Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
home:bmwiedemann:reproducible:distribution:ring1
apache-commons-compress
apache-commons-compress.changes
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File apache-commons-compress.changes of Package apache-commons-compress
------------------------------------------------------------------- Tue May 14 10:26:58 UTC 2024 - Fridrich Strba <fstrba@suse.com> - Upgrade to 1.26.1 * Fixed Bugs + COMPRESS-659: TarArchiveOutputStream should use Commons IO Charsets instead of Commons Codec Charsets. + COMPRESS-660: Add org.apache.commons.codec to OSGi imports. + COMPRESS-664 Return null value from getNextEntry() for empty file. + COMPRESS-664: Remove unused variables in tests. + COMPRESS-666: Multithreaded access to Tar archive throws java.util.zip.ZipException: Corrupt GZIP trailer. + COMPRESS-644: ArchiveStreamFactory.detect(InputStream) returns TAR for ICO file. + COMPRESS-661: ArchiveInputStream markSupported should always return false. + COMPRESS-662: Remove out of date jar and scripts. ------------------------------------------------------------------- Tue Feb 20 10:24:11 UTC 2024 - Dominique Leuenberger <dimstar@opensuse.org> - Use %patch -P N instead of deprecated %patchN. ------------------------------------------------------------------- Mon Feb 19 13:14:54 UTC 2024 - Fridrich Strba <fstrba@suse.com> - Upgrade to 1.26 * Fixing several vulnerabilities + bsc#1220068, CVE-2024-26308 + bsc#1220070, CVE-2024-25710 * New Features + Add and use ZipFile.builder(), ZipFile.Builder, and deprecate constructors + Add and use SevenZFile.builder(), SevenZFile.Builder, and deprecate constructors + Add and use ArchiveInputStream.getCharset() + Add and use ArchiveEntry.resolveIn(Path) + Add Maven property project.build.outputTimestamp for build reproducibility * Fixed Bugs + COMPRESS-632: Check for invalid PAX values in TarArchiveEntry + COMPRESS-632: Fix for zero size headers in ArjInputStream + COMPRESS-632: Fixes and tests for ArInputStream + COMPRESS-632: Fixes for dump file parsing + COMPRESS-632: Improve CPIO exception detection and handling + Deprecate SkipShieldingInputStream without replacement (no longer used) + Reuse commons-codec, don't duplicate class PureJavaCrc32C (removed package-private class) + Reuse commons-codec, don't duplicate class XXHash32 (deprecated class) + Reuse commons-io, don't duplicate class Charsets (deprecated class) + Reuse commons-io, don't duplicate class IOUtils (deprecated methods) + Reuse commons-io, don't duplicate class BoundedInputStream (deprecated class) + Reuse commons-io, don't duplicate class FileTimes (deprecated TimeUtils methods) + Reuse Arrays.equals(byte[], byte[]) and deprecate ArchiveUtils.isEqual(byte[], byte[]) + Add a null-check for the class loader of OsgiUtils + Add a null-check in Pack200.newInstance(String, String) + Deprecate ChecksumCalculatingInputStream in favor of java.util.zip.CheckedInputStream + Deprecate CRC32VerifyingInputStream .CRC32VerifyingInputStream(InputStream, long, int) + COMPRESS-655: FramedSnappyCompressorOutputStream produces incorrect output when writing a large buffer + COMPRESS-657: Fix TAR directory entries being misinterpreted as files + Deprecate unused method FileNameUtils.getBaseName(String) + Deprecate unused method FileNameUtils.getExtension(String) + ArchiveInputStream.BoundedInputStream.read() incorrectly adds 1 for EOF to the bytes read count + Deprecate IOUtils.read(File, byte[]) + Deprecate IOUtils.copyRange(InputStream, long, OutputStream, int) + COMPRESS-653: ZipArchiveOutputStream multi archive updates metadata in incorrect file + Deprecate ByteUtils.InputStreamByteSupplier + Deprecate ByteUtils.fromLittleEndian(InputStream, int) + Deprecate ByteUtils.toLittleEndian(DataOutput, long, int) + Reduce duplication by having ArchiveInputStream extend FilterInputStream + Support preamble garbage in ZipArchiveInputStream + COMPRESS-658: Fix formatting the lowest expressable DOS time + Drop reflection from ExtraFieldUtils static initialization + Preserve exception causation in ExtraFieldUtils.register(Class) - Upgrade to 1.25.0 * New