Skip to content

Conversation

@heitbaum
Copy link

With the malicious actor changes to upstream xz, make the LZMA library optional. .xz support in pvr.iptvsimple is limited to epg files.

Signed-off-by: Rudi Heitbaum <[email protected]>
@AlwinEsch
Copy link
Contributor

NOTE:: There also xz-utils 5.4.3 where use the bad checksum and possible download from dangerous source place! Should changed too.

-- verifying file...
       file='C:/jenkins-workspace/workspace/binary-addons/kodi-windows-i686-Omega/cmake/addons/build/download/xz-5.4.3.tar.xz'
-- SHA256 hash of
    C:/jenkins-workspace/workspace/binary-addons/kodi-windows-i686-Omega/cmake/addons/build/download/xz-5.4.3.tar.xz
  does not match expected value
    expected: '92177bef62c3824b4badc524f8abcce54a20b7dbcfb84cde0a2eb8b49159518c'
      actual: '6732bd6c5e2cc7f520a645bdb006a286c7790f73950213cd59d2a9e4e4fd3d36'

@AlwinEsch
Copy link
Contributor

AlwinEsch commented Mar 30, 2024

NOTE:: There also xz-utils 5.4.3 where use the bad checksum and possible download from dangerous source place! Should changed too.
....

@phunkyfish created a request here about #850

@AlwinEsch AlwinEsch requested a review from phunkyfish March 30, 2024 10:19
@phunkyfish
Copy link
Member

NOTE:: There also xz-utils 5.4.3 where use the bad checksum and possible download from dangerous source place! Should changed too.
....

@phunkyfish created a request here about #850

This won’t work unfortunately. 5.4.1 won’t build for win UWP. So we’ll just need to upload 5.4.3 to our kodi mirrors

@phunkyfish
Copy link
Member

I think is too much of a change, we don't link xz with sshd so this is a non-issue IMHO. Plus we are using an older version which should be safe anyway.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants