Re: [DistroKit] For zlib-1.2.12.tar.xz

Re: [DistroKit] For zlib-1.2.12.tar.xz

[Roland Hieber]

On Fri, Nov 04, 2022 at 07:10:28AM +0000, Joshi, Pranay wrote:
> Hi,
> 
> We want zlib library for building a Distrokit next branch to prepare an image using ptxdist tool in Linux, can you please provide "zlib-1.2.12.tar.xz"
> 
> We can only be able to find .gz this version of zlib in https://zlib.net/fossils/.

That is unfortunate… It seems like zlib 1.2.12 was intentionally
unpublished, probably because of CVE-2022-37434, which was fixed in zlib
1.2.13. I also cannot find any mirror still serving the old version… but
you should be able to use 1.2.13 instead.

You can try installing ptxdist-2022.10.0, which includes the newer zlib
version, and update via `ptxdist-2022.10.0 migrate`. Until DistroKit is
updated to the new PTXDist version, you can try overwriting the zlib
version locally by putting the following text into rules/post/zlib.make
in your DistroKit tree:

    ZLIB_VERSION    := 1.2.13
    ZLIB_MD5        := 7d9fc1d78ae2fa3e84fe98b77d006c63
    ZLIB            := zlib-$(ZLIB_VERSION)
    ZLIB_URL        := http://zlib.net/$(ZLIB).$(ZLIB_SUFFIX) $(call ptx/mirror, SF, libpng/$(ZLIB).$(ZLIB_SUFFIX))
    ZLIB_SOURCE     := $(SRCDIR)/$(ZLIB).$(ZLIB_SUFFIX)
    ZLIB_DIR        := $(BUILDDIR)/$(ZLIB)

After that, `ptxdist print ZLIB` should output "zlib-1.2.13".

 - Roland

-- 
Roland Hieber, Pengutronix e.K.          | r.hieber@pengutronix.de     |
Steuerwalder Str. 21                     | https://www.pengutronix.de/ |
31137 Hildesheim, Germany                | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686         | Fax:   +49-5121-206917-5555 |