X-Recipient:	archive-cygwin AT delorie DOT com
DKIM-Filter:	OpenDKIM Filter v2.11.0 sourceware.org 182CB3858C74
DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1711945029;
	bh=va/5iN8vn5DhLvD7DBL9Glw1RH6+zTsbxvIkDtNxej0=;
	h=Date:Subject:To:Cc:List-Id:List-Unsubscribe:List-Archive:
	List-Post:List-Help:List-Subscribe:From:Reply-To:From;
	b=NAE9nOx9CmR50BS2qyGzdl47uS0Uji4S7G01xHWezOG7hX0+t5jWR2f8zSMNEiJ+n
	LKROIBvn87CsX1gc87XVU74R6KLJizLs97Xhi/Ut1yRsMzVNS/XX2uF97XiwX7K98V
	+JJJtuNDYaFvIUlhjLkg3y+pQoHDIstmBU11obRY=
X-Original-To:	cygwin AT cygwin DOT com
Delivered-To:	cygwin AT cygwin DOT com
DMARC-Filter:	OpenDMARC Filter v1.4.2 sourceware.org 7F0D93858CD1
ARC-Filter:	OpenARC Filter v1.0.0 sourceware.org 7F0D93858CD1
ARC-Seal:	i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1711944961; cv=none;
	b=yDDoVDMNNzx5XozVUjcuqpwR5pX8M2xxsgRaTHJ71kLXxvwQOWHzlF5vme4rvIQk/qwUAY5mYuqFTFZEyn3W11UYclS5eoU3HPCkg3YjFepij/sMbNjtPPO39aTIVE4uJgT1ip/ISBhuF5YZcC8dTzxQkwxmUdXi1nXH03+XkMI=
ARC-Message-Signature:	i=1; a=rsa-sha256; d=sourceware.org; s=key;
	t=1711944961; c=relaxed/simple;
	bh=/T41MR56nNwm9N/iGlTV2MTIo8dY7EMuvTXc6QCWo4A=;
	h=DKIM-Signature:MIME-Version:From:Date:Message-ID:Subject:To;
	b=TX9IHnEiGq32up+4nZZAgkIjxO9eWMFvpXftZWZfi7mQ2g+RdP16Jc1MJnYqGChx4jOmu5NkJuqfe/jCtgzQ1pZHrUGALsTSYbz0gHmAu5H/vJSWxqm0BFYc1r7+RhoaK834POyNH4mYi1J0WYJeNp0hGWn2Ixe9+Qe1zE/EQp8=
ARC-Authentication-Results:	i=1; server2.sourceware.org
X-Google-DKIM-Signature:	v=1; a=rsa-sha256; c=relaxed/relaxed;
	d=1e100.net; s=20230601; t=1711944950; x=1712549750;
	h=cc:to:subject:message-id:date:from:mime-version:x-gm-message-state
	:from:to:cc:subject:date:message-id:reply-to;
	bh=UeN1FFwJNmJ5SPZqwRK3tfAh9f0jbUX7/2p9kmyOeIg=;
	b=ou/8W7GGljYfOcT/0CsbCMnHtkLix7cjB9N+MwcH4pPUzHrEQN1DCfng9/xykCHsQQ
	UFxjabYReABlfjCOmrmaltbrYdM/Ec6upaIMTaAdeBz/KC3z6e+jcTJG/+juNo/nNq0N
	j+aOuQfvH6WWwPgO/8GQXLeRf3FfKRJo1ZqlwF1rBDTaTCwis/1agEMl77HZhlDcio4L
	axh5T29fC1VU9RmJuzv6i5QxpqnVdPTgu0pzO57Zc0zD3rxgOvy56fuMY9oEPOisFEa7
	oQO4jfyBWbHiEiCVXfrSk48c+KtH+sk7x4R9zFj0TFKQR9Gwlk9Fa5AFWcDWiRT5BnXd
	tH6g==
X-Gm-Message-State:	AOJu0YyPDPk/neXkTVKAvDfM56wLFqFSXD5C1lqZFsLhBe/LGKk7ndXI
	1AbHfVbDMc8RJkbmxb3AdfW/XUN5bH4v8wmlvpFzhNaAooNHf1ukOE4DJ/vbZZTcnAec2fGE+7v
	337hildmNMC5kQ1SbRy8YrSpPHbA7E0SK/MWTVQ==
X-Google-Smtp-Source:	AGHT+IFbZCuJvJfKGeCYFRzistnLEhnNbDD2EJLBJcOx6u79BS2adM8fUz+6/DmonrgJSHr4i8wKa4+E9pPMJfBm55g=
X-Received:	by 2002:a17:907:940b:b0:a4e:a7a:84e0 with SMTP id
	dk11-20020a170907940b00b00a4e0a7a84e0mr6277511ejc.34.1711944949533; Sun, 31
	Mar 2024 21:15:49 -0700 (PDT)
MIME-Version:	1.0
Date:	Sun, 31 Mar 2024 21:15:38 -0700
Message-ID:	<CAAHpriNXOQxk6JaWZZ9axn0Ndh7-+iYrUcNYPeB5hVZR7DcKzg@mail.gmail.com>
Subject:	Re: Linux xz issue
To:	The Cygwin Mailing List <cygwin AT cygwin DOT com>
Cc:	Keith Thompson <Keith DOT S DOT Thompson AT gmail DOT com>
X-Spam-Status:	No, score=-0.8 required=5.0 tests=BAYES_00, DKIM_SIGNED,
	DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,
	SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version:	SpamAssassin 3.4.6 (2021-04-09) on
	server2.sourceware.org
X-BeenThere:	cygwin AT cygwin DOT com
X-Mailman-Version:	2.1.30
List-Id:	General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive:	<https://cygwin.com/pipermail/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe:	<https://cygwin.com/mailman/listinfo/cygwin>,
	<mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From:	Keith Thompson via Cygwin <cygwin AT cygwin DOT com>
Reply-To:	Keith Thompson <Keith DOT S DOT Thompson AT gmail DOT com>
Sender:	"Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>

Achim Gratz Stromeko AT Nexgo DOT DE wrote:
> Beyond that, the version 5.4.6 that everybody is currently reverting to
> (and is also still available for Cygwin if you want to go back) was
> already released when the presumed bad actor was co-maintainer and their
> involvement goes back even farther based on the Xz developer mailing
> list.  The repository has been deactivated by GitHub so I can't check
> there, but there is already some discussion about rolling back to 5.3.1
> or thereabouts.

The GitHub repo at <https://github.com/tukaani-project/xz> has been
deactivated, but there's another xz repo (likely the original one)
at <https://github.com/tukaani-project/xz>.  The most recent commit
in that repo is "CMake: Fix sabotaged Landlock sandbox check.".

I have no inside knowledge about any of this.

I'm running the Cygwin setup right now.  It reverts the xz package
from 5.6.1-1 to 5.4.6-1.  Only 5.4.2-1 and 5.4.6-1 are available.

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple

- Raw text -