busybox-w32/archival/libarchive, branch zstdA mirror of https://github.com/rmyorston/busybox-w32.git
https://git.lua4.win/busybox-w32/atom?h=zstd2026-03-24T12:15:33+00:00archival: support zstd in rpm and dpkg2026-03-24T12:15:33+00:00Ron Yorstonrmy@pobox.com2026-03-24T12:15:33+00:00urn:sha1:aaae1865727bcd53da581340456de34dfb182d5ctar: support zstd compression2026-03-22T13:30:58+00:00Ron Yorstonrmy@pobox.com2026-03-22T13:30:58+00:00urn:sha1:052807cc3330b3c5c1fb60b93ad0d2039d6142df
Use external utilities (not supplied!) to support zstd compression
in tar.
Adds 232-256 bytes.
Merge branch 'busybox' into merge2026-03-11T10:14:49+00:00Ron Yorstonrmy@pobox.com2026-03-11T10:14:49+00:00urn:sha1:ede205bd07573813337b5706acb0cae3b127a36ftar: only strip unsafe components from hardlinks, not symlinks2026-02-28T04:59:18+00:00Radoslav Kolevradoslav.kolev@suse.com2026-02-16T09:50:04+00:00urn:sha1:599f5dd8fac390c18b79cba4c14c334957605dae
commit 3fb6b31c7 introduced a check for unsafe components in
tar archive hardlinks, but it was being applied to symlinks too
which broke "Symlinks and hardlinks coexist" tar test.
Signed-off-by: Radoslav Kolev <radoslav.kolev@suse.com>
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Merge branch 'busybox' into merge2026-02-12T12:58:38+00:00Ron Yorstonrmy@pobox.com2026-02-12T12:50:11+00:00urn:sha1:de7b34e8c779d8baca5abba1394284e0b6e87dc6Merge branch 'busybox' into merge2026-02-10T13:49:25+00:00Ron Yorstonrmy@pobox.com2026-02-10T13:49:25+00:00urn:sha1:0e3015ddb8538f6329c59ed984a9c59bba3f376e*: whitespace cleanup2026-02-08T07:31:13+00:00Denys Vlasenkovda.linux@googlemail.com2026-02-07T20:17:07+00:00urn:sha1:391fdea73b73673410c5e267ec08efd45b3f38ee
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
tar: strip unsafe hardlink components - GNU tar does the same2026-01-29T11:01:56+00:00Denys Vlasenkovda.linux@googlemail.com2026-01-29T10:48:02+00:00urn:sha1:3fb6b31c716669e12f75a2accd31bb7685b1a1cb
Defends against files like these (python reproducer):
import tarfile
ti = tarfile.TarInfo("leak_hosts")
ti.type = tarfile.LNKTYPE
ti.linkname = "/etc/hosts" # or "../etc/hosts" or ".."
ti.size = 0
with tarfile.open("/tmp/hardlink.tar", "w") as t:
t.addfile(ti)
function old new delta
skip_unsafe_prefix - 127 +127
get_header_tar 1752 1754 +2
.rodata 106861 106856 -5
unzip_main 2715 2706 -9
strip_unsafe_prefix 102 18 -84
------------------------------------------------------------------------------
(add/remove: 1/0 grow/shrink: 1/3 up/down: 129/-98) Total: 31 bytes
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
Merge branch 'busybox' into merge2025-10-06T06:53:56+00:00Ron Yorstonrmy@pobox.com2025-10-06T06:53:56+00:00urn:sha1:3b6192619de7b98db5155dbcfe4038355d97cdacarchival/libarchive: sanitize filenames on output (prevent control sequence attacks2025-09-24T01:30:12+00:00Denys Vlasenkovda.linux@googlemail.com2025-09-24T01:28:47+00:00urn:sha1:f5e1bf966b19ea1821f00a8c9ecd7774598689b4
This fixes CVE-2025-46394 (terminal escape sequence injection)
Original credit: Ian.Norton at entrust.com
function old new delta
header_list 9 15 +6
header_verbose_list 239 244 +5
------------------------------------------------------------------------------
(add/remove: 0/0 grow/shrink: 2/0 up/down: 11/0) Total: 11 bytes
Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>