From 14105451ce2ed60bf5bcee5fdb24d78bd060f9c3 Mon Sep 17 00:00:00 2001 From: Janne Grunau Date: Mon, 20 Jul 2026 13:42:52 +0200 Subject: [PATCH] build: Prefer bsdtar over 7-Zip for macOS python xar package bsdtar is preferred over 7-Zip by some Linux distributions due to arbitrary code execution vulnarablities in 7-Zip like CVE-2026-48095. libarchive's xar code was unfortunately buggy (fixed betwee 3.7.2 and 3.8.5) so keep 7-Zip as fallback. bsdtar from macOS' Command-line tools is at least in macOS 15 buggy as well. Signed-off-by: Janne Grunau --- .github/workflows/build.yaml | 2 +- build.sh | 12 +++++++++--- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 7429e23..93f7818 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -27,7 +27,7 @@ jobs: run: | sudo apt-get update sudo apt-get install --no-install-recommends -y gcc-aarch64-linux-gnu - sudo apt-get install --no-install-recommends -y 7zip jq + sudo apt-get install --no-install-recommends -y libarchive-tools 7zip jq rustup target install aarch64-unknown-none-softfloat - name: Build asahi-installer diff --git a/build.sh b/build.sh index 5eb2594..21031fd 100755 --- a/build.sh +++ b/build.sh @@ -121,9 +121,15 @@ echo "Extracting Python framework..." mkdir -p "$PACKAGE/Frameworks/Python.framework" -7z x -so "$DL/$PYTHON_PKG" Python_Framework.pkg/Payload | zcat | \ - cpio -i -D "$PACKAGE/Frameworks/Python.framework" - +# test if libarchive's bsdtar is capable of extracting the payload +# libarchive 3.7.2 (Ubuntu 24.04) is broken while 3.8.5 (Ubuntu 26.04) works +if $(bsdtar -tf "$DL/$PYTHON_PKG" Python_Framework.pkg/Payload > /dev/null); then + bsdtar -xOf "$DL/$PYTHON_PKG" Python_Framework.pkg/Payload | zcat | \ + cpio -i -D "$PACKAGE/Frameworks/Python.framework" +else + 7z x -so "$DL/$PYTHON_PKG" Python_Framework.pkg/Payload | zcat | \ + cpio -i -D "$PACKAGE/Frameworks/Python.framework" +fi cd "$PACKAGE/Frameworks/Python.framework/Versions/Current"