This is to announce gzip-1.13, a stable release.
Thanks to Paul and Bruno for contributing.
There have been 50 commits by 3 people in the 71 weeks since 1.12.
See the NEWS below for a brief summary.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
Bruno Haible (4)
Jim Meyering (15)
Paul Eggert (31)
Jim
[on behalf of the gzip maintainers]
==================================================================
Here is the GNU gzip home page:
http://gnu.org/s/gzip/
For a summary of changes and contributors, see:
http://git.sv.gnu.org/gitweb/?p=gzip.git;a=shortlog;h=v1.13
or run this command from a git-cloned gzip directory:
git shortlog v1.12..v1.13
Here are the compressed sources:
https://ftp.gnu.org/gnu/gzip/gzip-1.13.tar.gz (1.3MB)
https://ftp.gnu.org/gnu/gzip/gzip-1.13.tar.xz (820KB)
Here are the GPG detached signatures:
https://ftp.gnu.org/gnu/gzip/gzip-1.13.tar.gz.sig
https://ftp.gnu.org/gnu/gzip/gzip-1.13.tar.xz.sig
Use a mirror for higher download bandwidth:
https://www.gnu.org/order/ftp.html
Here are the SHA1 and SHA256 checksums:
9cc4f2220c8028823433e9d869dc07610aefefb5 gzip-1.13.tar.gz
IPyBiu666Hzb8gnTUUGtnTzzErNaXmvmG/z7+e3dISo= gzip-1.13.tar.gz
a793e107a54769576adc16703f97c39ee7afdd4e gzip-1.13.tar.xz
dFTraTXbF8ZlVXbC4bD6vv04tNCTbg+H9IzQYs6RoFc= gzip-1.13.tar.xz
Verify the base64 SHA256 checksum with cksum -a sha256 --check
from GNU coreutils-9.2 or OpenBSD's cksum since 2007.
Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify gzip-1.13.tar.gz.sig
The signature should match the fingerprint of the following key:
pub rsa4096/0x7FD9FCCB000BEEEE 2010-06-14 [SCEA]
Key fingerprint = 155D 3FC5 00C8 3448 6D1E EA67 7FD9 FCCB 000B EEEE
uid [ unknown] Jim Meyering <jim@meyering.net>
uid [ unknown] Jim Meyering <meyering@fb.com>
uid [ unknown] Jim Meyering <meyering@gnu.org>
If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to retrieve
or refresh it, and then rerun the 'gpg --verify' command.
gpg --locate-external-key jim@meyering.net
gpg --recv-keys 7FD9FCCB000BEEEE
wget -q -O- 'https://savannah.gnu.org/project/release-gpgkeys.php?group=gzip&download=1' | gpg --import -
As a last resort to find the key, you can try the official GNU
keyring:
wget -q https://ftp.gnu.org/gnu/gnu-keyring.gpg
gpg --keyring gnu-keyring.gpg --verify gzip-1.13.tar.gz.sig
This release was bootstrapped with the following tools:
Autoconf 2.72c.32-cb6fb
Automake 1.16i
Gnulib v0.1-6631-g5651802c60
NEWS
* Noteworthy changes in release 1.13 (2023-08-19) [stable]
** Changes in behavior
zless now diagnoses gzip failures, if using less 623 or later.
When SIGPIPE is ignored, gzip now exits with status 2 (warning)
instead of status 1 (error) when writing to a broken pipe. This is
more useful with programs like 'less' that treat gzip exit status 2
as a non-failure.
** Bug fixes
'gzip -d' no longer fails to report invalid compressed data
that uses a dictionary distance outside the input window.
[bug present since the beginning]
Port to C23, which does not allow K&R-style function definitions
with parameters, and which does not define __alignas_is_defined.
Thanks to Paul Eggert and Lasse Collin for all the work
on fixing the exploitable zgrep bug, and to Paul for
handling most of the other changes.
