WIP: Migrate for zlib 1.3? #5443
Conversation
|
Hi! This is the friendly automated conda-forge-linting service. I just wanted to let you know that I linted all conda-recipes in your PR ( |
|
This looks like "cosmetic" changes. Can someone try whether e.g. libarchive or python works with the new zlib without rebuilding the current binaries? |
I agree that nothing significant seems to have changed in the zlib's public headers. That's probably why it's still providing a |
|
I tried to build a few packages for zlib 1.3 but honestly, i think i ran into some rerendering issues and gave up. |
|
@hmaarrfk @h-vetinari Is there any progress about this and getting the zlib updated to 1.3 for fixing CVE-2023-45853? |
You could install |
|
@h-vetinari Trying that now with builds from conda-forge, do you know if it's possible get builds with debug info included or striped in different package? |
|
This is result of abi-compliance-checker run for zlib1g versions build in ubuntu 23.10 and 24.04 (https://packages.ubuntu.com/mantic/zlib1g) - so versions 1.2.13 vs 1.3 |
|
For some reason the attachment was not added to previous message compat_reports.zip :-) |
|
Thanks for running this @omron93! 🙏 Taking a screenshot from the produced report, it indeed looks like the ABI is untouched:
|
There was a new zlib build release last August (a few weeks ago in conda-forge; it seems the bot didn't open a PR yet).
We've been on zlib 1.2 since the beginning of the global pinning
conda-forge-pinning-feedstock/recipe/conda_build_config.yaml
Lines 195 to 196 in 754eda8
so this would probable be a relatively big migration. It's possible that migrating isn't even necessary though. While there's been no update in the abi lab for a long time, the newest
libzlibstill contains both:indicating that major-level pinning the SOVER should be enough.
The changelog for zlib 1.3 also doesn't look particularly scary or ABI-relevant, though I guess the minor number was increased due to things like madler/zlib#633, which caused a pretty substantial overhaul, see e.g. madler/zlib@e9d5486
We should check if the ABI changed; if not, we could relax the pins.
CC @conda-forge/zlib @conda-forge/core