Hello, I was updated trixie code with 7zip 26.02. Here is minimized debdiff that only includes "debian/" directory.
Examine all diffs from online: https://salsa.debian.org/debian/7zip/-/compare/debian%2F25.01+dfsg-1_deb13u2...debian%2Ftrixie?from_project_id=61356 -- YOKOTA Hiroshi
diff --git a/debian/changelog b/debian/changelog index d71fe1b..3354853 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,30 @@ +7zip (26.02+dfsg-1~deb13u1) trixie; urgency=medium + + * 7zip 26.02 includes this fix: + CVE-2026-14266: Heap-based Buffer Overflow + * 7zip 26.01 includes these fixes: + CVE-2026-48092: SquashFS Fragment Offset Overflow + CVE-2026-48095: Heap Buffer Write Overflow + CVE-2026-48101: UEFI Capsule uninitialized heap memory disclosure + CVE-2026-48102: UDF Field OOB Read + CVE-2026-48103: WIM SecurityId OOB read + CVE-2026-48104: SquashFS BlockToNode uninitialized heap read + CVE-2026-48111: UEFI DEPEX OOB Read + CVE-2026-48112: Ar SYMDEF OOB Read + + * New upstream version 26.01+dfsg + * Change EOL from DOS style to Unix style in patch file + * Update debian/watch + * Drop file permission hack + * Configure git-buidpackage for trixie update + * Sync with p7zip/16.02+really26.01+dfsg-0+deb12u1 + * Add Salsa CI configuration file + * New upstream version 26.02+dfsg + * Update changelog for 26.01+dfsg-1~deb13u1 release + * Update changelog for 26.02+dfsg-1~deb13u1 release + + -- YOKOTA Hiroshi <[email protected]> Sat, 18 Jul 2026 09:08:21 +0900 + 7zip (25.01+dfsg-1~deb13u2) trixie; urgency=medium * Non-maintainer upload by the LTS Security Team. diff --git a/debian/copyright b/debian/copyright index e8034c0..abaed6b 100644 --- a/debian/copyright +++ b/debian/copyright @@ -5,7 +5,7 @@ Files-Excluded: CPP/7zip/Compress/Rar* Comment: RAR code is under the non-free "unRAR license restriction" Files: * -Copyright: 1999-2024 Igor Pavlov +Copyright: 1999-2026 Igor Pavlov License: LGPL-2.1+ Files: Asm/arm64/7zAsm.S @@ -160,7 +160,7 @@ Comment: the code was developed by Igor Pavlov, using Zstandard format Files: debian/* Copyright: 2021 Collabora, Ltd. - 2021-2024 YOKOTA Hiroshi <[email protected]> + 2021-2026 YOKOTA Hiroshi <[email protected]> License: LGPL-2.1+ License: LGPL-2.1+ diff --git a/debian/gbp.conf b/debian/gbp.conf index f055ec8..35ee03c 100644 --- a/debian/gbp.conf +++ b/debian/gbp.conf @@ -1,3 +1,5 @@ +[DEFAULT] +debian-branch = debian/trixie + [import-orig] pristine-tar = True -postunpack = find Asm C CPP DOC -type f -execdir chmod -x {} ";" diff --git a/debian/man/7z.1 b/debian/man/7z.1 index f981c3a..75f1a5a 100644 --- a/debian/man/7z.1 +++ b/debian/man/7z.1 @@ -211,6 +211,25 @@ eliminate duplication of root folder for extract command \-spf use fully qualified file