features: + Add GzipParameters.getFileName() and deprecate getFilename() + Add GzipParameters.setFileName(String) and deprecate setFilename(String) + Add FileNameUtil.getCompressedFileName(String) and deprecate getCompressedFilename(String) + Add FileNameUtil.getUncompressedFileName(String) and deprecate getUncompressedFilename(String) + Add FileNameUtil.isCompressedFileName(String) and deprecate isCompressedFilename(String) + Add BZip2Utils.getCompressedFileName(String) and deprecate getCompressedFilename(String) + Add BZip2Utils.getUncompressedFileName(String) and deprecate getUncompressedFilename(String) + Add BZip2Utils.isCompressedFileName(String) and deprecate isCompressedFilename(String) + Add LZMAUtils.getCompressedFileName(String) and deprecate getCompressedFilename(String) + Add LZMAUtils.getUncompressedFileName(String) and deprecate getUncompressedFilename(String) + Add LZMAUtils.isCompressedFileName(String) and deprecate isCompressedFilename(String) + Add XYUtils.getCompressedFileName(String) and deprecate getCompressedFilename(String) + Add XYUtils.getUncompressedFileName(String) and deprecate getUncompressedFilename(String) + Add XYUtils.isCompressedFileName(String) and deprecate isCompressedFilename(String) + Add GzipUtils.getCompressedFileName(String) and deprecate getCompressedFilename(String) + Add GzipUtils.getUncompressedFileName(String) and deprecate getUncompressedFilename(String) + Add GzipUtils.isCompressedFileName(String) and deprecate isCompressedFilename(String) + Add SevenZOutputFile.putArchiveEntry(SevenZArchiveEntry) and deprecate putArchiveEntry(ArchiveEntry) + Add generics to ChangeSet and ChangeSetPerformer + Add generics to ArchiveStreamProvider and friends + Add a generic type parameter to ArchiveOutputStream and avoid unchecked/unconfirmed type casts in subclasses + Add a generic type parameter to ArchiveInputStream and deprecate redundant get methods in subclasses + COMPRESS-648: Add ability to restrict autodetection in CompressorStreamFactory * Fixed Bugs: + Precompile regular expression in ArArchiveInputStream.isBSDLongName(String) + Precompile regular expression in ArArchiveInputStream.isGNULongName(String) + Precompile regular expression in TarArchiveEntry.parseInstantFromDecimalSeconds(String) + Precompile regular expression in ChangeSet.addDeletion(Change) + COMPRESS-649: Improve performance in BlockLZ4CompressorOutputStream + Null-guard Lister.main(String[]) for programmatic invocation + NPE in pack200.NewAttributeBands.Reference .addAttributeToBand(NewAttribute, InputStream) + Incorrect lazy initialization and update of static field in pack200.CodecEncoding.getSpecifier(Codec, Codec) + Incorrect string comparison in unpack200.AttributeLayout .numBackwardsCallables() + Inefficient use of keySet iterator instead of entrySet iterator in pack200.PackingOptions .addOrUpdateAttributeActions(List, Map, int) + Package private class pack200.IcBands.IcTuple should be a static inner class + Private class ZipFile.BoundedFileChannelInputStream should be a static inner class + Refactor internal SevenZ AES256SHA256Decoder InputStream into a named static inner class + Refactor internal SevenZ AES256SHA256Decoder OutputStream into a named static inner class + Use the root Locale for string conversion of command line options in org.apache.commons.compress.archivers.sevenz.CLI + Calling PackingUtils.config(PackingOptions) with null now closes the internal FileHandler + COMPRESS-650: LZ4 compressor throws IndexOutOfBoundsException + COMPRESS-632: LZWInputStream.initializeTables(int) should throw IllegalArgumentException instead of ArrayIndexOutOfBoundsException + COMPRESS-647: Throw IOException instead of ArrayIndexOutOfBoundsException when reading Zip with data descriptor entries - Update to 1.24.0 * New features: + Make ZipArchiveEntry.getLocalHeaderOffset() public * Fixed Bugs: + Use try-with-resources in ArchiveStreamFactory + Javadoc and code comments: Sanitize grammar issues and typos + Remove redundant (null) initializations + [StepSecurity] ci: Harden GitHub Actions - Update to 1.23.0 * New features: + COMPRESS-614: Use FileTime for time