Downgrading liblzma5, xz, xz-devel, xz-lang?

English Install/Boot/Login
1

May be I am getting paranoid after the xz scandal. This seems normal, but wanted to ask the community anyway. Nothing in the email lists yet.

Running zypper dup a few minutes ago:

# zypper dup
Loading repository data...
Reading installed packages...
Warning: You are about to do a distribution upgrade with all enabled repositories. Make sure these repositories are compatible before you continue. See 'man zypper' for more information about this command.
Computing distribution upgrade...

The following 4 packages are going to be downgraded:
  liblzma5 xz xz-devel xz-lang

4 packages to downgrade.
Overall download size: 856.6 KiB. Already cached: 0 B. After the operation, 38.4 KiB will be freed.

Backend:  classic_rpmtrans
Continue? [y/n/v/...? shows all options] (y): n
2

What is the question?

3

If a downgrade of these libraries was planned and expected.

4

To get details of the update such as its version:

zypper lu

To read the changelog:

sudo zypper dup --download-only
rpm -qp --changelog </var/cache/zypp/packages/.../path-to-rpm> | less
5

It is impossible to answer because you provided zero information. Show

zypper search -sx xz
zypper lr -d
6

Did you read this thread??

Start at the first post and read on :+1:

https://forums.opensuse.org/t/tumbleweed-today-xz-security-alert-and-cve-2024-3094/

7

I think, it istn’t his problem. Today the packages of xz an liblzma were downgraded again! That’s his Question.

2 Likes
8

They were not really downgraded. They were removed from the update repository.

Before

S  | Name | Type       | Version               | Arch   | Repository
---+------+------------+-----------------------+--------+-----------------------------------
i+ | xz   | package    | 5.6.1.revertto5.4-3.2 | x86_64 | openSUSE-Tumbleweed-Update
v  | xz   | package    | 5.6.1.revertto5.4-2.1 | x86_64 | openSUSE-Tumbleweed-Oss (20240329)
v  | xz   | package    | 5.6.1.revertto5.4-3.2 | i586   | openSUSE-Tumbleweed-Update
   | xz   | srcpackage | 5.6.1.revertto5.4-3.2 | noarch | openSUSE-Tumbleweed-Update

after

S  | Name | Type    | Version               | Arch   | Repository
---+------+---------+-----------------------+--------+------------------------
i+ | xz   | package | 5.6.1.revertto5.4-3.2 | x86_64 | (System Packages)
v  | xz   | package | 5.6.1.revertto5.4-2.1 | x86_64 | openSUSE-Tumbleweed-Oss

The version 5.6.1.revertto5.4-2.1 has been in main repository all the time. Release numbers are per-repository and cannot be directly compared.

2 Likes
9

Exactly, I mean this of course. I understood that these packages were reverted to an earlier version last weekend. Now there is a new change. I was curious about this and also somehow on guard given the circumstances.

1 Like
10

Question asked and answered now in the mailing lists:

11

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.