Here are the compressed sources:
https://ftp.gnu.org/gnu/gzip/gzip-1.12.tar.gz (1.3MB)
https://ftp.gnu.org/gnu/gzip/gzip-1.12.tar.xz (808KB)
Here are the GPG detached signatures[*]:
https://ftp.gnu.org/gnu/gzip/gzip-1.12.tar.gz.sig
https://ftp.gnu.org/gnu/gzip/gzip-1.12.tar.xz.sig
Use a mirror for higher download bandwidth:
https://www.gnu.org/order/ftp.html
Here are the SHA1 and SHA256 checksums:
91fa501ada319c4dc8f796208440d45a3f48ed13 gzip-1.12.tar.gz
W0+xTTgxTgny/IocUQ581UCj6g4+ubBCAEa4LDv0EIU gzip-1.12.tar.gz
318107297587818c8f1e1fbb55962f4b2897bc0b gzip-1.12.tar.xz
zl4D5Rn2N+H4FAEazjXE+HszwLur7sNbr1+9NHnpGVY gzip-1.12.tar.xz
The SHA256 checksum is base64 encoded, instead of the
hexadecimal encoding that most checksum tools default to.
[*] Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify gzip-1.12.tar.gz.sig
If that command fails because you don't have the required public key,
or that public key has expired, try the following commands to update
or refresh it, and then rerun the 'gpg --verify' command.
gpg --locate-external-key jim@meyering.net
gpg --recv-keys 7FD9FCCB000BEEEE
wget -q -O- 'https://savannah.gnu.org/project/release-gpgkeys.php?group=gzip&download=1' | gpg --import -
This release was bootstrapped with the following tools:
Autoconf 2.71
Automake 1.16d
Gnulib v0.1-5194-g58c597d13b
NEWS
* Noteworthy changes in release 1.12 (2022-04-07) [stable]
** Changes in behavior
'gzip -l' no longer misreports file lengths 4 GiB and larger.
Previously, 'gzip -l' output the 32-bit value stored in the gzip
header even though that is the uncompressed length modulo 2**32.
Now, 'gzip -l' calculates the uncompressed length by decompressing
the data and counting the resulting bytes. Although this can take
much more time, nowadays the correctness pros seem to outweigh the
performance cons.
'zless' is no longer installed on platforms lacking 'less'.
** Bug fixes
zgrep applied to a crafted file name with two or more newlines
can no longer overwrite an arbitrary, attacker-selected file.
[bug introduced in gzip-1.3.10]
zgrep now names input file on error instead of mislabeling it as
"(standard input)", if grep supports the GNU -H and --label options.
'zdiff -C 5' no longer misbehaves by treating '5' as a file name.
[bug present since the beginning]
Configure-time options like --program-prefix now work.
This is to announce gzip-1.11, a stable release.
There have been 43 commits by 5 people in the 2.7(!) years since 1.10.
See the NEWS below for a brief summary.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
Bjarni Ingi Gislason (1)
Dmitry V. Levin (1)
Ilya Leoshkevich (8)
Jim Meyering (20)
Paul Eggert (13)
Jim [on behalf of the gzip maintainers]
==================================================================
Here is the GNU gzip home page:
http://gnu.org/s/gzip/
For a summary of changes and contributors, see:
http://git.sv.gnu.org/gitweb/?p=gzip.git;a=shortlog;h=v1.11
or run this command from a git-cloned gzip directory:
git shortlog v1.10..v1.11
To summarize the 2581 gnulib-related changes, run these commands
from a git-cloned gzip directory:
git checkout v1.11
git submodule summary v1.10
==================================================================
Here are the compressed sources:
https://ftp.gnu.org/gnu/gzip/gzip-1.11.tar.gz (1.2MB)
https://ftp.gnu.org/gnu/gzip/gzip-1.11.tar.xz (788KB)
Here are the GPG detached signatures[*]:
https://ftp.gnu.org/gnu/gzip/gzip-1.11.tar.gz.sig
https://ftp.gnu.org/gnu/gzip/gzip-1.11.tar.xz.sig
Use a mirror for higher download bandwidth:
https://www.gnu.org/order/ftp.html
Here are SHA1 and SHA256 checksums:
ee2d3f44d8b370db7090b4c3250132cd62b38ec6 gzip-1.11.tar.gz
PooODEW60wCTQdzhfXFTbExlXZMTA5AhznVUomzVDtk gzip-1.11.tar.gz
adf4964893a45a211a888f8943c939f2794d86d4 gzip-1.11.tar.xz
m5qV1o/cuTaEmk1vrai/hobN31i5smycQontDJKneQc gzip-1.11.tar.xz
The SHA256 checksum is base64 encoded, instead of the
hexadecimal encoding that most checksum tools default to.
[*] Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify gzip-1.11.tar.gz.sig
If that command fails because you don't have the required public key,
then run this command to import it:
gpg --keyserver keys.gnupg.net --recv-keys 7FD9FCCB000BEEEE
and rerun the 'gpg --verify' command.
This release was bootstrapped with the following tools:
Autoconf 2.71
Automake 1.16d
Gnulib v0.1-4886-g93280a4bd
NEWS
* Noteworthy changes in release 1.11 (2021-09-03) [stable]
** Performance improvements
IBM Z platforms now support hardware-accelerated deflation.
This is to announce gzip-1.10, a stable release.
There have been 19 commits by 2 people in the 51 weeks since 1.9,
not to mention the 559 gnulib-related changes.
See the NEWS below for a brief summary.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
Jim Meyering (9)
Paul Eggert (10)
Jim [on behalf of the gzip maintainers]
==================================================================
Here is the GNU gzip home page:
http://gnu.org/s/gzip/
For a summary of changes and contributors, see:
http://git.sv.gnu.org/gitweb/?p=gzip.git;a=shortlog;h=v1.10
or run this command from a git-cloned gzip directory:
git shortlog v1.9..v1.10
==================================================================
Here are the compressed sources:
https://ftp.gnu.org/gnu/gzip/gzip-1.10.tar.gz (1.2MB)
https://ftp.gnu.org/gnu/gzip/gzip-1.10.tar.xz (760KB)
Here are the GPG detached signatures[*]:
https://ftp.gnu.org/gnu/gzip/gzip-1.10.tar.gz.sig
https://ftp.gnu.org/gnu/gzip/gzip-1.10.tar.xz.sig
[*] Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify gzip-1.10.tar.gz.sig
If that command fails because you don't have the required public key,
then run this command to import it:
gpg --keyserver keys.gnupg.net --recv-keys 7FD9FCCB000BEEEE
and rerun the 'gpg --verify' command.
This release was bootstrapped with the following tools:
Autoconf 2.69.197-b8fd7
Automake 1.16a
Gnulib v0.1-2305-g95c96b6dd
==================================================================
NEWS
* Noteworthy changes in release 1.10 (2018-12-29) [stable]
** Changes in behavior
Compressed gzip output no longer contains the current time as a
timestamp when the input is not a regular file. Instead, the output
contains a null (zero) timestamp. This makes gzip's behavior more
reproducible when used as part of a pipeline. (As a reminder, even
regular files will use null timestamps after the year 2106, due to a
limitation in the gzip format.)
** Bug fixes
A use of uninitialized memory on some malformed inputs has been fixed.
[bug present since the beginning]
A few theoretical race conditions in signal handers have been fixed.
These bugs most likely do not happen on practical platforms.
[bugs present since the beginning]
This is to announce gzip-1.9, a stable release.
There have been 53 commits by 2 people in the 89 weeks since 1.8.
Thanks to Paul Eggert for all of his help.
See the NEWS below for a brief summary.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
Jim Meyering (28)
Paul Eggert (25)
Jim [on behalf of the gzip maintainers]
==================================================================
Here is the GNU gzip home page:
http://gnu.org/s/gzip/
For a summary of changes and contributors, see:
http://git.sv.gnu.org/gitweb/?p=gzip.git;a=shortlog;h=v1.9
or run this command from a git-cloned gzip directory:
git shortlog v1.8..v1.9
To summarize the 983 gnulib-related changes, run these commands
from a git-cloned gzip directory:
git checkout v1.9
git submodule summary v1.8
==============================
Here are the compressed sources:
https://ftp.gnu.org/gnu/gzip/gzip-1.9.tar.gz (1.2MB)
https://ftp.gnu.org/gnu/gzip/gzip-1.9.tar.xz (748KB)
Here are the GPG detached signatures[*]:
https://ftp.gnu.org/gnu/gzip/gzip-1.9.tar.gz.sig
https://ftp.gnu.org/gnu/gzip/gzip-1.9.tar.xz.sig
Use a mirror for higher download bandwidth:
https://www.gnu.org/order/ftp.html
[*] Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify gzip-1.9.tar.gz.sig
If that command fails because you don't have the required public key,
then run this command to import it:
gpg --keyserver keys.gnupg.net --recv-keys 7FD9FCCB000BEEEE
and rerun the 'gpg --verify' command.
This release was bootstrapped with the following tools:
Autoconf 2.69.193-8974
Automake 1.15a
Gnulib v0.1-1744-g7e7c5c795
==============================
NEWS
* Noteworthy changes in release 1.9 (2018-01-07) [stable]
** Bug fixes
gzip -d -S SUFFIX file.SUFFIX would fail for any upper-case byte in SUFFIX.
E.g., before, this command would fail:
$ :|gzip > kT && gzip -d -S T kT
gzip: kT: unknown suffix -- ignored
[bug present since the beginning]
When decompressing data in 'pack' format, gzip no longer mishandles
leading zeros in the end-of-block code. [bug introduced in gzip-1.6]
When converting from system-dependent time_t format to the 32-bit
unsigned MTIME format used in gzip files, if a timestamp does not
fit gzip now substitutes zero instead of the timestamp's low-order
32 bits, as per Internet RFC 1952. When converting from MTIME to
time_t format, if a timestamp does not fit gzip now warns and
substitutes the nearest in-range value instead of crashing or
silently substituting an implementation-defined value (typically,
the timestamp's low-order bits). This affects timestamps before
1970 and after 2106, and timestamps after 2038 on platforms with
32-bit signed time_t. [bug present since the beginning]
Commands implemented via shell scripts are now more consistent about
failure status. For example, 'gunzip --help >/dev/full' now
consistently exits with status 1 (error), instead of with status 2
(warning) on some platforms. [bug present since the beginning]
Support for VMS and Amiga has been removed. It was not working anyway,
and it reportedly caused file name glitches on MS-Windowsish platforms.
This is to announce gzip-1.8, a stable release.
There have been 6 commits by 2 people in the 4 weeks since 1.7.
See the NEWS below for a brief summary.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
Jim Meyering (3)
Paul Eggert (3)
Jim [on behalf of the gzip maintainers]
=============================================================
Here is the GNU gzip home page:
http://gnu.org/s/gzip/
For a summary of changes and contributors, see:
http://git.sv.gnu.org/gitweb/?p=gzip.git;a=shortlog;h=v1.8
or run this command from a git-cloned gzip directory:
git shortlog v1.7..v1.8
To summarize the 35 gnulib-related changes, run these commands
from a git-cloned gzip directory:
git checkout v1.8
git submodule summary v1.7
=============================================================
Here are the compressed sources:
http://ftp.gnu.org/gnu/gzip/gzip-1.8.tar.gz (1.1MB)
http://ftp.gnu.org/gnu/gzip/gzip-1.8.tar.xz (712KB)
Here are the GPG detached signatures[*]:
http://ftp.gnu.org/gnu/gzip/gzip-1.8.tar.gz.sig
http://ftp.gnu.org/gnu/gzip/gzip-1.8.tar.xz.sig
Use a mirror for higher download bandwidth:
http://www.gnu.org/order/ftp.html
[*] Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify gzip-1.8.tar.gz.sig
If that command fails because you don't have the required public key,
then run this command to import it:
gpg --keyserver keys.gnupg.net --recv-keys 7FD9FCCB000BEEEE
and rerun the 'gpg --verify' command.
This release was bootstrapped with the following tools:
Autoconf 2.69.147-5ad35
Automake 1.99a
Gnulib v0.1-761-gd92a0d9
=============================================================
NEWS
* Noteworthy changes in release 1.8 (2016-04-26) [stable]
** Bug fixes
gzip -l no longer falsely reports a write error when writing to a pipe.
[bug introduced in gzip-1.7]
Port to Oracle Solaris Studio 12 on x86-64.
[bug present since at least gzip-1.2.4]
When configuring gzip, ./configure DEFS='...-DNO_ASM...' now
suppresses assembler again. [bug introduced in gzip-1.3.5]
This is to announce gzip-1.7, a stable release.
There have been 60 commits by 4 people in the nearly three
years since 1.6.
See the NEWS below for a brief summary.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
Jason Leschnik (1)
Jim Meyering (23)
Paul Eggert (35)
Rusty Russell (1)
Jim [on behalf of the gzip maintainers]
============================================================
Here is the GNU gzip home page:
http://gnu.org/s/gzip/
For a summary of changes and contributors, see:
http://git.sv.gnu.org/gitweb/?p=gzip.git;a=shortlog;h=v1.7
or run this command from a git-cloned gzip directory:
git shortlog v1.6..v1.7
To summarize the 838 gnulib-related changes, run these commands
from a git-cloned gzip directory:
git checkout v1.7
git submodule summary v1.6
Here are the compressed sources:
http://ftp.gnu.org/gzip/gzip-1.7.tar.gz (1.2MB)
http://ftp.gnu.org/gzip/gzip-1.7.tar.xz (748KB)
Here are the GPG detached signatures[*]:
http://ftp.gnu.org/gzip/gzip-1.7.tar.gz.sig
http://ftp.gnu.org/gzip/gzip-1.7.tar.xz.sig
Use a mirror for higher download bandwidth:
http://www.gnu.org/order/ftp.html
[*] Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify gzip-1.7.tar.gz.sig
If that command fails because you don't have the required public key,
then run this command to import it:
gpg --keyserver keys.gnupg.net --recv-keys 7FD9FCCB000BEEEE
and rerun the 'gpg --verify' command.
This release was bootstrapped with the following tools:
Autoconf 2.69.147-5ad35
Automake 1.99a
Gnulib v0.1-726-gf58b173
============================================================
NEWS
* Noteworthy changes in release 1.7 (2016-03-27) [stable]
** Changes in behavior
The GZIP environment variable is now obsolescent; gzip now warns if
it is used, and rejects attempts to use dangerous options or operands.
You can use an alias or script instead.
Installed programs like 'zgrep' now use the PATH environment variable
as usual to find subsidiary programs like 'gzip' and 'grep'.
Previously they prepended the installation directory to the PATH,
which sometimes caused 'make check' to test the wrong gzip executable.
[bug introduced in gzip-1.3.13]
** New features
gzip now accepts the --synchronous option, which causes it to use
fsync and similar primitives to transfer output data to the output
file's storage device when the file system supports this. Although
this option makes gzip safer in the presence of system crashes, it
can make gzip considerably slower.
gzip now accepts the --rsyncable option. This option is accepted in
all modes, but has effect only when compressing: it makes the resulting
output more amenable to efficient use of rsync. For example, when a
large input file gets a small change, a gzip --rsyncable image of
that file will remain largely unchanged, too. Without --rsyncable,
even a tiny change in the input could result in a totally different
gzip-compressed output file.
** Bug fixes
gzip -k -v no longer reports that files are replaced.
[bug present since the beginning]
zgrep -f A B C no longer reads A more than once if A is not a regular file.
This better supports invocations like 'zgrep -f <(COMMAND) B C' in Bash.
[bug introduced in gzip-1.2]
This is to announce gzip-1.6, a stable release.
There have been 35 commits by 4 people in the 51 weeks since 1.5.
See the NEWS below for a brief summary.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
Eric Blake (1)
Jim Meyering (15)
Paul Eggert (18)
Rodrigo Campos (1)
Jim [on behalf of the gzip maintainers]
==================================================================
Here is the GNU gzip home page:
http://gnu.org/s/gzip/
For a summary of changes and contributors, see:
http://git.sv.gnu.org/gitweb/?p=gzip.git;a=shortlog;h=v1.6
or run this command from a git-cloned gzip directory:
git shortlog v1.5..v1.6
To summarize the 503 gnulib-related changes, run these commands
from a git-cloned gzip directory:
git checkout v1.6
git submodule summary v1.5
Here are the compressed sources:
http://ftp.gnu.org/gnu/gzip/gzip-1.6.tar.gz (1.1MB)
http://ftp.gnu.org/gnu/gzip/gzip-1.6.tar.xz (712KB)
Here are the GPG detached signatures[*]:
http://ftp.gnu.org/gnu/gzip/gzip-1.6.tar.gz.sig
http://ftp.gnu.org/gnu/gzip/gzip-1.6.tar.xz.sig
Use a mirror for higher download bandwidth:
http://www.gnu.org/order/ftp.html
[*] Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify gzip-1.6.tar.gz.sig
If that command fails because you don't have the required public key,
then run this command to import it:
gpg --keyserver keys.gnupg.net --recv-keys 7FD9FCCB000BEEEE
and rerun the 'gpg --verify' command.
This release was bootstrapped with the following tools:
Autoconf 2.69.97-b1aba91
Automake 1.99a
Gnulib v0.0-7953-g9be0b54
NEWS
* Noteworthy changes in release 1.6 (2013-06-09) [stable]
** New features
gzip now accepts the --keep (-k) option, for consistency with tools
like xz, lzip and bzip2. With this option, gzip no longer removes
named input files when compressing or decompressing.
** Bug fixes
gzip -d no longer malfunctions with certain invalid data in 'pack' format.
[bug introduced in gzip-0.8]
When overwriting, gzip no longer acts as if you typed "y" when you type "n",
on some platforms when compiled with optimization.
[bug introduced in gzip-1.3.6]
zgrep no longer malfunctions with a multi-digit context option like -15.
Now, it passes that option to grep (equivalent to -C15) just as it does
for single-digit options. [bug introduced in gzip-1.3.12]
zmore now acts more like 'more', and is more portable to POSIXish hosts.
This is to announce gzip-1.5, a stable release.
There have been 118 commits by 7 people in the 2.5 years since 1.4.
See the NEWS below for a brief summary.
Thanks to everyone who has contributed!
The following people contributed changes to this release:
Dmitry V. Levin (3)
Eric Blake (3)
Jim Meyering (84)
Mark Adler (1)
Paul Eggert (24)
Paul R. Eggert (2)
Rob Vermaas (1)
Jim [on behalf of the gzip maintainers]
==================================================================
Here is the GNU gzip home page:
http://gnu.org/s/gzip/
For a summary of changes and contributors, see:
http://git.sv.gnu.org/gitweb/?p=gzip.git;a=shortlog;h=v1.5
or run this command from a git-cloned gzip directory:
git shortlog v1.4..v1.5
To summarize the 4107 gnulib-related changes, run these commands
from a git-cloned gzip directory:
git checkout v1.5
git submodule summary v1.4
==================================================================
Here are the compressed sources:
http://ftp.gnu.org/gnu/gzip/gzip-1.5.tar.gz (1.1MB)
http://ftp.gnu.org/gnu/gzip/gzip-1.5.tar.xz (708KB)
Here are the GPG detached signatures[*]:
http://ftp.gnu.org/gnu/gzip/gzip-1.5.tar.gz.sig
http://ftp.gnu.org/gnu/gzip/gzip-1.5.tar.xz.sig
Use a mirror for higher download bandwidth:
http://www.gnu.org/order/ftp.html
[*] Use a .sig file to verify that the corresponding file (without the
.sig suffix) is intact. First, be sure to download both the .sig file
and the corresponding tarball. Then, run a command like this:
gpg --verify gzip-1.5.tar.gz.sig
If that command fails because you don't have the required public key,
then run this command to import it:
gpg --keyserver keys.gnupg.net --recv-keys 7FD9FCCB000BEEEE
and rerun the 'gpg --verify' command.
This release was bootstrapped with the following tools:
Autoconf 2.69.4-560f
Automake 1.12a
Gnulib v0.0-7450-g5eae670
==================================================================
NEWS
* Noteworthy changes in release 1.5 (2012-06-17) [stable]
** Bug fixes
gzip -d now decodes and checks header CRC16 checksums as specified by
the FHCRC section of Internet RFC 1952.
"gzip -d -S '' precious.gz" is now rejected immediately. Before,
that command would emulate "rm -i precious.gz", but with an easily-
misunderstood prompt. I.e., gzip would ask if it's ok to remove the
existing file, "precious.gz". If you made the mistake of saying "yes",
it would remove that input file before attempting to uncompress it.
gzip -cdf now properly handles input consisting of gzip'd data followed
by uncompressed data. Before it would output raw compressed input, too.
For example, now "(printf x|gzip; echo y)|gzip -dcf" prints "xy\n",
while before it would print "x<compressed data>y\n".
gzip -rf no longer compresses files more than once (e.g., replacing
FOO with FOO.gz.gz) on file systems such as ZFS where a readdir
loop that unlinks and creates files can revisit output files.
This is to announce a stable release of the gzip compression tools.
The most important change is the one that addresses CVE-2010-0001,
mentioned in NEWS below.
http://www.gnu.org/software/gzip/
For a summary of changes and contributors, see:
http://git.sv.gnu.org/gitweb/?p=gzip.git;a=shortlog;h=v1.4
or run this command from a git-cloned gzip directory:
git shortlog v1.3.14..v1.4
Here are the compressed sources:
ftp://ftp.gnu.org/gnu/gzip/gzip-1.4.tar.gz (888KB)
ftp://ftp.gnu.org/gnu/gzip/gzip-1.4.tar.xz (600KB)
Here are the GPG detached signatures[*]:
ftp://ftp.gnu.org/gnu/gzip/gzip-1.4.tar.gz.sig
ftp://ftp.gnu.org/gnu/gzip/gzip-1.4.tar.xz.sig
To reduce load on the main server, use a mirror listed at:
http://www.gnu.org/order/ftp.html
[*] You can use either of the above signature files to verify that
the corresponding file (without the .sig suffix) is intact. First,
be sure to download both the .sig file and the corresponding tarball.
Then, run a command like this:
gpg --verify gzip-1.4.tar.gz.sig
If that command fails because you don't have the required public key,
then run this command to import it:
gpg --keyserver keys.gnupg.net --recv-keys B9AB9A16
and rerun the `gpg --verify' command.
This release was bootstrapped with the following tools:
Autoconf 2.65.23-13e35
Automake 1.11a
Gnulib v0.0-3341-gb4349b9
./NEWS
* Noteworthy changes in release 1.4 (2010-01-20) [stable]
** Bug fixes
gzip -d could segfault and/or clobber the stack, possibly leading to
arbitrary code execution. This affects x86_64 but not 32-bit systems.
This fixes CVE-2010-0001.
For more details, see http://bugzilla.redhat.com/554418
gzip -d would fail with a CRC error for some valid inputs.
So far, the only valid input known to exhibit this failure was
compressed "from FAT filesystem (MS-DOS, OS/2, NT)". In addition,
to trigger the failure, your memcpy implementation must copy in
the "reverse" order.
The announcement is here:
http://article.gmane.org/gmane.comp.gnu.gzip.bugs/280
The announcement is here:
http://article.gmane.org/gmane.comp.gnu.gzip.bugs/258