Bug#1138185: trixie-pu: package 7zip/26.01+dfsg-1~deb13u1

yokota <[email protected]> Sun, 23 Aug 2026 04:12:31 +0900

Newsgroups	gmane.linux.debian.devel.release
Message-ID	<CA+0c0dUWy21X7rQKCQZZXjn1UhmSLfTSLRcK+94yyFCudXuJLg__34600.5433982768$1787426132$gmane$org@mail.gmail.com>

Hello,

I was updated trixie code to fix Debian bug 1144903.

Here is minimized debdiff that only includes "debian/" directory.

Examine all diffs from online:
https://salsa.debian.org/debian/7zip/-/compare/debian%2F25.01+dfsg-1_deb13u2...debian%2Ftrixie?from_project_id=61356

--
YOKOTA Hiroshi

7zip_26.02+dfsg-1~deb13u1-debian-w-1.diff (text/x-patch, 14.4 KB)

diff --git a/debian/changelog b/debian/changelog
index d71fe1b..e27cfd3 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,33 @@
+7zip (26.02+dfsg-1~deb13u1) trixie; urgency=high
+
+  * 7zip 26.02 includes this fix:
+    CVE-2026-14266: Heap-based Buffer Overflow
+  * 7zip 26.01 includes these fixes:
+    CVE-2026-48092: SquashFS Fragment Offset Overflow
+    CVE-2026-48095: Heap Buffer Write Overflow
+    CVE-2026-48101: UEFI Capsule uninitialized heap memory disclosure
+    CVE-2026-48102: UDF Field OOB Read
+    CVE-2026-48103: WIM SecurityId OOB read
+    CVE-2026-48104: SquashFS BlockToNode uninitialized heap read
+    CVE-2026-48111: UEFI DEPEX OOB Read
+    CVE-2026-48112: Ar SYMDEF OOB Read
+
+  [ YOKOTA Hiroshi ]
+  * New upstream version 26.01+dfsg
+  * Change EOL from DOS style to Unix style in patch file
+  * Update debian/watch
+  * Drop file permission hack
+  * Configure git-buidpackage for trixie update
+  * Sync with p7zip/16.02+really26.01+dfsg-0+deb12u1
+  * Add Salsa CI configuration file
+  * New upstream version 26.02+dfsg
+
+  [ Sylvain Beucler ]
+  * Typo (Closes: #1144903)
+  * Typos in 7z Debian manpage
+
+ -- YOKOTA Hiroshi <[email protected]>  Sun, 23 Aug 2026 03:04:26 +0900
+
 7zip (25.01+dfsg-1~deb13u2) trixie; urgency=medium
 
   * Non-maintainer upload by the LTS Security Team.
diff --git a/debian/copyright b/debian/copyright
index e8034c0..abaed6b 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -5,7 +5,7 @@ Files-Excluded: CPP/7zip/Compress/Rar*
 Comment: RAR code is under the non-free "unRAR license restriction"
 
 Files: *
-Copyright: 1999-2024 Igor Pavlov
+Copyright: 1999-2026 Igor Pavlov
 License: LGPL-2.1+
 
 Files: Asm/arm64/7zAsm.S
@@ -160,7 +160,7 @@ Comment: the code was developed by Igor Pavlov, using Zstandard format
 
 Files: debian/*
 Copyright: 2021 Collabora, Ltd.
-           2021-2024 YOKOTA Hiroshi <[email protected]>
+           2021-2026 YOKOTA Hiroshi <[email protected]>
 License: LGPL-2.1+
 
 License: LGPL-2.1+
diff --git a/debian/gbp.conf b/debian/gbp.conf
index f055ec8..35ee03c 100644
--- a/debian/gbp.conf
+++ b/debian/gbp.conf
@@ -1,3 +1,5 @@
+[DEFAULT]
+debian-branch = debian/trixie
+
 [import-orig]
 pristine-tar = True
-postunpack   = find Asm C CPP DOC -type f -execdir chmod -x {} ";"
diff --git a/debian/man/7z.1 b/debian/man/7z.1
index f981c3a..080673d 100644
--- a/debian/man/7z.1
+++ b/debian/man/7z.1
@@ -54,10 +54,10 @@ for \fI\,file_names\fR\,.
 This behavior leads some unexpected result.
 .TP
 "a" (add) command
-Recurcevily add files from current directory into \fI\,archive_name\fR file.
+Recursively add files from current directory into \fI\,archive_name\fR file.
 .TP
 "d" (delete) command
-Recurcively delete files from \fI\,archive_name\fR file.
+Recursively delete files from \fI\,archive_name\fR file.
 This means \fB\,delete all files\fR from \fI\,archive_name\fR file.
 .SH OPTIONS
 .SS Commands
@@ -211,6 +211,25 @@ eliminate duplication of root folder for extract command
 \-spf
 use fully qualified file paths
 .TP
+\-spo{d|c|r}
+specifies the path generation mode for the output directory
+for archive extraction. The output directory path is generated from the path specified
+in the -o{\fI\,dir_path\fR\,} switch and the name of the archive being unpacked.
+.RS
+.TQ
+\-spod
+for Linux/Posix/macOS: -o{\fI\,dir_path\fR\,} specifies the direct path to the output directory.
+The asterisk (*) character in {\fI\,dir_path\fR\,} will not be replaced by the archive name.
+.TQ
+\-spoc
+7-Zip will concatenate the path specified in -o{\fI\,dir_path\fR\,} with the archive name
+to form the final path to the output directory.
+.TQ
+\-spor
+7-Zip will replace asterisk (*) character in the path specified in the -o{\fI\,dir_path\fR\,}
+with the archive name. This is the default option.
+.RE
+.TP
 \-ssc[\-]
 set sensitive case mode
 .TP
diff --git a/debian/patches/0001-Accept-Debian-build-flags.patch b/debian/patches/0001-Accept-Debian-build-flags.patch
index 2bf482c..b57d44d 100644
--- a/debian/patches/0001-Accept-Debian-build-flags.patch
+++ b/debian/patches/0001-Accept-Debian-build-flags.patch
@@ -8,7 +8,7 @@ Forwarded: not-needed
  1 file changed, 5 insertions(+), 5 deletions(-)
 
 diff --git a/CPP/7zip/7zip_gcc.mak b/CPP/7zip/7zip_gcc.mak
-index 8fbef14..2756ba4 100644
+index a78c0fa..0e4055f 100644
 --- a/CPP/7zip/7zip_gcc.mak
 +++ b/CPP/7zip/7zip_gcc.mak
 @@ -45,7 +45,7 @@ CFLAGS_DEBUG = -g
@@ -25,7 +25,7 @@ index 8fbef14..2756ba4 100644
  else
  SHARED_EXT=.so
 -LDFLAGS = -shared -fPIC $(LDFLAGS_STATIC)
-+LDFLAGS = -shared -fPIC $(DEB_LDFLAGS) $(LDFLAGS_STATIC)
++LDFLAGS = -shared -fPIC $(DEB_7Z_LDFLAGS) $(LDFLAGS_STATIC)
  CC_SHARED=-fPIC
  endif
  
@@ -33,7 +33,7 @@ index 8fbef14..2756ba4 100644
  else
  
 -LDFLAGS = $(LDFLAGS_STATIC)
-+LDFLAGS = $(DEB_LDFLAGS) $(LDFLAGS_STATIC)
++LDFLAGS = $(DEB_7Z_LDFLAGS) $(LDFLAGS_STATIC)
  # -z force-bti
  # -s is not required for clang, do we need it for GCC ???
  
