Maneage - Bugs: bug #62700, lzma/xz compilation bug for cmake...
You are not allowed to post comments on this tracker with your current authentication level.
bug #62700: lzma/xz compilation bug for cmake in Maneage 27ff6f7
Submitter: | Boud Roukema <boud> | ||
Submitted: | Sun 03 Jul 2022 05:37:02 PM UTC | ||
Category: | Software | Severity: | 3 - Normal |
Item Group: | Crash | Status: | Postponed |
Privacy: | Public | Assigned to: | boud |
Open/Closed: | Open |
Jump to the original submission
Wed 01 May 2024 10:15:05 PM UTC, comment #11: |
Boud Roukema <boud> |
Sat 20 Apr 2024 10:20:14 AM UTC, comment #10: In case anyone didn't hear about it, xz versions 5.6.0 and 5.6.1 definitely have a backdoor [1], CVE-2024-3094, most likely by a state actor, that could have let a specific crackers' group have ssh access to many of the most secure servers around the world - x86_64 Debian servers - if it hadn't been discovered in time [2]. The xz community is still working on a full audit of possibly affected code on irc #tukaani on LiberaChat, and that will take some time.
|
Boud Roukema <boud> |
Sat 11 Mar 2023 09:00:45 PM UTC, comment #9: Looks like xz 5.2.7 was released 5 months ago, and 5.4.1 was released 8 weeks ago:
|
Boud Roukema <boud> |
Tue 20 Sep 2022 08:39:33 PM UTC, comment #8: The time scale for xz-5.2.7 to be released should be a month or so; possbly shorter. On Maneage time scales, that's short :).
|
Boud Roukema <boud> |
Sat 10 Sep 2022 05:47:23 PM UTC, comment #7: There are effectively two different bugs:
|
Boud Roukema <boud> |
Fri 09 Sep 2022 06:25:56 PM UTC, comment #6: While it is useful for xz to protect against the CentOS 7 mess, in principle, Maneage should not have detected the error, since we build both xz and cmake.
to
in the high-level.mk rule for building cmake.
|
Boud Roukema <boud> |
Thu 01 Sep 2022 04:18:17 PM UTC, comment #5: Lasse Collin, the xz developer, proposed a much cleaner fix, on the Libera Chat irc channel #tukaani, as suggested at https://tukaani.org . I'm currently testing the fix.
|
Boud Roukema <boud> |
Mon 08 Aug 2022 08:38:22 PM UTC, comment #4: The fix in https://savannah.nongnu.org/task/?16244 works for me. I think we could leave this bug open for a while though, to see if xz upstream finally comes up with any comments - e.g. let's say another month, since the main xz developer is probably on holidays.
|
Boud Roukema <boud> |
Sun 07 Aug 2022 03:39:32 PM UTC, comment #3: This bug has been implemented as part of task #16244. |
Mohammad Akhlaghi <makhlaghi> |
Fri 15 Jul 2022 02:44:19 PM UTC, comment #2: See the #14991 github/easybuilders thread, which points to a pdf by Pat Riehecky [1]. It seems like the bug is not the fault of cmake in CentOS7, it's rather related to pthread/glibc in CentOS7. Our long-term solution is task 15390: install our own glibc [2] :).
|
Boud Roukema <boud> |
Thu 14 Jul 2022 02:40:31 PM UTC, comment #1: Based on discussion at 'easybuild' [1] and testing by me, it looks like the known hack is necessary and sufficient for CentOS7 systems and might not cause bugs in other systems. Commit 25539cd69c of branch 'xz_centos7_fix' of 'Maneage' [2] implements the known hack and works for me on a CentOS Linux 7.9.2009 system and a Debian GNU/Linux 11.3 system.
|
Boud Roukema <boud> |
Sun 03 Jul 2022 05:37:02 PM UTC, original submission:
SYSTEM:
|
Boud Roukema <boud> |
No files currently attached
Depends on the following items: None found
Items that depend on this one: None found
There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.
Follow 9 latest changes.
Date | Changed by | Updated Field | Previous Value | => | Replaced by |
---|---|---|---|---|---|
2022-09-10 | boud | Status | In Progress | Postponed | |
2022-09-01 | boud | Status | Fixed | In Progress | |
2022-08-08 | boud | Open/Closed | Closed | Open | |
2022-08-08 | boud | Severity | 5 - Blocker | 3 - Normal | |
2022-08-07 | makhlaghi | Status | Works For Me | Fixed | |
Assigned to | None | boud | |||
Open/Closed | Open | Closed | |||
2022-07-14 | boud | Severity | 3 - Normal | 5 - Blocker | |
Status | None | Works For Me |
Powered by Savane 3.13-4b48.
Corresponding source code
There are likely to be better options than commit 2581607 (my message of 20 April 2024). Either version 5.2.12 or 5.4.6, freshly created as a tarball by us from https://git.tukaani.org/?p=xz.git;a=summary and placed on Zenodo; or a tarball from one of these created and signed by Larhzu (Lasse Collin) and given a clearly labelled new name such as xz-5.4.6-rerelease.tar.gz , should be reasonably safe (see [1]). These will not need the hacks in the rule in reproduce/software/make/basic.mk .
Meanwhile, here's a minor stocktake of the "current" state of Maneage regarding xz, depending on how we interpret "current state":
The comment in urls.conf means that http://tukaani.org/xz will not be used; instead a default URL will be used based on the downloader rules in reproduce/software/shell/configure.sh , so probably from Zenodo.
The build rule has my early hack inspired from the 'easybuild-easyconfigs' people, at the time I was waiting for an upstream xz response: https://git.maneage.org/project.git/tree/reproduce/software/make/basic.mk
In the current live git versions of my published papers, we have:
The most recent paper - Peper+2023 - still has a commented version describing my early hack; it is inactive:
https://codeberg.org/mpeper/lensing/src/branch/lensing/reproduce/software/make/basic.mk#L266
[1] https://github.com/tukaani-project/xz/issues/103#issuecomment-2088735668