,7 +24,6 @@ Requires:	%{name}-libs%{?_isa} = %{version}-%{release}
 # have grepconf, but we're only concerned with F22 here.
 Requires:	grep >= 2.20-5
 
-BuildRequires:  make
 BuildRequires:	gcc
 BuildRequires:	perl-interpreter
 
@@ -84,7 +80,7 @@ commands that deal with the older LZMA format.
 
 
 %prep
-%autosetup -p1
+%autosetup
 
 
 %build
@@ -126,22 +122,21 @@ LD_LIBRARY_PATH=$PWD/src/liblzma/.libs make check
 
 
 %files -f %{name}.lang
-%license COPYING*
+%license %{_pkgdocdir}/COPYING*
 %doc %{_pkgdocdir}
 %exclude %_pkgdocdir/examples*
 %{_bindir}/*xz*
 %{_mandir}/man1/*xz*
-%{_mandir}/de/man1/*xz*
 %{profiledir}/*
 
 
 %files libs
-%license COPYING
+%license %{_pkgdocdir}/COPYING
 %{_libdir}/lib*.so.5*
 
 
 %files static
-%license COPYING
+%license %{_pkgdocdir}/COPYING
 %{_libdir}/liblzma.a
 
 
@@ -157,55 +152,12 @@ LD_LIBRARY_PATH=$PWD/src/liblzma/.libs make check
 %files lzma-compat
 %{_bindir}/*lz*
 %{_mandir}/man1/*lz*
-%{_mandir}/de/man1/*lz*
 
 
 %changelog
-* Tue May 31 2022 Matej Mužila <mmuzila@redhat.com> - 5.2.5-8
+* Thu Nov 22 2018 Pavel Raiskup <praiskup@redhat.com> - 5.2.4-3
-- Fix arbitrary file write vulnerability
-  Resolves: CVE-2022-1271
-
-* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 5.2.5-7
-- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
-  Related: rhbz#1991688
-
-* Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 5.2.5-6
-- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
-
-* Thu Jan 28 2021 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.5-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Mon Jan 04 2021 Ondrej Dubaj <odubaj@redhat.com> - 5.2.5-4
-- Enabled CET for i686 (#1910368)
-
-* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.5-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Mon Jun  8 2020 Richard W.M. Jones <rjones@redhat.com> - 5.2.5-2
-- Fix location of German man pages (RHBZ#1844813).
-
-* Mon Mar 30 2020 Ondrej Dubaj <odubaj@redhat.com> - 5.2.5-1
-- Rebase to version 5.2.5 (#1818418)
-
-* Fri Jan 31 2020 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.4-8
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Wed Aug 21 2019 Petr Kubat <pkubat@redhat.com> - 5.2.4-7
-- Use relative path for COPYING files so that rpm moves them to correct place
-  Related: rhbz#1741074
-
-* Sat Jul 27 2019 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.4-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
-* Sun Feb 03 2019 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.4-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
-
-* Thu Nov 22 2018 Pavel Raiskup <praiskup@redhat.com> - 5.2.4-4
 - fix annocheck failures on i686 (rhbz#1630650)
 
-* Sat Jul 14 2018 Fedora Release Engineering <releng@fedoraproject.org> - 5.2.4-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
-
 * Wed May 09 2018 Pavel Raiskup <praiskup@redhat.com> - 5.2.4-2
 - drop ppc64p7 hack, per fedora devel list discussion:
   https://lists.fedoraproject.org/archives/list/