@@ -42,7 +42,7 @@ index 8fbef14..2756ba4 100644
  
  
 -CFLAGS = $(MY_ARCH_2) $(LOCAL_FLAGS) $(CFLAGS_BASE2) $(CFLAGS_BASE) $(FLAGS_FLTO) $(CC_SHARED) -o $@
-+CFLAGS = $(DEB_CFLAGS) $(DEB_CPPFLAGS) $(MY_ARCH_2) $(LOCAL_FLAGS) $(CFLAGS_BASE2) $(CFLAGS_BASE) $(FLAGS_FLTO) $(CC_SHARED) -o $@
++CFLAGS = $(DEB_7Z_CFLAGS) $(DEB_7Z_CPPFLAGS) $(MY_ARCH_2) $(LOCAL_FLAGS) $(CFLAGS_BASE2) $(CFLAGS_BASE) $(FLAGS_FLTO) $(CC_SHARED) -o $@
  
  
  ifdef IS_MINGW
@@ -51,7 +51,7 @@ index 8fbef14..2756ba4 100644
  #-Wno-reorder
  
 -CXXFLAGS = $(MY_ARCH_2) $(LOCAL_FLAGS) $(CXXFLAGS_BASE2) $(CFLAGS_BASE) $(FLAGS_FLTO) $(CXXFLAGS_EXTRA) $(CC_SHARED) $(CXX_WARN_FLAGS) $(CXX_STD_FLAGS) $(CXX_INCLUDE_FLAGS) -o $@
-+CXXFLAGS = $(DEB_CXXFLAGS) $(DEB_CPPFLAGS) $(MY_ARCH_2) $(LOCAL_FLAGS) $(CXXFLAGS_BASE2) $(CFLAGS_BASE) $(FLAGS_FLTO) $(CXXFLAGS_EXTRA) $(CC_SHARED) $(CXX_WARN_FLAGS) $(CXX_STD_FLAGS) $(CXX_INCLUDE_FLAGS) -o $@
++CXXFLAGS = $(DEB_7Z_CXXFLAGS) $(DEB_7Z_CPPFLAGS) $(MY_ARCH_2) $(LOCAL_FLAGS) $(CXXFLAGS_BASE2) $(CFLAGS_BASE) $(FLAGS_FLTO) $(CXXFLAGS_EXTRA) $(CC_SHARED) $(CXX_WARN_FLAGS) $(CXX_STD_FLAGS) $(CXX_INCLUDE_FLAGS) -o $@
  
  STATIC_TARGET=
  ifdef COMPL_STATIC
diff --git a/debian/patches/0002-Use-getcwd-3-POSIX-extension-to-avoid-PATH_MAX-macro.patch b/debian/patches/0002-Use-getcwd-3-POSIX-extension-to-avoid-PATH_MAX-macro.patch
index 812805a..d91ddbc 100644
--- a/debian/patches/0002-Use-getcwd-3-POSIX-extension-to-avoid-PATH_MAX-macro.patch
+++ b/debian/patches/0002-Use-getcwd-3-POSIX-extension-to-avoid-PATH_MAX-macro.patch
@@ -10,7 +10,7 @@ This fix helps GNU Hurd.
  1 file changed, 1 insertion(+), 12 deletions(-)
 
 diff --git a/CPP/Windows/FileDir.cpp b/CPP/Windows/FileDir.cpp
-index 4a4bf52..e1747fc 100644
+index ad0d8c9..f5f94d4 100644
 --- a/CPP/Windows/FileDir.cpp
 +++ b/CPP/Windows/FileDir.cpp
 @@ -1141,22 +1141,11 @@ bool GetCurrentDir(FString &path)
diff --git a/debian/patches/0003-Disable-local-echo-display-when-in-input-passwords-C.patch b/debian/patches/0003-Disable-local-echo-display-when-in-input-passwords-C.patch
index c5e7182..a240e4e 100644
--- a/debian/patches/0003-Disable-local-echo-display-when-in-input-passwords-C.patch
+++ b/debian/patches/0003-Disable-local-echo-display-when-in-input-passwords-C.patch
@@ -11,7 +11,7 @@ Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1006238
  2 files changed, 35 insertions(+), 1 deletion(-)
 
 diff --git a/CPP/7zip/UI/Console/UserInputUtils.cpp b/CPP/7zip/UI/Console/UserInputUtils.cpp
-index 6c3c85a..2832b00 100644
+index 2adf9df..fbc1568 100644
 --- a/CPP/7zip/UI/Console/UserInputUtils.cpp
 +++ b/CPP/7zip/UI/Console/UserInputUtils.cpp
 @@ -57,9 +57,18 @@ NUserAnswerMode::EEnum ScanUserYesNoAllQuit(CStdOutStream *outStream)
@@ -72,7 +72,7 @@ index 6c3c85a..2832b00 100644
    
    const bool res = g_StdIn.ScanUStringUntilNewLine(psw);
 diff --git a/CPP/Common/StdInStream.h b/CPP/Common/StdInStream.h
-index 2253c43..69d84fe 100644
+index 81ca3bf..e8b6214 100644
 --- a/CPP/Common/StdInStream.h
 +++ b/CPP/Common/StdInStream.h
 @@ -23,7 +23,10 @@ public:
diff --git a/debian/patches/0004-Use-system-locale-to-select-codepage-for-legacy-zip-.patch b/debian/patches/0004-Use-system-locale-to-select-codepage-for-legacy-zip-.patch
index e593bf6..25de1a6 100644
--- a/debian/patches/0004-Use-system-locale-to-select-codepage-for-legacy-zip-.patch
+++ b/debian/patches/0004-Use-system-locale-to-select-codepage-for-legacy-zip-.patch
@@ -11,7 +11,7 @@ Fixes https://sourceforge.net/p/sevenzip/bugs/2473/
  1 file changed, 184 insertions(+), 2 deletions(-)
 
 diff --git a/CPP/7zip/Archive/Zip/ZipItem.cpp b/CPP/7zip/Archive/Zip/ZipItem.cpp
-index 272e53b..47f6178 100644
+index 5684cac..b067182 100644
 --- a/CPP/7zip/Archive/Zip/ZipItem.cpp
 +++ b/CPP/7zip/Archive/Zip/ZipItem.cpp
 @@ -1,5 +1,12 @@
diff --git a/debian/patches/0005-Add-note-for-unexpected-recursive-operations-behavio.patch b/debian/patches/0005-Add-note-for-unexpected-recursive-operations-behavio.patch
index 440ee78..f0b7a41 100644
--- a/debian/patches/0005-Add-note-for-unexpected-recursive-operations-behavio.patch
+++ b/debian/patches/0005-Add-note-for-unexpected-recursive-operations-behavio.patch
@@ -9,7 +9,7 @@ Bug-Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1091693
  1 file changed, 4 insertions(+)
 
