CVS commit: [pkgsrc-2026Q3] pkgsrc/archivers/libzip

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Wed Oct 21 00:36:20 UTC 2026

Modified Files:
        pkgsrc/archivers/libzip [pkgsrc-2026Q3]: Makefile PLIST distinfo
Added Files:
        pkgsrc/archivers/libzip/patches [pkgsrc-2026Q3]:
            patch-regress_support_nihtest.conf.in
Removed Files:
        pkgsrc/archivers/libzip/patches [pkgsrc-2026Q3]:
            patch-regress_nihtest.conf.in

Log Message:
Pullup ticket #7291 - requested by taca
archivers/libzip: Security fix

Revisions pulled up:
- archivers/libzip/Makefile                                     1.86-1.87
- archivers/libzip/PLIST                                        1.23
- archivers/libzip/distinfo                                     1.52-1.53
- archivers/libzip/patches/patch-regress_nihtest.conf.in        deleted
- archivers/libzip/patches/patch-regress_support_nihtest.conf.in 1.1

---
   Module Name: pkgsrc
   Committed By:        wiz
   Date:                Wed Oct  7 14:24:37 UTC 2026

   Modified Files:
        pkgsrc/archivers/libzip: Makefile PLIST distinfo
   Added Files:
        pkgsrc/archivers/libzip/patches: patch-regress_support_nihtest.conf.in
   Removed Files:
        pkgsrc/archivers/libzip/patches: patch-regress_nihtest.conf.in

   Log Message:
   libzip: update to 1.12.

   # 1.12 [2026-10-07]

   * Keep order of local extra fields, even if an identical extra field is present in the central directory.
   * Add `zip_source_at_eof()` and `ZIP_SOURCE_AT_EOF`.
   * Consistently report CRC and decryption errors when reading exactly to end-of-file.
   * Remove Mbed TLS support - the required functions were made private.
   * Make non-random tests work on macOS and Windows by using a special version of libzip.
   * Securely clear passwords and key material before freeing it.
   * Use SipHash hash function with per-table random keys. This prevents hash flooding attacks.
   * Add compile time option to limit LZMA window size.
   * Add more comprehensive fuzzers for metadata and write code paths.
   * Fix `zip_source_is_seekable()`.
   * Fix setting incorrect WinZIP AES version in some cases.
   * Further improvements to overall stability and other minor adjustments have been made.

---
   Module Name: pkgsrc
   Committed By:        wiz
   Date:                Wed Oct 14 10:59:01 UTC 2026

   Modified Files:
        pkgsrc/archivers/libzip: Makefile distinfo

   Log Message:
   libzip: update to 1.12.1.

   # 1.12.1 [2026-10-14]

   * Protect against denial of service attack (advisory GHSA-m3wq-j48p-jxwh, actually fixed in 1.12).
   * Fix compile issues.
   * Fix adding and replacing files in torrentzip archives.
   * Fix error handling in `zip_source_filep_create()`.


To generate a diff of this commit:
cvs rdiff -u -r1.85 -r1.85.4.1 pkgsrc/archivers/libzip/Makefile
cvs rdiff -u -r1.22 -r1.22.12.1 pkgsrc/archivers/libzip/PLIST
cvs rdiff -u -r1.51 -r1.51.12.1 pkgsrc/archivers/libzip/distinfo
cvs rdiff -u -r1.3 -r0 \
    pkgsrc/archivers/libzip/patches/patch-regress_nihtest.conf.in
cvs rdiff -u -r0 -r1.1.2.2 \
    pkgsrc/archivers/libzip/patches/patch-regress_support_nihtest.conf.in

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/archivers/libzip/Makefile
diff -u pkgsrc/archivers/libzip/Makefile:1.85 pkgsrc/archivers/libzip/Makefile:1.85.4.1
--- pkgsrc/archivers/libzip/Makefile:1.85       Thu May 14 16:40:22 2026
+++ pkgsrc/archivers/libzip/Makefile    Wed Oct 21 00:36:19 2026
@@ -1,7 +1,6 @@
-# $NetBSD: Makefile,v 1.85 2026/05/14 16:40:22 ryoon Exp $
+# $NetBSD: Makefile,v 1.85.4.1 2026/10/21 00:36:19 maya Exp $
 
-DISTNAME=              libzip-1.11.4
-PKGREVISION=           3
+DISTNAME=              libzip-1.12.1
 CATEGORIES=            archivers devel
 MASTER_SITES=          https://libzip.org/download/
 MASTER_SITES+=         ${MASTER_SITE_GITHUB:=nih-at/}

