FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Gentoo > Gentoo Development

 
 
LinkBack Thread Tools
 
Old 05-08-2008, 10:49 AM
 
Default RFC: lzma tarball usage

Duncan <1i5t5.duncan@cox.net> writes:

>> So it would also be possible to compile "lzmadec" without any need for
>> C++. Just call "make" in subdirs liblzmadec and lzmadec.
>
> What about USE=decode-only or something similar for lzma-utils, then? If
> desired, it could even be masked on "normal" profiles, but would then be
> there for the embedded and releng folks.

USE=cxx should do just fine, it will disable the C++-related parts,
whatever they are. Sincerely I'd quite like to enable it on my vserver's
build chroots too.

(BTW I considered using lzma for backup compression, but I didn't get
much different results from bzip2 in term of size, but took quite longer
in case of compression... I still have some doubts whether lzma is worth
it).

--
Diego "Flameeyes" Pettenò
http://blog.flameeyes.eu/
 
Old 05-08-2008, 10:59 AM
Graham Murray
 
Default RFC: lzma tarball usage

flameeyes@gmail.com (Diego 'Flameeyes' Pettenò) writes:

> USE=cxx should do just fine, it will disable the C++-related parts,
> whatever they are. Sincerely I'd quite like to enable it on my vserver's
> build chroots too.

Should that be USE=-cxx? The help for USE=cxx says that this builds
support for C++.
--
gentoo-dev@lists.gentoo.org mailing list
 
Old 05-08-2008, 11:30 AM
Luca Barbato
 
Default RFC: lzma tarball usage

Mart Raudsepp wrote:

Hello,

Over the course of this year, a lzma-utils buildtime dependency has been
added to a few system packages, to handle .tar.lzma tarballs.
This has huge implications on the requirement of the system toolchain,
which is highly disturbing from a minimal (lets say embedded) systems
concern - lzma-utils depends on the C++ compiler and the libstdc++
beast, while a minimal system would like to avoid this at all cost.


I'd rewrite the C++ code in plain C if isn't that complex...

lu

--

Luca Barbato
Gentoo Council Member
Gentoo/linux Gentoo/PPC
http://dev.gentoo.org/~lu_zero

--
gentoo-dev@lists.gentoo.org mailing list
 
Old 05-08-2008, 11:31 AM
 
Default RFC: lzma tarball usage

Graham Murray <graham@gmurray.org.uk> writes:

> Should that be USE=-cxx? The help for USE=cxx says that this builds
> support for C++.

It was meant as setting a cxx USE on the ebuild, I wasn't certainly
meaning to disable the C++ parts with USE=cxx enabled

--
Diego "Flameeyes" Pettenò
http://blog.flameeyes.eu/
 
Old 05-08-2008, 11:41 AM
Ulrich Mueller
 
Default RFC: lzma tarball usage

>>>>> On Thu, 08 May 2008, Diego 'Flameeyes' Pettenò wrote:

>>> So it would also be possible to compile "lzmadec" without any need
>>> for C++. Just call "make" in subdirs liblzmadec and lzmadec.
>>
>> What about USE=decode-only or something similar for lzma-utils,
>> then? If desired, it could even be masked on "normal" profiles, but
>> would then be there for the embedded and releng folks.

> USE=cxx should do just fine, it will disable the C++-related parts,
> whatever they are. Sincerely I'd quite like to enable it on my
> vserver's build chroots too.

See <https://bugs.gentoo.org/show_bug.cgi?id=220899> for a first
attempt of an ebuild.

Ulrich
--
gentoo-dev@lists.gentoo.org mailing list
 
Old 05-08-2008, 01:17 PM
Doug Goldstein
 
Default RFC: lzma tarball usage

Ryan Hill wrote:

On Wed, 07 May 2008 16:23:12 +0300
Mart Raudsepp <leio@gentoo.org> wrote:



Hello,

Over the course of this year, a lzma-utils buildtime dependency has
been added to a few system packages, to handle .tar.lzma tarballs.
This has huge implications on the requirement of the system toolchain,
which is highly disturbing from a minimal (lets say embedded) systems
concern - lzma-utils depends on the C++ compiler and the libstdc++
beast, while a minimal system would like to avoid this at all cost.



