7 ms·

Yesterday sure was fun wasn't it :p Thanks for all your help/working with me on getting this cleaned up in Fedora.

by jonathanspw 2y ago

w4ffl35 2y ago
Is it normal that when I try to uninstall xz it is trying to install lzma?
- inetknght 2y ago
  It means that `xz` was depended upon by something that depends on eg "xz OR lzma"
speleding 2y ago
PSA: I just noticed homebrew installed the compromised version on my Mac as a dependency of some other package. You may want to check this to see what version you get: xz --version Homebrew has already taken action, a `brew upgrade` will downgrade back to the last known good version.
- mthoms 2y ago
  Thanks for this. I just ran brew upgrade and the result was as you described: xz 5.6.1 -> 5.4.6
- jonahx 2y ago
  I also had a homebrew installed affected version. I understand it's unlikely, but is there anything I can do to check if the backdoor was used? Also any other steps I should take after "brew upgrade"?
  - tomputer 2y ago
    Quoting[1] from Homebrew on Github: >> Looks like that Homebrew users (both macOS and Linux, both Intel and ARM) are unlikely affected? > Correct. Though we do not appear to be affected, this revert was done out of an abundance of caution. [1] https://github.com/Homebrew/homebrew-core/pull/167512 https://github.com/Homebrew/homebrew-core/pull/167512
- cozzyd 2y ago
  Is it actually compromised on homebrew though? I guess we can't be sure but it seemed to be checking if it was being packaged as .deb or .rpm?
- erhaetherth 2y ago
  Is 5.2.2 safe? Just 5.6.0 and 5.6.1 are bad?
- pmarreck 2y ago
  sorry, what exact version(s) is the one(s) affected again? (or SHAs, etc.) (EDIT: 5.6.0 and 5.6.1 ?) (EDIT 2: Ooof, looks like the nix unstable channel uses xz 5.6.1 at this time) I use Nix to manage this stuff on Mac, not Homebrew...
  - redxtech 2y ago
    GitHub disabled the xz repo, making it a bit more difficult for nix to revert to an older version. They've made a fix, but it will take several more days for the build systems to finish rebuilding the ~220,000 packages that depend on the bootstrap utils.
    - kreetx 2y ago
      Here is the discussion https://github.com/NixOS/nixpkgs/issues/300055 https://github.com/NixOS/nixpkgs/issues/300055
    - account42 2y ago
      Lol they shouldn't be relying on GitHub in the first place.
      - rrrix1 2y ago
        What should they be relying on instead? Maybe rsync everything to an FTP server? Or Torrents? From your other comments, you seem to think no one should ever use GitHub for anything.

Yesterday sure was fun wasn't it :p Thanks for all your help/working with me on getting this cleaned up in Fedora.

w4ffl35 2y ago

Is it normal that when I try to uninstall xz it is trying to install lzma?

inetknght 2y ago
It means that `xz` was depended upon by something that depends on eg "xz OR lzma"

speleding 2y ago

PSA: I just noticed homebrew installed the compromised version on my Mac as a dependency of some other package. You may want to check this to see what version you get: xz --version Homebrew has already taken action, a `brew upgrade` will downgrade back to the last known good version.

mthoms 2y ago
Thanks for this. I just ran brew upgrade and the result was as you described: xz 5.6.1 -> 5.4.6
jonahx 2y ago
I also had a homebrew installed affected version. I understand it's unlikely, but is there anything I can do to check if the backdoor was used? Also any other steps I should take after "brew upgrade"?
- tomputer 2y ago
  Quoting[1] from Homebrew on Github: >> Looks like that Homebrew users (both macOS and Linux, both Intel and ARM) are unlikely affected? > Correct. Though we do not appear to be affected, this revert was done out of an abundance of caution. [1] https://github.com/Homebrew/homebrew-core/pull/167512 https://github.com/Homebrew/homebrew-core/pull/167512
cozzyd 2y ago
Is it actually compromised on homebrew though? I guess we can't be sure but it seemed to be checking if it was being packaged as .deb or .rpm?
erhaetherth 2y ago
Is 5.2.2 safe? Just 5.6.0 and 5.6.1 are bad?
pmarreck 2y ago
sorry, what exact version(s) is the one(s) affected again? (or SHAs, etc.) (EDIT: 5.6.0 and 5.6.1 ?) (EDIT 2: Ooof, looks like the nix unstable channel uses xz 5.6.1 at this time) I use Nix to manage this stuff on Mac, not Homebrew...
- redxtech 2y ago
  GitHub disabled the xz repo, making it a bit more difficult for nix to revert to an older version. They've made a fix, but it will take several more days for the build systems to finish rebuilding the ~220,000 packages that depend on the bootstrap utils.
  - kreetx 2y ago
    Here is the discussion https://github.com/NixOS/nixpkgs/issues/300055 https://github.com/NixOS/nixpkgs/issues/300055
  - account42 2y ago
    Lol they shouldn't be relying on GitHub in the first place.
    - rrrix1 2y ago
      What should they be relying on instead? Maybe rsync everything to an FTP server? Or Torrents? From your other comments, you seem to think no one should ever use GitHub for anything.