paths .TP +\-spo{d|c|r} +specifies the path generation mode for the output directory +for archive extraction. The output directory path is generated from the path specified +in the -o{\fI\,dir_path\fR\,} switch and the name of the archive being unpacked. +.RS +.TQ +\-spod +for Linux/Posix/macOS: -o{\fI\,dir_path\fR\,} specifies the direct path to the output directory. +The asterisk (*) character in {\fI\,dir_path\fR\,} will not be replaced by the archive name. +.TQ +\-spoc +7-Zip will concatenate the path specified in -o{\fI\,dir_path\fR\,} with the archive name +to form the final path to the output directory. +.TQ +\-spor +7-Zip will replace asterisk (*) character in the path specified in the -o{\fI\,dir_path\fR\,} +with the archive name. This is the default option. +.RE +.TP \-ssc[\-] set sensitive case mode .TP diff --git a/debian/patches/0001-Accept-Debian-build-flags.patch b/debian/patches/0001-Accept-Debian-build-flags.patch index 2bf482c..b57d44d 100644 --- a/debian/patches/0001-Accept-Debian-build-flags.patch +++ b/debian/patches/0001-Accept-Debian-build-flags.patch @@ -8,7 +8,7 @@ Forwarded: not-needed 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/CPP/7zip/7zip_gcc.mak b/CPP/7zip/7zip_gcc.mak -index 8fbef14..2756ba4 100644 +index a78c0fa..0e4055f 100644 --- a/CPP/7zip/7zip_gcc.mak +++ b/CPP/7zip/7zip_gcc.mak @@ -45,7 +45,7 @@ CFLAGS_DEBUG = -g @@ -25,7 +25,7 @@ index 8fbef14..2756ba4 100644 else SHARED_EXT=.so -LDFLAGS = -shared -fPIC $(LDFLAGS_STATIC) -+LDFLAGS = -shared -fPIC $(DEB_LDFLAGS) $(LDFLAGS_STATIC) ++LDFLAGS = -shared -fPIC $(DEB_7Z_LDFLAGS) $(LDFLAGS_STATIC) CC_SHARED=-fPIC endif @@ -33,7 +33,7 @@ index 8fbef14..2756ba4 100644 else -LDFLAGS = $(LDFLAGS_STATIC) -+LDFLAGS = $(DEB_LDFLAGS) $(LDFLAGS_STATIC) ++LDFLAGS = $(DEB_7Z_LDFLAGS) $(LDFLAGS_STATIC) # -z force-bti # -s is not required for clang, do we need it for GCC ??? @@ -42,7 +42,7 @@ index 8fbef14..2756ba4 100644 -CFLAGS = $(MY_ARCH_2) $(LOCAL_FLAGS) $(CFLAGS_BASE2) $(CFLAGS_BASE) $(FLAGS_FLTO) $(CC_SHARED) -o $@ -+CFLAGS = $(DEB_CFLAGS) $(DEB_CPPFLAGS) $(MY_ARCH_2) $(LOCAL_FLAGS) $(CFLAGS_BASE2) $(CFLAGS_BASE) $(FLAGS_FLTO) $(CC_SHARED) -o $@ ++CFLAGS = $(DEB_7Z_CFLAGS) $(DEB_7Z_CPPFLAGS) $(MY_ARCH_2) $(LOCAL_FLAGS) $(CFLAGS_BASE2) $(CFLAGS_BASE) $(FLAGS_FLTO) $(CC_SHARED) -o $@ ifdef IS_MINGW @@ -51,7 +51,7 @@ index 8fbef14..2756ba4 100644 #-Wno-reorder -CXXFLAGS = $(MY_ARCH_2) $(LOCAL_FLAGS) $(CXXFLAGS_BASE2) $(CFLAGS_BASE) $(FLAGS_FLTO) $(CXXFLAGS_EXTRA) $(CC_SHARED) $(CXX_WARN_FLAGS) $(CXX_STD_FLAGS) $(CXX_INCLUDE_FLAGS) -o $@ -+CXXFLAGS = $(DEB_CXXFLAGS) $(DEB_CPPFLAGS) $(MY_ARCH_2) $(LOCAL_FLAGS) $(CXXFLAGS_BASE2) $(CFLAGS_BASE) $(FLAGS_FLTO) $(CXXFLAGS_EXTRA) $(CC_SHARED) $(CXX_WARN_FLAGS) $(CXX_STD_FLAGS) $(CXX_INCLUDE_FLAGS) -o $@ ++CXXFLAGS = $(DEB_7Z_CXXFLAGS) $(DEB_7Z_CPPFLAGS) $(MY_ARCH_2) $(LOCAL_FLAGS) $(CXXFLAGS_BASE2) $(CFLAGS_BASE) $(FLAGS_FLTO) $(CXXFLAGS_EXTRA) $(CC_SHARED) $(CXX_WARN_FLAGS) $(CXX_STD_FLAGS) $(CXX_INCLUDE_FLAGS) -o $@ STATIC_TARGET= ifdef COMPL_STATIC diff --git a/debian/patches/0002-Use-getcwd-3-POSIX-extension-to-avoid-PATH_MAX-macro.patch b/debian/patches/0002-Use-getcwd-3-POSIX-extension-to-avoid-PATH_MAX-macro.patch index 812805a..d91ddbc 100644 --- a/debian/patches/0002-Use-getcwd-3-POSIX-extension-to-avoid-PATH_MAX-macro.patch +++ b/debian/patches/0002-Use-getcwd-3-POSIX-extension-to-avoid-PATH_MAX-macro.patch @@ -10,7 +10,7 @@ This fix helps GNU Hurd. 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/CPP/Windows/FileDir.cpp b/CPP/Windows/FileDir.cpp -index 4a4bf52..e1747fc 100644 +index ad0d8c9..f5f94d4 100644 --- a/CPP/Windows/FileDir.cpp +++ b/CPP/Windows/FileDir.cpp @@ -1141,22 +1141,11 @@ bool GetCurrentDir(FString &path) diff --git a/debian/patches/0003-Disable-local-echo-display-when-in-input-passwords-C.patch b/debian/patches/0003-Disable-local-echo-display-when-in-input-passwords-C.patch index c5e7182..a240e4e 100644 --- a/debian/patches/0003-Disable-local-echo-display-when-in-input-passwords-C.patch +++ b/debian/patches/0003-Disable-local-echo-display-when-in-input-passwords-C.patch @@ -11,7 +11,7 @@ Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006238 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/CPP/7zip/UI/Console/UserInputUtils.cpp b/CPP/7zip/UI/Console/UserInputUtils.cpp -index 6c3c85a..2832b00 100644 +index 2adf9df..fbc1568 100644 --- a/CPP/7zip/UI/Console/UserInputUtils.cpp +++ b/CPP/7zip/UI/Console/UserInputUtils.cpp @@ -57,9 +57,18 @@ NUserAnswerMode::EEnum ScanUserYesNoAllQuit(CStdOutStream *outStream) @@ -72,7 +72,7 @@ index 6c3c85a..2832b00 100644 const bool res = g_StdIn.ScanUStringUntilNewLine(psw); diff --git a/CPP/Common/StdInStream.h b/CPP/Common/StdInStream.h -index 2253c43..69d84fe 100644 +index 81ca3bf..e8b6214 100644 --- a/CPP/Common/StdInStream.h +++ b/CPP/Common/StdInStream.h @@ -23,7 +23,10 @@ public: diff --git a/debian/patches/0004-Use-system-locale-to-select-codepage-for-legacy-zip-.patch b/debian/patches/0004-Use-system-locale-to-select-codepage-for-legacy-zip-.patch index e593bf6..25de1a6 100644 --- a/debian/patches/0004-Use-system-locale-to-select-codepage-for-legacy-zip-.patch +++ b/debian/patches/0004-Use-system-locale-to-select-codepage-for-legacy-zip-.patch @@ -11,7 +11,7 @@ Fixes https://sourceforge.net/p/sevenzip/bugs/2473/ 1 file changed, 184 insertions(+), 2 deletions(-) diff --git a/CPP/7zip/Archive/Zip/ZipItem.cpp b/CPP/7zip/Archive/Zip/ZipItem.cpp -index 272e53b..47f6178 100644 +index 5684cac..b067182 100644 --- a/CPP/7zip/Archive/Zip/ZipItem.cpp +++ b/CPP/7zip/Archive/Zip/ZipItem.cpp @@ -1,5 +1,12 @@ diff --git a/debian/patches/0005-Add-note-for-unexpected-recursive-operations-behavio.patch b/debian/patches/0005-Add-note-for-unexpected-recursive-operations-behavio.patch index 440ee78..445b874 100644 --- a/debian/patches/0005-Add-note-for-unexpected-recursive-operations-behavio.patch +++ b/debian/patches/0005-Add-note-for-unexpected-recursive-operations-behavio.patch @@ -9,7 +9,7 @@ Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1091693 1 file changed, 4 insertions(+) diff --git a/CPP/7zip/UI/Console/Main.cpp b/CPP/7zip/UI/Console/Main.cpp -index 5094452..7511322 100644 +index 521fe77..1b6c2a3 100644 --- a/CPP/7zip/UI/Console/Main.cpp +++ b/CPP/7zip/UI/Console/Main.cpp @@ -133,6 +133,10 @@ static const char * const kHelpString = diff --git a/debian/patches/0006-Use-c-flags-for-asmc.patch b/debian/patches/0006-Use-c-flags-for-asmc.patch index 4a30667..155ca03 100644 --- a/debian/patches/0006-Use-c-flags-for-asmc.patch +++ b/debian/patches/0006-Use-c-flags-for-asmc.patch @@ -8,7 +8,7 @@ No needs to build executable files while in assembling. 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CPP/7zip/7zip_gcc.mak b/CPP/7zip/7zip_gcc.mak -index 2756ba4..5d05cf0 100644 +index 0e4055f..4e74da6 100644 --- a/CPP/7zip/7zip_gcc.mak +++ b/CPP/7zip/7zip_gcc.mak @@ -194,7 +194,7 @@ AFLAGS_ABI = -elf -DABI_LINUX -DABI_CDECL diff --git a/debian/patches/0007-Add-fpic-for-Asmc-options.patch b/debian/patches/0007-Add-fpic-for-Asmc-options.patch index 396fdfe..ca1e461 100644 --- a/debian/patches/0007-Add-fpic-for-Asmc-options.patch +++ b/debian/patches/0007-Add-fpic-for-Asmc-options.patch @@ -9,7 +9,7 @@ Asmc author suggests this option: 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CPP/7zip/7zip_gcc.mak b/CPP/7zip/7zip_gcc.mak -index 5d05cf0..3fada36 100644 +index 4e74da6..e8fcde4 100644 --- a/CPP/7zip/7zip_gcc.mak +++ b/CPP/7zip/7zip_gcc.mak @@ -194,7 +194,7 @@ AFLAGS_ABI = -elf -DABI_LINUX -DABI_CDECL diff --git a/debian/rules b/debian/rules index 3286f48..82ab4a2 100755 --- a/debian/rules +++ b/debian/rules @@ -41,45 +41,45 @@ override_dh_auto_build: $(MAKE) -C CPP/7zip/Bundles/Alone2 -f $(m) \ CROSS_COMPILE="$(DEB_HOST_GNU_TYPE)-" \ DISABLE_RAR=1 \ - DEB_CFLAGS="$(CFLAGS) -pipe" \ - DEB_CXXFLAGS="$(CXXFLAGS) -pipe" \ - DEB_CPPFLAGS="$(CPPFLAGS)" \ - DEB_LDFLAGS="$(LDFLAGS) -pipe" + DEB_7Z_CFLAGS="$(CFLAGS)" \ + DEB_7Z_CXXFLAGS="$(CXXFLAGS)" \ + DEB_7Z_CPPFLAGS="$(CPPFLAGS)" \ + DEB_7Z_LDFLAGS="$(LDFLAGS)" $(MAKE) -C CPP/7zip/Bundles/Format7zF -f $(m) \ CROSS_COMPILE="$(DEB_HOST_GNU_TYPE)-" \ DISABLE_RAR_COMPRESS=1 \ - DEB_CFLAGS="$(CFLAGS) -pipe" \ - DEB_CXXFLAGS="$(CXXFLAGS) -pipe" \ - DEB_CPPFLAGS="$(CPPFLAGS)" \ - DEB_LDFLAGS="$(LDFLAGS) -pipe" + DEB_7Z_CFLAGS="$(CFLAGS)" \ + DEB_7Z_CXXFLAGS="$(CXXFLAGS)" \ + DEB_7Z_CPPFLAGS="$(CPPFLAGS)" \ + DEB_7Z_LDFLAGS="$(LDFLAGS)" $(MAKE) -C CPP/7zip/UI/Console -f $(m) \ CROSS_COMPILE="$(DEB_HOST_GNU_TYPE)-" \ DISABLE_RAR=1 \ - DEB_CFLAGS="$(CFLAGS) -pipe" \ - DEB_CXXFLAGS="$(CXXFLAGS) -pipe" \ - DEB_CPPFLAGS="$(CPPFLAGS)" \ - DEB_LDFLAGS="$(LDFLAGS) -pipe" + DEB_7Z_CFLAGS="$(CFLAGS)" \ + DEB_7Z_CXXFLAGS="$(CXXFLAGS)" \ + DEB_7Z_CPPFLAGS="$(CPPFLAGS)" \ + DEB_7Z_LDFLAGS="$(LDFLAGS)" $(MAKE) -C CPP/7zip/Bundles/SFXCon -f $(m) \ CROSS_COMPILE="$(DEB_HOST_GNU_TYPE)-" \ DISABLE_RAR=1 \ - DEB_CFLAGS="$(CFLAGS) -pipe" \ - DEB_CXXFLAGS="$(CXXFLAGS) -pipe" \ - DEB_CPPFLAGS="$(CPPFLAGS)" \ - DEB_LDFLAGS="$(LDFLAGS) -pipe" + DEB_7Z_CFLAGS="$(CFLAGS)" \ + DEB_7Z_CXXFLAGS="$(CXXFLAGS)" \ + DEB_7Z_CPPFLAGS="$(CPPFLAGS)" \ + DEB_7Z_LDFLAGS="$(LDFLAGS)" $(MAKE) -C CPP/7zip/Bundles/Alone -f $(m) \ CROSS_COMPILE="$(DEB_HOST_GNU_TYPE)-" \ DISABLE_RAR=1 \ - DEB_CFLAGS="$(CFLAGS) -pipe" \ - DEB_CXXFLAGS="$(CXXFLAGS) -pipe" \ - DEB_CPPFLAGS="$(CPPFLAGS)" \ - DEB_LDFLAGS="$(LDFLAGS) -pipe" + DEB_7Z_CFLAGS="$(CFLAGS)" \ + DEB_7Z_CXXFLAGS="$(CXXFLAGS)" \ + DEB_7Z_CPPFLAGS="$(CPPFLAGS)" \ + DEB_7Z_LDFLAGS="$(LDFLAGS)" $(MAKE) -C CPP/7zip/Bundles/Alone7z -f $(m) \ CROSS_COMPILE="$(DEB_HOST_GNU_TYPE)-" \ DISABLE_RAR=1 \ - DEB_CFLAGS="$(CFLAGS) -pipe" \ - DEB_CXXFLAGS="$(CXXFLAGS) -pipe" \ - DEB_CPPFLAGS="$(CPPFLAGS)" \ - DEB_LDFLAGS="$(LDFLAGS) -pipe" + DEB_7Z_CFLAGS="$(CFLAGS)" \ + DEB_7Z_CXXFLAGS="$(CXXFLAGS)" \ + DEB_7Z_CPPFLAGS="$(CPPFLAGS)" \ + DEB_7Z_LDFLAGS="$(LDFLAGS)" override_dh_auto_clean: $(MAKE) -C CPP/7zip/Bundles/Alone2 -f $(m) clean diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml new file mode 100644 index 0000000..8424db4 --- /dev/null +++ b/debian/salsa-ci.yml @@ -0,0 +1,3 @@ +--- +include: + - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/recipes/debian.yml diff --git a/debian/watch b/debian/watch index ddb2188..893ab8d 100644 --- a/debian/watch +++ b/debian/watch @@ -1,7 +1,10 @@ # -*- mode: conf -*- version=4 -opts="uversionmangle=s/(\d{2})(\d{2})/$1.$2/, \ +opts="filenamemangle=s%.*/@ANY_VERSION@%@PACKAGE@-$1.tar.gz%, \ + downloadurlmangle=s%api.github.com/repos/([^/]+/[^/]+)/git/refs/tags/@ANY_VERSION@%github.com/$1/archive/refs/tags/$2.tar.gz%g, \ + searchmode=plain, \ dversionmangle=s/\+dfsg$//, \ oversionmangle=s/$/+dfsg/, \ pgpmode=none" \ -https://www.7-zip.org/download.html a/7z(\d{4})-src\.tar\.xz +https://api.github.com/repos/ip7z/7zip/git/matching-refs/tags/ \ + https://api.github.com/repos/[^/]+/[^/]+/git/refs/tags/@ANY_VERSION@