The new lzma-utils codebase uses liblzma, written in C. It's at the
alpha stage but supposedly supports encoding/decoding the current lzma
format "well enough" (;P). It probably has some fun bugs to find
and squish.

http://sf.net/mailarchive/forum.php?thread_name=200804251652.58484.lasse.col lin%40tukaani.org&forum_name=lzmautils-announce


According to the mailing list this change was done to fix security holes
in the format and also resulted in a slightly different format that's
incompatible with the previous verion. So lzma 5.x and higher will be a
different on disk format. It's troubling to me that projects are using
lzma when it's on disk format isn't even final and the project has
security issues.

--
gentoo-dev@lists.gentoo.org mailing list
 
Old 05-08-2008, 01:28 PM
Ciaran McCreesh
 
Default RFC: lzma tarball usage

On Thu, 08 May 2008 09:17:08 -0400
Doug Goldstein <cardoe@gentoo.org> wrote:
> It's troubling to me that projects are using lzma when it's on disk
> format isn't even final and the project has security issues.

You mean projects like 'GNU tar'?

--
Ciaran McCreesh
 
Old 05-08-2008, 01:32 PM
Doug Goldstein
 
Default RFC: lzma tarball usage

Ciaran McCreesh wrote:

On Thu, 08 May 2008 09:17:08 -0400
Doug Goldstein <cardoe@gentoo.org> wrote:


It's troubling to me that projects are using lzma when it's on disk
format isn't even final and the project has security issues.



You mean projects like 'GNU tar'?


As far as I know Ciaran, all GNU projects have switched or are in the
process of switching to lzma over bzip2. I believe the issue in question
which prompted this original e-mail was due to coreutils. But I could be
wrong.

--
gentoo-dev@lists.gentoo.org mailing list
 
Old 05-08-2008, 01:36 PM
Ciaran McCreesh
 
Default RFC: lzma tarball usage

On Thu, 08 May 2008 09:32:34 -0400
Doug Goldstein <cardoe@gentoo.org> wrote:
> Ciaran McCreesh wrote:
> > On Thu, 08 May 2008 09:17:08 -0400
> > Doug Goldstein <cardoe@gentoo.org> wrote:
> >> It's troubling to me that projects are using lzma when it's on disk
> >> format isn't even final and the project has security issues.
> >
> > You mean projects like 'GNU tar'?
> >
> As far as I know Ciaran, all GNU projects have switched or are in the
> process of switching to lzma over bzip2. I believe the issue in
> question which prompted this original e-mail was due to coreutils.
> But I could be wrong.

You miss my point. GNU tar sometimes changes its on disk format (and
will be doing so again at some point for xattrs), and it's had security
issues.

--
Ciaran McCreesh
 
Old 05-08-2008, 01:41 PM
Doug Goldstein
 
Default RFC: lzma tarball usage

Doug Goldstein wrote:

Ciaran McCreesh wrote:

On Thu, 08 May 2008 09:17:08 -0400
Doug Goldstein <cardoe@gentoo.org> wrote:


It's troubling to me that projects are using lzma when it's on disk
format isn't even final and the project has security issues.



You mean projects like 'GNU tar'?


As far as I know Ciaran, all GNU projects have switched or are in the
process of switching to lzma over bzip2. I believe the issue in
question which prompted this original e-mail was due to coreutils. But
I could be wrong.
Additionally to follow myself up, I believe one of the security issues
was execution of arbitrary data either when untarred or just
decompressed (assuming a specially crafted lzma file).


Some of the other fun bits are lzma requires autotools but autotools are
going to be compressed with lzma. So if we ever need to autoreconf, we
have a chicken/egg issue.

--
gentoo-dev@lists.gentoo.org mailing list
 

Thread Tools




All times are GMT. The time now is 05:52 AM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright ©2007 - 2008, www.linux-archive.org