On 09/07/2020 13.14, cagsm wrote:

On Thu, Jul 9, 2020 at 12:28 PM Carlos E. R. wrote:

...

Rar is proprietary, so if they make changes and do not publish how to decode them, there is nothing that can be done on the Linux camp. And if they publish them, it takes time.

that's when I asked about 7zip open source project. all these linuxes I come across seem to use some ancient 7zip 4.56 or something very old as a codebase or proted project.

I don't know, I'm not very familiar with 7zip.

...

But, you can install the proprietary version of rar (shareware), and at least test if those archives can be opened.

...

I do not have test archives with the new formats to try myself.

okay I never used proprietary software on linux, so how would I go about it? how do I install shareware rar? you mean from their rarlab webpage or something? how does one actually make sure that some commercial or proprietary soft-ware doesnt infect one's system right to its core or doesnt bring you all the spyware and more?

LOL. Rar is safe, I have used it occasionally. You would go to their web page, and download the Linux version for trial. I see version 5.91, which is the same number as for WinRAR. But the Linux version is command line only. https://www.rarlab.com/download.htm It is good software, but it does not support Linux permissions or attributes, thus its usefulness in Linux is limited. If you like it and want to keep using it, then you have to pay them, per their instructions somewhere. I don't know the price.

then again, maybe a wine approach would even be better just came to my mind, and use the original 7zip windows binaries over there. never done that before either.

Might work. It will run slower, though. -- Cheers / Saludos, Carlos E. R. (from 15.1 x86_64 at Telcontar)

On 07/09/2020 05:37 AM, Per Jessen wrote:

cagsm wrote:

...

Anyone know how to solve these issues? For unpacking rar archive, we have 'unrar'. For 7zip, we have 'p7zip'

I have a customer who uses Nessus for security scans and it flags the Leap 15.x p7zip as having vulnerabilities.  Nessus is probably just looking at the RPM version and notices that it matches an old Windows version that is vulnerable.  I have no idea if Leap's p7zip has been back-ported for security fixes, but I just manually remove and lock it. Until recently, anyway.  The need has arisen for the customer to use p7zip occasionally, so we've been installing/uninstalling appropriately, hoping to miss the asynchronous Nessus scans. I can't help but think that this is a problem for SLE too. Regards, Lew -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On Fri, 10 Jul 2020 11:13:13 +0200 Per Jessen wrote:

Lew Wolfgang wrote:

...

On 07/09/2020 05:37 AM, Per Jessen wrote:

...

cagsm wrote:

...

Anyone know how to solve these issues? For unpacking rar archive, we have 'unrar'. For 7zip, we have 'p7zip'

I have a customer who uses Nessus for security scans and it flags the Leap 15.x p7zip as having vulnerabilities. 

What sort of vulnerabilities might there be in such a utility ?

Well it might scan the entire filesystems for poorly set permissions, drop some executable code in one such location and either execute it itself or wait for the poor mutt of the user to execute it, at which point it gains root access via a zero-day and pwns the whole machine. Assuming we're in a TV universe, of course :) -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 07/10/2020 02:13 AM, Per Jessen wrote:

Lew Wolfgang wrote:

...

On 07/09/2020 05:37 AM, Per Jessen wrote:

...

cagsm wrote:

...

Anyone know how to solve these issues? For unpacking rar archive, we have 'unrar'. For 7zip, we have 'p7zip' I have a customer who uses Nessus for security scans and it flags the Leap 15.x p7zip as having vulnerabilities. What sort of vulnerabilities might there be in such a utility ?

I don't recall the specifics of the Nessus report, but in general, interpreters are difficult to get right.  Buffer overflows caused by specially crafted object files can do it. This for p7zip: https://www.cvedetails.com/vulnerability-list/vendor_id-9220/product_id-3093... Leap 15.0 and 15.1 triggered the finding.  I haven't tried 15.2 yet. Regards, Lew -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Hello, On Fri, 10 Jul 2020, Lew Wolfgang wrote:

On 07/10/2020 02:13 AM, Per Jessen wrote:

...

Lew Wolfgang wrote:

...

On 07/09/2020 05:37 AM, Per Jessen wrote:

...

cagsm wrote:

...

Anyone know how to solve these issues? For unpacking rar archive, we have 'unrar'. For 7zip, we have 'p7zip' I have a customer who uses Nessus for security scans and it flags the Leap 15.x p7zip as having vulnerabilities. What sort of vulnerabilities might there be in such a utility ?

