staging/xback/tools/xz, branch master

tools: cache the configure results of eleven more autotools tools

2026-09-22T18:29:59Z

Configure stage without a cache against a warm cache: mtools 3.34 s -> 0.28 s gengetopt 4.39 s -> 2.13 s fakeroot 10.97 s -> 8.73 s xz 4.32 s -> 2.17 s libressl 3.07 s -> 1.46 s flex 12.32 s -> 10.98 s expat 2.74 s -> 1.52 s bc 1.34 s -> 0.38 s dosfstools 3.13 s -> 2.54 s libtool 2.86 s -> 2.29 s mtd-utils 4.06 s -> 3.56 s flex, fakeroot, dosfstools and mtd-utils run autoreconf in the same stage, and the cache does not reach that part. Each of the eleven configures the same way with a warm cache as it does without one: the check configures three times, without a cache, with a cold cache and with a warm cache, and every generated file of the first and the last run is identical. A static scan of each configure script found no cache check that changes CFLAGS, CPPFLAGS, LDFLAGS or LIBS without restoring it. patchelf, mklibs and automake pass the same check but gain less than half a second, so they stay out. make world after make tools/clean now takes 121 s against 177 s with cold caches. Signed-off-by: John Crispin

tools/xz: update to version 5.8.4

2026-09-21T11:28:13Z

Release Notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.4 Signed-off-by: Shiji Yang Link: https://github.com/openwrt/openwrt/pull/25295 Signed-off-by: Robert Marko

treewide: use HTTPS for PKG_SOURCE_URL where possible

2026-04-20T03:58:37Z

Switch http:// (and redundant ftp://) PKG_SOURCE_URL entries to https:// across tools/ and package/. PKG_HASH alone does not protect against an attacker tampering with insecure downloads when a maintainer regenerates the hash via `make ... FIXUP=1`: HTTPS authenticates the upstream so the captured hash reflects real upstream content. In-place http -> https (HTTPS reachability verified per host): - tools/elftosb, tools/lzop, tools/liblzo, tools/mpfr, tools/dosfstools, tools/libressl, tools/xz - package/libs/mpfr, package/libs/libmnl, package/libs/libnfnetlink Replaced with @OPENWRT (HTTPS-only mirror) where the upstream HTTPS host is dead or has a broken certificate: - package/libs/popt (ftp.rpm.org cert mismatch) - package/firmware/ixp4xx-microcode (was http://downloads.openwrt.org) - package/boot/imx-bootlets (trabant.uid0.hu cert mismatch) - package/boot/kobs-ng (freescale.com URL is dead, redirects to nxp.com root) Dropped redundant ftp://ftp.denx.de fallback (https://ftp.denx.de is already listed): - package/boot/uboot-tools, tools/mkimage Signed-off-by: Paul Spooren

tools/xz: update to 5.8.3

2026-04-06T13:58:13Z

This includes a fix for (CVE-2026-34743). Release Notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.3 Signed-off-by: Shiji Yang Link: https://github.com/openwrt/openwrt/pull/22790 Signed-off-by: Hauke Mehrtens

tools/xz: update to 5.8.2

2025-12-21T19:49:22Z

Release Notes: https://github.com/tukaani-project/xz/releases/tag/v5.8.2 Signed-off-by: Shiji Yang Link: https://github.com/openwrt/openwrt/pull/21208 Signed-off-by: Robert Marko

tools: xz: update to 5.8.1

2025-04-22T11:20:05Z

5.8.1 (2025-04-03) * Multithreaded .xz decoder (lzma_stream_decoder_mt()): - Fix a bug that could at least result in a crash with invalid input. (CVE-2025-31115) - Fix a performance bug: Only one thread was used if the whole input file was provided at once to lzma_code(), the output buffer was big enough, timeout was disabled, and LZMA_FINISH was used. There are no bug reports about this, thus it's possible that no real-world application was affected. * Avoid even with C11/C17 compilers. This fixes the build with Oracle Developer Studio 12.6 on Solaris 10 when the compiler is in C11 mode (the header doesn't exist). * Autotools: Restore compatibility with GNU make versions older than 4.0 by creating the package using GNU gettext 0.23.1 infrastructure instead of 0.24. * Update Croatian translation. Link: https://github.com/openwrt/openwrt/pull/18558 Signed-off-by: Robert Marko

tools/xz: update to 5.8.0

2025-04-01T19:47:15Z

Changelogs: https://github.com/tukaani-project/xz/releases/tag/v5.8.0 Signed-off-by: Shiji Yang Link: https://github.com/openwrt/openwrt/pull/18367 Signed-off-by: Nick Hainke

tools: xz: update to 5.6.4

2025-02-23T11:21:26Z

The serious liblzma backdoor vulnerability (CVE-2024-3094) has been fixed since v5.6.2. It's time to bump this tool to the latest version. This patch also added a new GitHub package URL. Changelogs: https://github.com/tukaani-project/xz/releases/tag/v5.6.2 https://github.com/tukaani-project/xz/releases/tag/v5.6.3 https://github.com/tukaani-project/xz/releases/tag/v5.6.4 Signed-off-by: Shiji Yang Link: https://github.com/openwrt/openwrt/pull/18063 Signed-off-by: Nick Hainke

Revert "tools/xz: update to 5.6.1" (CVE-2024-3094)

2024-03-29T16:59:56Z

This reverts commit 714c91d1a63f29650abaa9cf69ffa47cf2c70297 as probably the upstream xz repository and the xz tarballs have been backdoored. References: https://www.openwall.com/lists/oss-security/2024/03/29/4. Signed-off-by: Petr Štetiar

tools/xz: update to 5.6.1

2024-03-29T05:56:43Z

Change mirror to github. Signed-off-by: Nick Hainke