Accepting request 1205105 from Archiving

OBS-URL: https://build.opensuse.org/request/show/1205105
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/libarchive?expand=0&rev=53

fix-bsdunzip-test.patch

@@ -1,19 +0,0 @@
-commit 64e2e88ec326dd37fcb85c9a9d21fa43444a0a59
-Author: Bernhard M. Wiedemann <bwiedemann@suse.de>
-Date:   Wed May 22 10:13:47 2024 +0200
-
-    Fix test failure on openSUSE:Leap:15.5
-
-diff --git a/unzip/test/test_I.c b/unzip/test/test_I.c
-index 5d31ce8d..92e5ce59 100644
---- a/unzip/test/test_I.c
-+++ b/unzip/test/test_I.c
-@@ -45,7 +45,7 @@ DEFINE_TEST(test_I)
- #endif
- 
- 	extract_reference_file(reffile);
--	r = systemf("%s -I UTF-8 %s >test.out 2>test.err", testprog, reffile);
-+	r = systemf("env -uLC_ALL LC_CTYPE=en_US.UTF-8 %s -I UTF-8 %s >test.out 2>test.err", testprog, reffile);
- 	assertEqualInt(0, r);
- 	assertNonEmptyFile("test.out");
- 	assertEmptyFile("test.err");

fix-soversion.patch

@@ -1,13 +0,0 @@
-Index: libarchive-3.4.0/CMakeLists.txt
-===================================================================
---- libarchive-3.4.0.orig/CMakeLists.txt
-+++ libarchive-3.4.0/CMakeLists.txt
-@@ -71,7 +71,7 @@ SET(LIBARCHIVE_VERSION_STRING  "${VERSIO
- # libarchive 2.9 == interface version 11 = 2 + 9
- # libarchive 3.0 == interface version 12
- # libarchive 3.1 == interface version 13
--math(EXPR INTERFACE_VERSION  "13 + ${_minor}")
-+set(INTERFACE_VERSION  "13")
- 
- # Set SOVERSION == Interface version
- # ?? Should there be more here ??

libarchive-3.7.4.tar.xz.asc

@@ -1,14 +0,0 @@
------BEGIN PGP SIGNATURE-----
-
-iQGzBAABCgAdFiEE2yx88bTCZfrvVuP8WEihi48UGEsFAmYre4IACgkQWEihi48U
-GEvAuwwAmsnbql7+1CW9RuBHitOvHyIL6sHbjR0Hd3ruI9s3FMevMBzPjpb5MgOU
-/D+o0amv1Tv/QSJAid1siZIumgur2hzqglNMK5FkoajpZ1UjYASHHxFoh5qkRKvW
-Ws/ViXMVGB2DlyydzzjFwa0JAAK/IpD9uKPPr6rgt+cRBibkWXuJILbmzi/DF1XH
-zlp/5FGwzY4/zhqbXgz11ZhX3gacdLd68+xsYbSII2JvZ2yb2zsS+0ia3skUawEj
-QMKzdpErqO+RedsRiJG9fjA65Q1hKWpMoWMuKZWLX+v0iv/OHv57RzLelmPy6Ohw
-0/PwCHFzFmOfu2LZd+mCWsrYaBrezGJq9tm+pAsCXSxcj3LuQwZ6d8/wgtS5CeNE
-+LoHCbzAcI5WiyU3wbw1qvulVDewL+j0rQoj23Lj2z9ry2K94NMpYji3JMkWI8dS
-QXitZd29uZ9l5Jf5Kz9BLHOoO1Q8bEOGB33dLpT+UIjFoJ6wqxNXef6OAECoHGH0
-OnEtTuAX
-=kNTk
------END PGP SIGNATURE-----

libarchive-3.7.6.tar.xz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:0a2efdcb185da2eb1e7cd8421434cb9a6119f72417a13335cca378d476fd3ba0
+size 5458552