 diff --git a/CPP/7zip/UI/Console/Main.cpp b/CPP/7zip/UI/Console/Main.cpp
-index 5094452..7511322 100644
+index 521fe77..1b6c2a3 100644
 --- a/CPP/7zip/UI/Console/Main.cpp
 +++ b/CPP/7zip/UI/Console/Main.cpp
 @@ -133,6 +133,10 @@ static const char * const kHelpString =
@@ -18,7 +18,7 @@ index 5094452..7511322 100644
      "\n"
 +    "Note:\n"
 +    "  If <file_names> is not specified, 7z" PROG_POSTFIX " implicitly uses \".\" as <file_names>.\n"
-+    "  This means recursively add/delete/extract files to/from <arcive_name>.\n"
++    "  This means recursively add/delete/extract files to/from <archive_name>.\n"
 +    "\n"
      "<Commands>\n"
      "  a : Add files to archive\n"
diff --git a/debian/patches/0006-Use-c-flags-for-asmc.patch b/debian/patches/0006-Use-c-flags-for-asmc.patch
index 4a30667..155ca03 100644
--- a/debian/patches/0006-Use-c-flags-for-asmc.patch
+++ b/debian/patches/0006-Use-c-flags-for-asmc.patch
@@ -8,7 +8,7 @@ No needs to build executable files while in assembling.
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/CPP/7zip/7zip_gcc.mak b/CPP/7zip/7zip_gcc.mak
-index 2756ba4..5d05cf0 100644
+index 0e4055f..4e74da6 100644
 --- a/CPP/7zip/7zip_gcc.mak
 +++ b/CPP/7zip/7zip_gcc.mak
 @@ -194,7 +194,7 @@ AFLAGS_ABI = -elf -DABI_LINUX -DABI_CDECL
diff --git a/debian/patches/0007-Add-fpic-for-Asmc-options.patch b/debian/patches/0007-Add-fpic-for-Asmc-options.patch
index 396fdfe..ca1e461 100644
--- a/debian/patches/0007-Add-fpic-for-Asmc-options.patch
+++ b/debian/patches/0007-Add-fpic-for-Asmc-options.patch
@@ -9,7 +9,7 @@ Asmc author suggests this option:
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/CPP/7zip/7zip_gcc.mak b/CPP/7zip/7zip_gcc.mak
-index 5d05cf0..3fada36 100644
+index 4e74da6..e8fcde4 100644
 --- a/CPP/7zip/7zip_gcc.mak
 +++ b/CPP/7zip/7zip_gcc.mak
 @@ -194,7 +194,7 @@ AFLAGS_ABI = -elf -DABI_LINUX -DABI_CDECL
diff --git a/debian/rules b/debian/rules
index 3286f48..82ab4a2 100755
--- a/debian/rules
+++ b/debian/rules
@@ -41,45 +41,45 @@ override_dh_auto_build:
 	$(MAKE) -C CPP/7zip/Bundles/Alone2 -f $(m) \
 		CROSS_COMPILE="$(DEB_HOST_GNU_TYPE)-" \
 		DISABLE_RAR=1 \
-		DEB_CFLAGS="$(CFLAGS) -pipe" \
-		DEB_CXXFLAGS="$(CXXFLAGS) -pipe" \
-		DEB_CPPFLAGS="$(CPPFLAGS)" \
-		DEB_LDFLAGS="$(LDFLAGS) -pipe"
+		DEB_7Z_CFLAGS="$(CFLAGS)" \
+		DEB_7Z_CXXFLAGS="$(CXXFLAGS)" \
+		DEB_7Z_CPPFLAGS="$(CPPFLAGS)" \
+		DEB_7Z_LDFLAGS="$(LDFLAGS)"
 	$(MAKE) -C CPP/7zip/Bundles/Format7zF -f $(m) \
 		CROSS_COMPILE="$(DEB_HOST_GNU_TYPE)-" \
 		DISABLE_RAR_COMPRESS=1 \
-		DEB_CFLAGS="$(CFLAGS) -pipe" \
-		DEB_CXXFLAGS="$(CXXFLAGS) -pipe" \
-		DEB_CPPFLAGS="$(CPPFLAGS)" \
-		DEB_LDFLAGS="$(LDFLAGS) -pipe"
+		DEB_7Z_CFLAGS="$(CFLAGS)" \
+		DEB_7Z_CXXFLAGS="$(CXXFLAGS)" \
+		DEB_7Z_CPPFLAGS="$(CPPFLAGS)" \
+		DEB_7Z_LDFLAGS="$(LDFLAGS)"
 	$(MAKE) -C CPP/7zip/UI/Console -f $(m) \
 		CROSS_COMPILE="$(DEB_HOST_GNU_TYPE)-" \
 		DISABLE_RAR=1 \
-		DEB_CFLAGS="$(CFLAGS) -pipe" \
-		DEB_CXXFLAGS="$(CXXFLAGS) -pipe" \
-		DEB_CPPFLAGS="$(CPPFLAGS)" \
-		DEB_LDFLAGS="$(LDFLAGS) -pipe"
+		DEB_7Z_CFLAGS="$(CFLAGS)" \
+		DEB_7Z_CXXFLAGS="$(CXXFLAGS)" \
+		DEB_7Z_CPPFLAGS="$(CPPFLAGS)" \
+		DEB_7Z_LDFLAGS="$(LDFLAGS)"
 	$(MAKE) -C CPP/7zip/Bundles/SFXCon -f $(m) \
 		CROSS_COMPILE="$(DEB_HOST_GNU_TYPE)-" \
 		DISABLE_RAR=1 \
-		DEB_CFLAGS="$(CFLAGS) -pipe" \
-		DEB_CXXFLAGS="$(CXXFLAGS) -pipe" \
-		DEB_CPPFLAGS="$(CPPFLAGS)" \
-		DEB_LDFLAGS="$(LDFLAGS) -pipe"
+		DEB_7Z_CFLAGS="$(CFLAGS)" \
+		DEB_7Z_CXXFLAGS="$(CXXFLAGS)" \
+		DEB_7Z_CPPFLAGS="$(CPPFLAGS)" \
+		DEB_7Z_LDFLAGS="$(LDFLAGS)"
 	$(MAKE) -C CPP/7zip/Bundles/Alone -f $(m) \
 		CROSS_COMPILE="$(DEB_HOST_GNU_TYPE)-" \
 		DISABLE_RAR=1 \
-		DEB_CFLAGS="$(CFLAGS) -pipe" \
-		DEB_CXXFLAGS="$(CXXFLAGS) -pipe" \
-		DEB_CPPFLAGS="$(CPPFLAGS)" \
-		DEB_LDFLAGS="$(LDFLAGS) -pipe"
+		DEB_7Z_CFLAGS="$(CFLAGS)" \
+		DEB_7Z_CXXFLAGS="$(CXXFLAGS)" \
+		DEB_7Z_CPPFLAGS="$(CPPFLAGS)" \
+		DEB_7Z_LDFLAGS="$(LDFLAGS)"
 	$(MAKE) -C CPP/7zip/Bundles/Alone7z -f $(m) \
 		CROSS_COMPILE="$(DEB_HOST_GNU_TYPE)-" \
 		DISABLE_RAR=1 \
-		DEB_CFLAGS="$(CFLAGS) -pipe" \
-		DEB_CXXFLAGS="$(CXXFLAGS) -pipe" \
-		DEB_CPPFLAGS="$(CPPFLAGS)" \
-		DEB_LDFLAGS="$(LDFLAGS) -pipe"
+		DEB_7Z_CFLAGS="$(CFLAGS)" \
+		DEB_7Z_CXXFLAGS="$(CXXFLAGS)" \
+		DEB_7Z_CPPFLAGS="$(CPPFLAGS)" \
+		DEB_7Z_LDFLAGS="$(LDFLAGS)"
 
 override_dh_auto_clean:
 	$(MAKE) -C CPP/7zip/Bundles/Alone2    -f $(m) clean
diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml
new file mode 100644
index 0000000..8424db4
--- /dev/null
+++ b/debian/salsa-ci.yml
@@ -0,0 +1,3 @@
+---
+include:
+  - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/recipes/debian.yml
diff --git a/debian/watch b/debian/watch
index ddb2188..893ab8d 100644
--- a/debian/watch
+++ b/debian/watch
@@ -1,7 +1,10 @@
 # -*- mode: conf -*-
 version=4
-opts="uversionmangle=s/(\d{2})(\d{2})/$1.$2/, \
+opts="filenamemangle=s%.*/@ANY_VERSION@%@PACKAGE@-$1.tar.gz%, \
+      downloadurlmangle=s%api.github.com/repos/([^/]+/[^/]+)/git/refs/tags/@ANY_VERSION@%github.com/$1/archive/refs/tags/$2.tar.gz%g, \
+      searchmode=plain, \
       dversionmangle=s/\+dfsg$//, \
       oversionmangle=s/$/+dfsg/, \
       pgpmode=none" \
-https://www.7-zip.org/download.html a/7z(\d{4})-src\.tar\.xz
+https://api.github.com/repos/ip7z/7zip/git/matching-refs/tags/ \
+  https://api.github.com/repos/[^/]+/[^/]+/git/refs/tags/@ANY_VERSION@