I don't recall the specifics of the Nessus report, but in general, interpreters are difficult to get right.  Buffer overflows caused by specially crafted object files can do it.

This for p7zip:

https://www.cvedetails.com/vulnerability-list/vendor_id-9220/product_id-3093...

Well, that 2015 CVE should be irrelevant, for https://www.cvedetails.com/cve/CVE-2017-17969/ and https://www.cvedetails.com/cve/CVE-2016-9296/ there are patches in https://build.opensuse.org/package/show/Archiving/p7zip and as old as that is, that patched version should be in any Leap still supported. That leaves https://www.cvedetails.com/cve/CVE-2018-5996/ You should file a bug for that and ask for a patch / update of p7zip. Anyway: if the scan flags p7zip for more than CVE-2018-5996, then it's wrong. And yes, of course, it should be fixed. HTH, -dnh -- printk(KERN_WARNING MYNAM ": (bad VooDoo)\n"); linux-2.6.6/drivers/message/fusion/mptctl.c -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

Carlos, et al -- ...and then Carlos E. R. said... % % If all the scanner does is look at the software version, patching is % irrelevant. It isn't. The offending code is compiled into some binary string in the executable, and that sequence is used as a scan pattern. If that particular ordering of bits is found, then the file is flagged. Alas, I have in the past had innocent files flagged because the pattern was insufficiently unique :-/ % % -- % Cheers / Saludos, % % Carlos E. R. % (from 15.1 x86_64 at Telcontar) HANN :-D -- David T-G See http://justpickone.org/davidtg/email/ See http://justpickone.org/davidtg/tofu.txt -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 10/07/2020 11.00, David C. Rankin wrote:

On 07/09/2020 04:45 AM, cagsm wrote:

...

I have not found any really meaningful information out there either, additional repositories, or projects to port more recent unrar or better 7zip source code and libraries over to the linux etc world. I guess 7zip SDK and source code would suffice, as a current 7zip on the windows platform can reand and at least extract also current rar archive formats.

Anyone know how to solve these issues?

packman repo has rar-5.7.1-lp150.1.1.x86_64

5.9.0 for Leap 15.1 - I forgot that packman has it. -- Cheers / Saludos, Carlos E. R. (from 15.1 x86_64 at Telcontar)

cagsm wrote:

very odd that a neat open source project such as 7zip did never make it into the rest of the open source world with its current releases, let alone gui interfaces or plugins or libraries for that dolphin ark whatever api library external calls or something approach

kind of had the illusion that oss would be profiting from each other's works ;(

Only if someone _does_ the work, it doesn't happen automagically. In this case, I guess nobody's been interested. -- Per Jessen, Zürich (20.7°C) http://www.dns24.ch/ - free dynamic DNS, made in Switzerland. -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org

On 11/07/2020 11.34, cagsm wrote:

On Fri, Jul 10, 2020 at 11:00 AM David C. Rankin <> wrote:

...

packman repo has rar-5.7.1-lp150.1.1.x86_64

leaving nonofficial repos aside of this discussion for a moment and also non-oss/non-free software especially proprietary, see the whole mess with nagware, malware etc on the windows world, I am not ready to install corporate ware or any kind of commercial darkware onto open source platforms... just yet....

There is nothing evil in the shareware "rar". It is not even a corporation. And in fact, you can cheat and forget to pay, the program keeps working, it doesn't check. It is just a programmer that had a bright idea for compressing files almost 30 years ago, and wanted to get some money for his work, in a polite manner. He even published on the public domain some of this code and methods, so that Linux has the free "unrar". Definitely not evil. Nothing will happen to your machine for installing rar from packman or from the developer site.

...

Testing archive:> Are you saying these versions of rar and zip don't work with current .rar and .zip files?

exactly. that is what this whole thread is about. the only approach so far I could barely manage to make use of the archive files is via wine and using windows x64 7zip installer and its results from inside wine. very odd that a neat open source project such as 7zip did never make it into the rest of the open source world with its current releases, let alone gui interfaces or plugins or libraries for that dolphin ark whatever api library external calls or something approach

kind of had the illusion that oss would be profiting from each other's works ;(

Notice that the "unrar" code in 7zip is the same as in the tool "unrar", It is the same code that the developer of "rar" published, and it can not open the more advanced rar compression schemes. Not now, but since ever.