libarchive-3.7.6.tar.xz.asc

@@ -0,0 +1,14 @@
+-----BEGIN PGP SIGNATURE-----
+
+iQGzBAABCgAdFiEE2yx88bTCZfrvVuP8WEihi48UGEsFAmbxNkUACgkQWEihi48U
+GEu+SQwAqe5TjNK7cC1bF0MBthJ+2QQkxCASYJ9ZrvVPS0wBrNGvCx4UvAtR/pVZ
+gnvHJmRA60nY7cLvKyDAysmDfq3x5mIBUha/WzEo35NkvTXBOcttzXxWF0GziHtR
+WGyk8SK8SWICxsgIlp219xS+E+pWA1dPH2mi6o0DZZTrqpt5RM3rD6mkxUmKCerh
+Kqn2aN754Mtt41fMixZpnwVQlXW0H9M/WoGIPUIXfRuA2s3Atyh/RL0nvbOJOWOD
+KlNFlKh4kEEg/13v7Ui1UOcTNRKkMjfB7Th8koSZiVPPLd6h2lwOOJk1YQlwdunN
+OsgqqB4f6rrW58r2Ce3abOCL4kdLGeIO72Cm/qWcpZHVn3k/xBB8qhrczMqB+URd
+U+tHlV65kR4qqv/POZdGqTQ0W0tyqKl4Zp8wvfW2vyuXnYXjQV4cjp4M1ta/KGVb
+zXDQynRdLx59RyIV3nZUUulAJoVjSuWTIry0WLKc9g0wnCx783fBunLJTeSxNrtK
+q719Bv4A
+=VN99
+-----END PGP SIGNATURE-----

libarchive.changes

@@ -1,3 +1,37 @@
+-------------------------------------------------------------------
+Fri Sep 27 19:15:54 UTC 2024 - Antonio Teixeira <antonio.teixeira@suse.com>
+
+- Update to 3.7.6:
+  * tar: clean up linkpath between entries
+  * tar: fix memory leaks when processing symlinks or parsing pax headers
+  * iso: be more cautious about parsing ISO-9660 timestamps
+- Version 3.7.5 changes:
+  * fix multiple vulnerabilities identified by SAST
+  * cpio: ignore out-of-range gid/uid/size/ino and harden AFIO parsing
+  * lzop: prevent integer overflow
+  * rar4: protect copy_from_lzss_window_to_unp() (CVE-2024-20696, bsc#1225971)
+  * rar4: fix CVE-2024-26256 (CVE-2024-26256, bsc#1225972)
+  * rar4: fix OOB in delta and audio filter
+  * rar4: fix out of boundary access with large files
+  * rar4: add boundary checks to rgb filter
+  * rar4: fix OOB access with unicode filenames
+  * rar5: clear 'data ready' cache on window buffer reallocs
+  * rpm: calculate huge header sizes correctly
+  * unzip: unify EOF handling
+  * util: fix out of boundary access in mktemp functions
+  * uu: stop processing if lines are too long
+  * 7zip: fix issue when skipping first file in 7zip archive that is a multiple
+    of 65536 bytes
+  * ar: fix archive entries having no type
+  * lha: do not allow negative file sizes
+  * lha: fix integer truncation on 32-bit systems
+  * shar: check strdup return value
+  * rar5: don't try to read rediculously long names
+  * xar: fix another infinite loop and expat error handling
+  * many Windows fixes, cleanups and improvements
+- Drop fix-soversion.patch, fix-bsdunzip-test.patch
+  * Fixed upstream
+
 -------------------------------------------------------------------
 Thu Jun 20 14:56:58 UTC 2024 - Antonio Teixeira <antonio.teixeira@suse.com>
 

libarchive.spec

@@ -30,7 +30,7 @@
 %bcond_without	ext2fs
 %endif
 Name:           libarchive
-Version:        3.7.4
+Version:        3.7.6
 Release:        0
 Summary:        Utility and C library to create and read several streaming archive formats
 License:        BSD-2-Clause
@@ -41,11 +41,6 @@ Source1:        https://github.com/libarchive/libarchive/releases/download/v%{ve
 Source2:        libarchive.keyring
 Source1000:     baselibs.conf
 Patch1:         lib-suffix.patch
-Patch2:         fix-soversion.patch
-# PATCH-FIX-SUSE danilo.spinella@suse.com
-# bsdunzip test fails because of a locale issue, set locale properly to fix it
-# It will be fixed in the next release
-Patch3:         fix-bsdunzip-test.patch
 BuildRequires:  cmake
 BuildRequires:  libacl-devel
 BuildRequires:  libbz2-devel