X-Recipient: archive-cygwin AT delorie DOT com
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 182CB3858C74
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cygwin.com;
	s=default; t=1711945029;
	bh=va/5iN8vn5DhLvD7DBL9Glw1RH6+zTsbxvIkDtNxej0=;
	h=Date:Subject:To:Cc:List-Id:List-Unsubscribe:List-Archive:
	 List-Post:List-Help:List-Subscribe:From:Reply-To:From;
	b=NAE9nOx9CmR50BS2qyGzdl47uS0Uji4S7G01xHWezOG7hX0+t5jWR2f8zSMNEiJ+n
	 LKROIBvn87CsX1gc87XVU74R6KLJizLs97Xhi/Ut1yRsMzVNS/XX2uF97XiwX7K98V
	 +JJJtuNDYaFvIUlhjLkg3y+pQoHDIstmBU11obRY=
X-Original-To: cygwin AT cygwin DOT com
Delivered-To: cygwin AT cygwin DOT com
DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org 7F0D93858CD1
ARC-Filter: OpenARC Filter v1.0.0 sourceware.org 7F0D93858CD1
ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1711944961; cv=none;
 b=yDDoVDMNNzx5XozVUjcuqpwR5pX8M2xxsgRaTHJ71kLXxvwQOWHzlF5vme4rvIQk/qwUAY5mYuqFTFZEyn3W11UYclS5eoU3HPCkg3YjFepij/sMbNjtPPO39aTIVE4uJgT1ip/ISBhuF5YZcC8dTzxQkwxmUdXi1nXH03+XkMI=
ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key;
 t=1711944961; c=relaxed/simple;
 bh=/T41MR56nNwm9N/iGlTV2MTIo8dY7EMuvTXc6QCWo4A=;
 h=DKIM-Signature:MIME-Version:From:Date:Message-ID:Subject:To;
 b=TX9IHnEiGq32up+4nZZAgkIjxO9eWMFvpXftZWZfi7mQ2g+RdP16Jc1MJnYqGChx4jOmu5NkJuqfe/jCtgzQ1pZHrUGALsTSYbz0gHmAu5H/vJSWxqm0BFYc1r7+RhoaK834POyNH4mYi1J0WYJeNp0hGWn2Ixe9+Qe1zE/EQp8=
ARC-Authentication-Results: i=1; server2.sourceware.org
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20230601; t=1711944950; x=1712549750;
 h=cc:to:subject:message-id:date:from:mime-version:x-gm-message-state
 :from:to:cc:subject:date:message-id:reply-to;
 bh=UeN1FFwJNmJ5SPZqwRK3tfAh9f0jbUX7/2p9kmyOeIg=;
 b=ou/8W7GGljYfOcT/0CsbCMnHtkLix7cjB9N+MwcH4pPUzHrEQN1DCfng9/xykCHsQQ
 UFxjabYReABlfjCOmrmaltbrYdM/Ec6upaIMTaAdeBz/KC3z6e+jcTJG/+juNo/nNq0N
 j+aOuQfvH6WWwPgO/8GQXLeRf3FfKRJo1ZqlwF1rBDTaTCwis/1agEMl77HZhlDcio4L
 axh5T29fC1VU9RmJuzv6i5QxpqnVdPTgu0pzO57Zc0zD3rxgOvy56fuMY9oEPOisFEa7
 oQO4jfyBWbHiEiCVXfrSk48c+KtH+sk7x4R9zFj0TFKQR9Gwlk9Fa5AFWcDWiRT5BnXd
 tH6g==
X-Gm-Message-State: AOJu0YyPDPk/neXkTVKAvDfM56wLFqFSXD5C1lqZFsLhBe/LGKk7ndXI
 1AbHfVbDMc8RJkbmxb3AdfW/XUN5bH4v8wmlvpFzhNaAooNHf1ukOE4DJ/vbZZTcnAec2fGE+7v
 337hildmNMC5kQ1SbRy8YrSpPHbA7E0SK/MWTVQ==
X-Google-Smtp-Source: AGHT+IFbZCuJvJfKGeCYFRzistnLEhnNbDD2EJLBJcOx6u79BS2adM8fUz+6/DmonrgJSHr4i8wKa4+E9pPMJfBm55g=
X-Received: by 2002:a17:907:940b:b0:a4e:a7a:84e0 with SMTP id
 dk11-20020a170907940b00b00a4e0a7a84e0mr6277511ejc.34.1711944949533; Sun, 31
 Mar 2024 21:15:49 -0700 (PDT)
MIME-Version: 1.0
Date: Sun, 31 Mar 2024 21:15:38 -0700
Message-ID: <CAAHpriNXOQxk6JaWZZ9axn0Ndh7-+iYrUcNYPeB5hVZR7DcKzg@mail.gmail.com>
Subject: Re: Linux xz issue
To: The Cygwin Mailing List <cygwin AT cygwin DOT com>
Cc: Keith Thompson <Keith DOT S DOT Thompson AT gmail DOT com>
X-Spam-Status: No, score=-0.8 required=5.0 tests=BAYES_00, DKIM_SIGNED,
 DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,
 SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
 server2.sourceware.org
X-BeenThere: cygwin AT cygwin DOT com
X-Mailman-Version: 2.1.30
List-Id: General Cygwin discussions and problem reports <cygwin.cygwin.com>
List-Archive: <https://cygwin.com/pipermail/cygwin/>
List-Post: <mailto:cygwin AT cygwin DOT com>
List-Help: <mailto:cygwin-request AT cygwin DOT com?subject=help>
List-Subscribe: <https://cygwin.com/mailman/listinfo/cygwin>,
 <mailto:cygwin-request AT cygwin DOT com?subject=subscribe>
From: Keith Thompson via Cygwin <cygwin AT cygwin DOT com>
Reply-To: Keith Thompson <Keith DOT S DOT Thompson AT gmail DOT com>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: "Cygwin" <cygwin-bounces+archive-cygwin=delorie DOT com AT cygwin DOT com>

Achim Gratz Stromeko AT Nexgo DOT DE wrote:
> Beyond that, the version 5.4.6 that everybody is currently reverting to
> (and is also still available for Cygwin if you want to go back) was
> already released when the presumed bad actor was co-maintainer and their
> involvement goes back even farther based on the Xz developer mailing
> list.  The repository has been deactivated by GitHub so I can't check
> there, but there is already some discussion about rolling back to 5.3.1
> or thereabouts.

The GitHub repo at <https://github.com/tukaani-project/xz> has been
deactivated, but there's another xz repo (likely the original one)
at <https://github.com/tukaani-project/xz>.  The most recent commit
in that repo is "CMake: Fix sabotaged Landlock sandbox check.".

I have no inside knowledge about any of this.

I'm running the Cygwin setup right now.  It reverts the xz package
from 5.6.1-1 to 5.4.6-1.  Only 5.4.2-1 and 5.4.6-1 are available.

-- 
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple