Skip to content

Commit c6da67a

Browse files
committed
(#3625) Upgrade 7z to 24.09
This addresses a known CVE with 7-zip: GHSA-2pjx-wvcg-vhr8
1 parent b88f205 commit c6da67a

File tree

5 files changed

+55
-21
lines changed

5 files changed

+55
-21
lines changed

docs/legal/CREDITS.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
- [Contributors](#contributors)
77
- [Third Party Licenses - Development](#third-party-licenses---development)
88
- [Third Party Licenses - Runtime](#third-party-licenses---runtime)
9-
- [7-Zip @ 21.07](#7-zip--2107)
9+
- [7-Zip @ 24.09](#7-zip--2409)
1010
- [AlphaFS @ 2.1.3](#alphafs--213)
1111
- [Checksum @ 0.2.0](#checksum--020)
1212
- [log4net @ 2.0.12](#log4net--2012)
@@ -70,7 +70,7 @@ We would like to credit other super sweet tools/frameworks that aid in the devel
7070
Chocolatey CLI (choco) uses a number of 3rd-party components.
7171
Their details are below.
7272

73-
- [7-Zip @ 21.07](#7-zip--2107)
73+
- [7-Zip @ 24.09](#7-zip--2409)
7474
- [AlphaFS @ 2.1.3](#alphafs--213)
7575
- [Checksum @ 0.2.0](#checksum--020)
7676
- [log4net @ 2.0.12](#log4net--2012)
@@ -81,7 +81,7 @@ Their details are below.
8181
- [Shim Generator (shimgen) @ 1.0.0](#shim-generator-shimgen--100)
8282
- [SimpleInjector @ 2.8.3](#simpleinjector--283)
8383

84-
### 7-Zip @ 21.07
84+
### 7-Zip @ 24.09
8585

8686
Chocolatey uses [7-Zip](http://www.7-zip.org/) for uncompressing archives.
8787
[License terms](http://www.7-zip.org/license.txt):
@@ -92,7 +92,7 @@ Chocolatey uses [7-Zip](http://www.7-zip.org/) for uncompressing archives.
9292
License for use and distribution
9393
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
9494
95-
7-Zip Copyright (C) 1999-2022 Igor Pavlov.
95+
7-Zip Copyright (C) 1999-2023 Igor Pavlov.
9696
9797
The licenses for files are:
9898

src/chocolatey.resources/tools/7z.dll

144 KB
Binary file not shown.

src/chocolatey.resources/tools/7z.exe

17.5 KB
Binary file not shown.

src/chocolatey.resources/tools/7zip.license.txt

Lines changed: 50 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,19 +3,20 @@
33
License for use and distribution
44
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
55

6-
7-Zip Copyright (C) 1999-2016 Igor Pavlov.
6+
7-Zip Copyright (C) 1999-2023 Igor Pavlov.
77

8-
Licenses for files are:
8+
The licenses for files are:
99

10-
1) 7z.dll: GNU LGPL + unRAR restriction
11-
2) All other files: GNU LGPL
10+
1) 7z.dll:
11+
- The "GNU LGPL" as main license for most of the code
12+
- The "GNU LGPL" with "unRAR license restriction" for some code
13+
- The "BSD 3-clause License" for some code
14+
2) All other files: the "GNU LGPL".
1215

13-
The GNU LGPL + unRAR restriction means that you must follow both
14-
GNU LGPL rules and unRAR restriction rules.
16+
Redistributions in binary form must reproduce related license information from this file.
1517

16-
17-
Note:
18-
You can use 7-Zip on any computer, including a computer in a commercial
18+
Note:
19+
You can use 7-Zip on any computer, including a computer in a commercial
1920
organization. You don't need to register or pay for 7-Zip.
2021

2122

@@ -32,25 +33,58 @@
3233
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
3334
Lesser General Public License for more details.
3435

35-
You can receive a copy of the GNU Lesser General Public License from
36+
You can receive a copy of the GNU Lesser General Public License from
3637
http://www.gnu.org/
3738

3839

39-
unRAR restriction
40-
-----------------
4140

42-
The decompression engine for RAR archives was developed using source
41+
42+
BSD 3-clause License
43+
--------------------
44+
45+
The "BSD 3-clause License" is used for the code in 7z.dll that implements LZFSE data decompression.
46+
That code was derived from the code in the "LZFSE compression library" developed by Apple Inc,
47+
that also uses the "BSD 3-clause License":
48+
49+
----
50+
Copyright (c) 2015-2016, Apple Inc. All rights reserved.
51+
52+
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
53+
54+
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
55+
56+
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer
57+
in the documentation and/or other materials provided with the distribution.
58+
59+
3. Neither the name of the copyright holder(s) nor the names of any contributors may be used to endorse or promote products derived
60+
from this software without specific prior written permission.
61+
62+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
63+
LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
64+
COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
65+
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
66+
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
67+
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
68+
----
69+
70+
71+
72+
73+
unRAR license restriction
74+
-------------------------
75+
76+
The decompression engine for RAR archives was developed using source
4377
code of unRAR program.
4478
All copyrights to original unRAR code are owned by Alexander Roshal.
4579

4680
The license for original unRAR code has the following restriction:
4781

48-
The unRAR sources cannot be used to re-create the RAR compression algorithm,
49-
which is proprietary. Distribution of modified unRAR sources in separate form
82+
The unRAR sources cannot be used to re-create the RAR compression algorithm,
83+
which is proprietary. Distribution of modified unRAR sources in separate form
5084
or as a part of other software is permitted, provided that it is clearly
5185
stated in the documentation and source comments that the code may
5286
not be used to develop a RAR (WinRAR) compatible archiver.
5387

5488

5589
--
56-
Igor Pavlov
90+
Igor Pavlov

tests/pester-tests/BundledApplications.Tests.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
Describe 'Ensuring correct version of <Name> is installed' -Tag BundledApplications -ForEach @(
44
@{ Name = 'shimgen' ; Version = '1.0.0' ; ChocolateyVersion = '1.0.0' ; IsSigned = $true }
5-
@{ Name = '7z' ; Version = '21.07' ; ChocolateyVersion = '1.1.0' ; IsSigned = $false }
5+
@{ Name = '7z' ; Version = '24.09' ; ChocolateyVersion = '1.1.0' ; IsSigned = $false }
66
) -Skip:(-not (Test-ChocolateyVersionEqualOrHigherThan "1.0.0")) {
77
Context '<Name> is correctly installed' -Skip:(-not (Test-ChocolateyVersionEqualOrHigherThan $ChocolateyVersion)) {
88
BeforeAll {

0 commit comments

Comments
 (0)