-- Cheers / Saludos, Carlos E. R. (from 15.1 x86_64 at Telcontar)

On 11/07/2020 13.27, cagsm wrote:

On Sat, Jul 11, 2020 at 1:09 PM Carlos E. R. wrote:

...

There is nothing evil in the shareware "rar". It is not even a corporation. And in fact, you can cheat and forget to pay, the program keeps working, it doesn't check.

well whatever I am speaking about running only oss on oss platform. say what you will do wonder why we are even using suse leap here to begin with? if it suffices that someone simply states, nothing bad happened so far, or nothing bad happend, for 1, 10, 100 or thousand years. doesnt put it into the same league as oss.

I simply use the tools needed for each task, preferably oss, but otherwise I'll use others. There are "evil" tools out there. And there are intrusive tools. Rar is none of that. It is really honest software.

...

It is just a programmer that had a bright idea for compressing files almost 30 years ago, and wanted to get some money for his work, in a polite manner. He even published on the public domain some of this code and methods, so that Linux has the free "unrar". Definitely not evil. Nothing will happen to your machine for installing rar from packman or from the developer site.

the 7zip developer did something with its source code, evolved it, fixed it, incorporated newer rar5 file format capability, reverse engineered or however they achived it, as 7zip version 19.00 does unpack and handle rar5 fileformat properly.

That would be illegal.

the current stuff shipping with leap 15.2, that 7zip 16.02something doesnt handle it. also I am not an expert what software component, library or api or methods do enable that kde gui ark or something to handle the various archive formats. maybe it has a rar library of its own, maybe it does use something that the 7zip 16.02something package comes with or anything in between.

unfortunately I need to use wine for such tasks. but I am glad that worked. but at least thats open source 7zip windows version on open source wine on open source opensuse. and this is the only thing that currently works when sticking to oss and not infesting a happy oss system with non-oss, unfree and nontrustable software components.

Man, you are paranoid. -- Cheers / Saludos, Carlos E. R. (from 15.1 x86_64 at Telcontar)

On 10/07/2020 05:00, David C. Rankin wrote:

On 07/09/2020 04:45 AM, cagsm wrote:

...

I have not found any really meaningful information out there either, additional repositories, or projects to port more recent unrar or better 7zip source code and libraries over to the linux etc world. I guess 7zip SDK and source code would suffice, as a current 7zip on the windows platform can reand and at least extract also current rar archive formats.

Anyone know how to solve these issues?

packman repo has rar-5.7.1-lp150.1.1.x86_64

and you can get

zip-3.0-lp150.2.7.x86_64 from OSS

zypper info unzip zip Information for package unzip: ------------------------------ Repository : 151_Archiving Name : unzip Version : 6.00-lp151.93.1 Arch : x86_64 Vendor : obs://build.opensuse.org/Archiving Installed Size : 262.8 KiB Installed : Yes Status : up-to-date Source package : unzip-6.00-lp151.93.1.src Summary : A program to unpack compressed files Information for package zip: ---------------------------- Repository : 151_Archiving Name : zip Version : 3.0-lp151.39.2 Arch : x86_64 Vendor : obs://build.opensuse.org/Archiving Installed Size : 838.4 KiB Installed : Yes Status : up-to-date Source package : zip-3.0-lp151.39.2.src Summary : File compression program and # zypper rm unzip zip Reading installed packages... Resolving package dependencies... The following 42 packages are going to be REMOVED: GimpResourcesThumbnailer baloo_kcm breeze4-style kcm-servicemenus kde-thumbnailer-msoole kde-thumbnailer-ooxml kde4-kgreeter-plugins kdebase4-runtime kdebase4-workspace-addons kdebase4-workspace-liboxygenstyle kdebase4-workspace-libs kdelibs4 kdelibs4-core kdepimlibs4 kdm krandr kscd kvkbd libakonadi4 libkde4 libkdegames6 libkdepimlibs4 libkscreen libksuseinstall1 polka unzip yast2-bootloader yast2-country yast2-installation yast2-ldap yast2-metapackage-handler yast2-multipath yast2-network yast2-nfs-client yast2-ntp-client yast2-online-update yast2-packager yast2-storage-ng yast2-tune yast2-update yast2-users zip 42 packages to remove.

Are you saying these versions of rar and zip don't work with current .rar and .zip files?

-- A: Yes. > Q: Are you sure? >> A: Because it reverses the logical flow of conversation. >>> Q: Why is top posting frowned upon? -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org