fields in SevenZipArchiveEntry + COMPRESS-621: Fix calculation the offset of the first ZIP central directory entry + COMPRESS-633:Add encryption support for SevenZ + COMPRESS-613: Support for extra time data in Zip archives + COMPRESS-621: Add org.apache.commons.compress.archivers.zip .DefaultBackingStoreSupplier to write to a custom folder instead of the default temporary folder. + COMPRESS-600: Add capability to configure Deflater strategy in GzipCompressorOutputStream: GzipParameters.setDeflateStrategy(int). * Fixed Bugs: + Implicit narrowing conversion in compound assignment + Avoid NPE in FileNameUtils.getBaseName(Path) for paths with zero elements like root paths + Avoid NPE in FileNameUtils.getExtension(Path) for paths with zero elements like root paths + LZMA2Decoder.decode() looses original exception + Extract conditions and avoid duplicate code. + Remove duplicate conditions. Use switch instead. + Replace JUnit 3 and 4 with JUnit 5 + Make 'ZipFile.offsetComparator' static + COMPRESS-638: The GzipCompressorOutputStream#writeHeader() uses ISO_8859_1 to write the file name and comment. If the strings contains non-ISO_8859_1 characters, unknown characters are displayed after decompression. Use percent encoding for non ISO_8859_1 characters. + Port some code from IO to NIO APIs + pack200: Fix FileBands misusing InputStream#read(byte[]) + COMPRESS-641: Add TarArchiveEntry.getLinkFlag() + COMPRESS-642: Integer overflow ArithmeticException in TarArchiveOutputStream + COMPRESS-642: org.apache.commons.compress.archivers.zip .ZipFile.finalize() should not write to std err. * Removed: + Remove BZip2CompressorOutputStream.finalize() which only wrote to std err - Update to 1.22 * New features: + COMPRESS-602: Migrate zip package to use NIO + Add APK file extension constants: ArchiveStreamFactory.APK, APKM, APKS, XAPK + ArchiveStreamFactory.createArchiveInputStream(String, InputStream, String) supports the "APK" format (it's a JAR) + Expander example now has NIO Path versions of IO File APIs + COMPRESS-612: Improve TAR support for file times + Add SevenZArchiveEntry.setContentMethods(SevenZMethodConfiguration...) * Fixed Bugs: + Fix some compiler warnings in pack200 packages + Close File input stream after unpacking in Pack200UnpackerAdapter.unpack(File, JarOutputStream) + Pack200UnpackerAdapter.unpack(InputStream, JarOutputStream) should not close its given input stream + COMPRESS-596: Fix minor problem in examples. + COMPRESS-584: Add a limit to the copy buffer in IOUtils.readRange() to avoid reading more from a channel than asked for + Documentation nits + Replace wrapper Collections.sort is with an instance method directly + Replace manual comparisons with Comparator.comparingInt() + Replace manual copy of array contents with System.arraycopy() + Fix thread safety issues when encoding 7z password + bzip2: calculate median-of-3 on unsigned values + Use Math.min and Math.max calculations. + COMPRESS-603: Expander should be able to work if an entry's name is "./". + COMPRESS-604: Ensure compatibility with Java 8 + Use StringBuilder instead of StringBuffer. + Inline variable. Remove redundant local variable. + Use compare method + Remove Unnecessary interface modifiers + Avoid use C-style array declaration. + ChecksumVerifyingInputStream.read() does not always validate checksum at end-of-stream + Fix TarFileTest + COMPRESS-625: Update Wikipedia link in TarUtils.java:627. + COMPRESS-626: OutOfMemoryError on malformed pack200 input (attributes). + COMPRESS-628: OutOfMemoryError on malformed pack200 input (org.apache.commons.compress.harmony.pack200.NewAttributeBands .readNextUnionCase). + COMPRESS-628: OutOfMemoryError on malformed unpack200 input (org.apache.commons.compress.harmony.unpack200 .NewAttributeBands.readNextUnionCase). + Some input streams are not closed in org.apache.commons .compress.harmony.pack200.PackingUtils + COMPRESS-627: Pack200 causes a 'archive.3E' error if it's not in the system class loader. - Modified patches: * 0001-Remove-Brotli-compressor.patch * 0002-Remove-ZSTD-compressor.patch * 0003-Remove-Pack200-compressor.patch + rediff to changed context - Removed patch: * fix_java_8_compatibility.patch + not needed, since we handle the compatibility differently ------------------------------------------------------------------- Mon Mar 21 08:57:33 UTC 2022 - Fridrich Strba <fstrba@suse.com> - Added patch: * 0003-Remove-Pack200-compressor.patch + Remove support for pack200 which depends on old asm3 ------------------------------------------------------------------- Tue Jul 20 07:17:33 UTC 2021 - Fridrich Strba <fstrba@suse.com> - Updated to 1.21 * When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package. (CVE-2021-35515, bsc#1188463) * When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' sevenz package. (CVE-2021-35516, bsc#1188464) * When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' tar package. (CVE-2021-35517, bsc#1188465) * When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Compress' zip package. (CVE-2021-36090, bsc#1188466) - New dependency on asm3 for Pack200 compressor - Rebased patch fix_java_8_compatibility.patch to a new context and added some new ocurrences ------------------------------------------------------------------- Wed Aug 28 08:57:02 UTC 2019 - Pedro Monreal Gonzalez <pmonrealgonzalez@suse.com> - Updated to 1.19 [bsc#1148475, CVE-2019-12402] * ZipFile could get stuck in an infinite loop when parsing ZIP archives with certain strong encryption headers (CVE-2019-12402). * ZipArchiveInputStream and ZipFile will no longer throw an exception if an extra field generally understood by Commons Compress is malformed but rather turn them into UnrecognizedExtraField instances. You can influence the way extra fields are parsed in more detail by using the new getExtraFields(ExtraFieldParsingBehavior) method of ZipArchiveEntry now. * Some of the ZIP extra fields related to strong encryption will now throw ZipExceptions rather than ArrayIndexOutOfBoundsExceptions in certain cases when used directly. There is no practical difference when they are read via ZipArchiveInputStream or ZipFile. * ParallelScatterZipCreator now writes entries in the same order they have been added to the archive. * ZipArchiveInputStream and ZipFile are more forgiving when parsing extra fields by default now. * TarArchiveInputStream has a new lenient mode that may allow it to read certain broken archives. - Rebased patch fix_java_8_compatibility.patch ------------------------------------------------------------------- Mon Mar 25 17:32:03 UTC 2019 - Fridrich Strba <fstrba@suse.com> - Remove pom parent, since we don't use it when not building with maven ------------------------------------------------------------------- Sun Jan 27 16:48:58 UTC 2019 - Jan Engelhardt <jengelh@inai.de> - Add missing RPM group for %name-javadoc. ------------------------------------------------------------------- Fri Jan 25 09:10:54 UTC 2019 - Fridrich Strba <fstrba@suse.com> - Rename package to apache-commons-compress * Upgrade to version 1.18 * Use build.xml file generated ba mvn ant:ant and simplified manually after + Allows building with ant and considerably shortens build cycle - Added patches * 0001-Remove-Brotli-compressor.patch + do not build Brotli compressor, since we don't have its dependencies * 0002-Remove-ZSTD-compressor.patch + do not build ZSTD compressor, since we don't have its dependencies * fix_java_8_compatibility.patch + restore Java 8 compatibility in java.nio.ByteBuffer use ------------------------------------------------------------------- Mon Sep 18 10:43:23 UTC 2017 - fstrba@suse.com - Fix build with jdk9: specify java source and target 1.6 - Build also the javadoc package ------------------------------------------------------------------- Fri May 19 16:04:30 UTC 2017 - tchvatal@suse.com - Fix build under new javapackage-tools ------------------------------------------------------------------- Thu Nov 29 14:57:33 UTC 2012 - mvyskocil@suse.com - use saxon and saxon-scripts only when using maven ------------------------------------------------------------------- Thu May 14 16:05:37 CEST 2009 - mvyskocil@suse.cz - 'Initial SUSE packaging from jpackage.org 5.0'
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