Index: pkgsrc/archivers/libzip/PLIST
diff -u pkgsrc/archivers/libzip/PLIST:1.22 pkgsrc/archivers/libzip/PLIST:1.22.12.1
--- pkgsrc/archivers/libzip/PLIST:1.22  Fri May 23 14:07:15 2025
+++ pkgsrc/archivers/libzip/PLIST       Wed Oct 21 00:36:19 2026
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST,v 1.22 2025/05/23 14:07:15 wiz Exp $
+@comment $NetBSD: PLIST,v 1.22.12.1 2026/10/21 00:36:19 maya Exp $
 bin/zipcmp
 bin/zipmerge
 bin/ziptool
@@ -10,12 +10,11 @@ lib/cmake/libzip/libzip-config-version.c
 lib/cmake/libzip/libzip-config.cmake
 lib/cmake/libzip/libzip-targets-noconfig.cmake
 lib/cmake/libzip/libzip-targets.cmake
-lib/cmake/libzip/modules/FindMbedTLS.cmake
 lib/cmake/libzip/modules/FindNettle.cmake
 lib/cmake/libzip/modules/Findzstd.cmake
 lib/libzip.so
 lib/libzip.so.5
-lib/libzip.so.5.5
+lib/libzip.so.5.6
 lib/pkgconfig/libzip.pc
 man/man1/zipcmp.1
 man/man1/zipmerge.1
@@ -98,6 +97,7 @@ man/man3/zip_set_archive_flag.3
 man/man3/zip_set_default_password.3
 man/man3/zip_set_file_comment.3
 man/man3/zip_set_file_compression.3
+man/man3/zip_source_at_eof.3
 man/man3/zip_source_begin_write.3
 man/man3/zip_source_begin_write_cloning.3
 man/man3/zip_source_buffer.3
@@ -121,6 +121,7 @@ man/man3/zip_source_layered.3
 man/man3/zip_source_layered_create.3
 man/man3/zip_source_make_command_bitmap.3
 man/man3/zip_source_open.3
+man/man3/zip_source_pass_to_lower_layer.3
 man/man3/zip_source_read.3
 man/man3/zip_source_rollback_write.3
 man/man3/zip_source_seek.3

Index: pkgsrc/archivers/libzip/distinfo
diff -u pkgsrc/archivers/libzip/distinfo:1.51 pkgsrc/archivers/libzip/distinfo:1.51.12.1
--- pkgsrc/archivers/libzip/distinfo:1.51       Fri May 23 14:07:15 2025
+++ pkgsrc/archivers/libzip/distinfo    Wed Oct 21 00:36:19 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.51 2025/05/23 14:07:15 wiz Exp $
+$NetBSD: distinfo,v 1.51.12.1 2026/10/21 00:36:19 maya Exp $
 
-BLAKE2s (libzip-1.11.4.tar.xz) = e9f5dffd45c74e6122f84816ac08eca888703235e26faa1afa52726b4fde33c7
-SHA512 (libzip-1.11.4.tar.xz) = dc7929ed7a0f43e793041fc3f0639649233d4ecbe59f90b0275582b51d2951e240ce5182220fb14ade7dcccc08dab90fda22c87dc7365fec4fe70ee4f14eaa37
-Size (libzip-1.11.4.tar.xz) = 793340 bytes
-SHA1 (patch-regress_nihtest.conf.in) = 4ba110f2acef8ded4956c1931ee6f7c6e0618cd0
+BLAKE2s (libzip-1.12.1.tar.xz) = 6cee5faaa8f3caa81dd958d086260ffa53f9d728e57ac2014bf90558d2b2e319
+SHA512 (libzip-1.12.1.tar.xz) = acc848242e8c0fc85c7e7984f633d898443156024cb67ee4facb657c80dd397b01326e5c32bc3955eba7ffcecdc39bebabfd27ea2d38e80603dae15581cf00e1
+Size (libzip-1.12.1.tar.xz) = 813384 bytes
+SHA1 (patch-regress_support_nihtest.conf.in) = c73430f947353220980c5ed4b25bb7714c677d39

Added files:

Index: pkgsrc/archivers/libzip/patches/patch-regress_support_nihtest.conf.in
diff -u /dev/null pkgsrc/archivers/libzip/patches/patch-regress_support_nihtest.conf.in:1.1.2.2
--- /dev/null   Wed Oct 21 00:36:20 2026
+++ pkgsrc/archivers/libzip/patches/patch-regress_support_nihtest.conf.in       Wed Oct 21 00:36:20 2026
@@ -0,0 +1,15 @@
+$NetBSD: patch-regress_support_nihtest.conf.in,v 1.1.2.2 2026/10/21 00:36:20 maya Exp $
+
+To allow testing in uninstalled state.
+
+--- regress/support/nihtest.conf.in.orig       2023-08-23 10:55:23.000000000 +0000
++++ regress/support/nihtest.conf.in
+@@ -9,6 +9,8 @@ program-directories = @PROJECT_BINARY_DI
+     @PROJECT_BINARY_DIR@/src/Debug
+ default-program = ziptool_regress
+ default-stderr-replace = "^([A-Z]:)?[^ :]*: " ""
++environment-passthrough = LD_LIBRARY_PATH
++    DYLD_LIBRARY_PATH
+ 
+ [comparators]
+ zip.zip = zipcmp -pv