Wanted to make more use of Suse/Linux, but people from over the corporate and Windows worlds seem to be fond of submitting RAR and 7ZIP file formats to all the different places, channels, transfer mechanisms etc and seemingly even current Leap 15.2 seems to be unable to handle new sub version formats of both, rar and 7zip file formats. This is my interpretation of the failings to read/check/unpack the rar and 7zip files on a fresh leap 15.2 installation.
Lot of rar Files the ark program can not make any use of it complains it can not handle the content. Also the same for 7Zip as for the un*x world, there seems to be no fairly recent port of the open source 7zip project and or its libraries?
I have not found any really meaningful information out there either, additional repositories, or projects to port more recent unrar or better 7zip source code and libraries over to the linux etc world. I guess 7zip SDK and source code would suffice, as a current 7zip on the windows platform can reand and at least extract also current rar archive formats.
Anyone know how to solve these issues? TY
On 09/07/2020 11.45, cagsm wrote:
Wanted to make more use of Suse/Linux, but people from over the corporate and Windows worlds seem to be fond of submitting RAR and 7ZIP file formats to all the different places, channels, transfer mechanisms etc and seemingly even current Leap 15.2 seems to be unable to handle new sub version formats of both, rar and 7zip file formats. This is my interpretation of the failings to read/check/unpack the rar and 7zip files on a fresh leap 15.2 installation.
Lot of rar Files the ark program can not make any use of it complains it can not handle the content. Also the same for 7Zip as for the un*x world, there seems to be no fairly recent port of the open source 7zip project and or its libraries?
I have not found any really meaningful information out there either, additional repositories, or projects to port more recent unrar or better 7zip source code and libraries over to the linux etc world. I guess 7zip SDK and source code would suffice, as a current 7zip on the windows platform can reand and at least extract also current rar archive formats.
Anyone know how to solve these issues?
Rar is proprietary, so if they make changes and do not publish how to decode them, there is nothing that can be done on the Linux camp. And if they publish them, it takes time.
But, you can install the proprietary version of rar (shareware), and at least test if those archives can be opened.
I do not have test archives with the new formats to try myself.
On Thu, Jul 9, 2020 at 12:28 PM Carlos E. R. robin.listas@telefonica.net wrote:
Rar is proprietary, so if they make changes and do not publish how to decode them, there is nothing that can be done on the Linux camp. And if they publish them, it takes time.
that's when I asked about 7zip open source project. all these linuxes I come across seem to use some ancient 7zip 4.56 or something very old as a codebase or proted project.
But, you can install the proprietary version of rar (shareware), and at least test if those archives can be opened.
I do not have test archives with the new formats to try myself.
okay I never used proprietary software on linux, so how would I go about it? how do I install shareware rar? you mean from their rarlab webpage or something? how does one actually make sure that some commercial or proprietary soft-ware doesnt infect one's system right to its core or doesnt bring you all the spyware and more?
then again, maybe a wine approach would even be better just came to my mind, and use the original 7zip windows binaries over there. never done that before either.
TY
On 09/07/2020 13.14, cagsm wrote:
On Thu, Jul 9, 2020 at 12:28 PM Carlos E. R. robin.listas@telefonica.net wrote:
Rar is proprietary, so if they make changes and do not publish how to decode them, there is nothing that can be done on the Linux camp. And if they publish them, it takes time.
that's when I asked about 7zip open source project. all these linuxes I come across seem to use some ancient 7zip 4.56 or something very old as a codebase or proted project.
I don't know, I'm not very familiar with 7zip.
But, you can install the proprietary version of rar (shareware), and at least test if those archives can be opened.
I do not have test archives with the new formats to try myself.
okay I never used proprietary software on linux, so how would I go about it? how do I install shareware rar? you mean from their rarlab webpage or something? how does one actually make sure that some commercial or proprietary soft-ware doesnt infect one's system right to its core or doesnt bring you all the spyware and more?
LOL.
Rar is safe, I have used it occasionally. You would go to their web page, and download the Linux version for trial. I see version 5.91, which is the same number as for WinRAR. But the Linux version is command line only.
https://www.rarlab.com/download.htm
It is good software, but it does not support Linux permissions or attributes, thus its usefulness in Linux is limited.
If you like it and want to keep using it, then you have to pay them, per their instructions somewhere. I don't know the price.
then again, maybe a wine approach would even be better just came to my mind, and use the original 7zip windows binaries over there. never done that before either.
Might work. It will run slower, though.
cagsm wrote:
Anyone know how to solve these issues?
For unpacking rar archive, we have 'unrar'. For 7zip, we have 'p7zip'
On 07/09/2020 05:37 AM, Per Jessen wrote:
cagsm wrote:
Anyone know how to solve these issues?
For unpacking rar archive, we have 'unrar'. For 7zip, we have 'p7zip'
I have a customer who uses Nessus for security scans and it flags the Leap 15.x p7zip as having vulnerabilities. Nessus is probably just looking at the RPM version and notices that it matches an old Windows version that is vulnerable. I have no idea if Leap's p7zip has been back-ported for security fixes, but I just manually remove and lock it.
Until recently, anyway. The need has arisen for the customer to use p7zip occasionally, so we've been installing/uninstalling appropriately, hoping to miss the asynchronous Nessus scans.
I can't help but think that this is a problem for SLE too.
Regards, Lew
On 07/09/2020 04:45 AM, cagsm wrote:
I have not found any really meaningful information out there either, additional repositories, or projects to port more recent unrar or better 7zip source code and libraries over to the linux etc world. I guess 7zip SDK and source code would suffice, as a current 7zip on the windows platform can reand and at least extract also current rar archive formats.
Anyone know how to solve these issues?
packman repo has rar-5.7.1-lp150.1.1.x86_64
and you can get
zip-3.0-lp150.2.7.x86_64 from OSS
Are you saying these versions of rar and zip don't work with current .rar and .zip files?
Lew Wolfgang wrote:
On 07/09/2020 05:37 AM, Per Jessen wrote:
cagsm wrote:
Anyone know how to solve these issues?
For unpacking rar archive, we have 'unrar'. For 7zip, we have 'p7zip'
I have a customer who uses Nessus for security scans and it flags the Leap 15.x p7zip as having vulnerabilities.
What sort of vulnerabilities might there be in such a utility ?
On 10/07/2020 11.00, David C. Rankin wrote:
On 07/09/2020 04:45 AM, cagsm wrote:
I have not found any really meaningful information out there either, additional repositories, or projects to port more recent unrar or better 7zip source code and libraries over to the linux etc world. I guess 7zip SDK and source code would suffice, as a current 7zip on the windows platform can reand and at least extract also current rar archive formats.
Anyone know how to solve these issues?
packman repo has rar-5.7.1-lp150.1.1.x86_64
5.9.0 for Leap 15.1 - I forgot that packman has it.
On Fri, 10 Jul 2020 11:13:13 +0200 Per Jessen per@computer.org wrote:
Lew Wolfgang wrote:
On 07/09/2020 05:37 AM, Per Jessen wrote:
cagsm wrote:
Anyone know how to solve these issues?
For unpacking rar archive, we have 'unrar'. For 7zip, we have 'p7zip'
I have a customer who uses Nessus for security scans and it flags the Leap 15.x p7zip as having vulnerabilities.
What sort of vulnerabilities might there be in such a utility ?
Well it might scan the entire filesystems for poorly set permissions, drop some executable code in one such location and either execute it itself or wait for the poor mutt of the user to execute it, at which point it gains root access via a zero-day and pwns the whole machine.
Assuming we're in a TV universe, of course :)
Dave Howorth wrote:
On Fri, 10 Jul 2020 11:13:13 +0200 Per Jessen per@computer.org wrote:
Lew Wolfgang wrote:
On 07/09/2020 05:37 AM, Per Jessen wrote:
cagsm wrote:
Anyone know how to solve these issues?
For unpacking rar archive, we have 'unrar'. For 7zip, we have 'p7zip'
I have a customer who uses Nessus for security scans and it flags the Leap 15.x p7zip as having vulnerabilities.
What sort of vulnerabilities might there be in such a utility ?
Well it might scan the entire filesystems for poorly set permissions, drop some executable code in one such location and either execute it itself or wait for the poor mutt of the user to execute it, at which point it gains root access via a zero-day and pwns the whole machine.
Assuming we're in a TV universe, of course :)
Dave, I knew I could count on you for the light Friday entertainment :-)
(I _was_ even going to make some comment about trojans, but then I forgot)
On 07/10/2020 02:13 AM, Per Jessen wrote:
Lew Wolfgang wrote:
On 07/09/2020 05:37 AM, Per Jessen wrote:
cagsm wrote:
Anyone know how to solve these issues?
For unpacking rar archive, we have 'unrar'. For 7zip, we have 'p7zip'
I have a customer who uses Nessus for security scans and it flags the Leap 15.x p7zip as having vulnerabilities.
What sort of vulnerabilities might there be in such a utility ?
I don't recall the specifics of the Nessus report, but in general, interpreters are difficult to get right. Buffer overflows caused by specially crafted object files can do it.
This for p7zip:
https://www.cvedetails.com/vulnerability-list/vendor_id-9220/product_id-3093...
Leap 15.0 and 15.1 triggered the finding. I haven't tried 15.2 yet.
Regards, Lew
Lew Wolfgang wrote:
On 07/10/2020 02:13 AM, Per Jessen wrote:
Lew Wolfgang wrote:
On 07/09/2020 05:37 AM, Per Jessen wrote:
cagsm wrote:
Anyone know how to solve these issues?
For unpacking rar archive, we have 'unrar'. For 7zip, we have 'p7zip'
I have a customer who uses Nessus for security scans and it flags the Leap 15.x p7zip as having vulnerabilities.
What sort of vulnerabilities might there be in such a utility ?
I don't recall the specifics of the Nessus report, but in general, interpreters are difficult to get right. Buffer overflows caused by specially crafted object files can do it.
That I can appreciate - but where is the vulnerability ? I mean, it's a utility like tar, man, cp etc etc - unless it has the DaHoWo trojan embedded?
Hello,
On Fri, 10 Jul 2020, Lew Wolfgang wrote:
On 07/10/2020 02:13 AM, Per Jessen wrote:
Lew Wolfgang wrote:
On 07/09/2020 05:37 AM, Per Jessen wrote:
cagsm wrote:
Anyone know how to solve these issues?
For unpacking rar archive, we have 'unrar'. For 7zip, we have 'p7zip'
I have a customer who uses Nessus for security scans and it flags the Leap 15.x p7zip as having vulnerabilities.
What sort of vulnerabilities might there be in such a utility ?
I don't recall the specifics of the Nessus report, but in general, interpreters are difficult to get right. Buffer overflows caused by specially crafted object files can do it.
This for p7zip:
https://www.cvedetails.com/vulnerability-list/vendor_id-9220/product_id-3093...
Well, that 2015 CVE should be irrelevant, for https://www.cvedetails.com/cve/CVE-2017-17969/ and https://www.cvedetails.com/cve/CVE-2016-9296/ there are patches in https://build.opensuse.org/package/show/Archiving/p7zip and as old as that is, that patched version should be in any Leap still supported. That leaves
https://www.cvedetails.com/cve/CVE-2018-5996/
You should file a bug for that and ask for a patch / update of p7zip.
Anyway: if the scan flags p7zip for more than CVE-2018-5996, then it's wrong. And yes, of course, it should be fixed.
HTH, -dnh
On 10/07/2020 21.17, David Haller wrote:
Hello,
You should file a bug for that and ask for a patch / update of p7zip.
Anyway: if the scan flags p7zip for more than CVE-2018-5996, then it's wrong. And yes, of course, it should be fixed.
If all the scanner does is look at the software version, patching is irrelevant.
Carlos, et al --
...and then Carlos E. R. said... % % If all the scanner does is look at the software version, patching is % irrelevant.
It isn't. The offending code is compiled into some binary string in the executable, and that sequence is used as a scan pattern. If that particular ordering of bits is found, then the file is flagged. Alas, I have in the past had innocent files flagged because the pattern was insufficiently unique :-/
% % -- % Cheers / Saludos, % % Carlos E. R. % (from 15.1 x86_64 at Telcontar)
HANN
:-D
On Fri, Jul 10, 2020 at 11:00 AM David C. Rankin drankinatty@suddenlinkmail.com wrote:
packman repo has rar-5.7.1-lp150.1.1.x86_64
leaving nonofficial repos aside of this discussion for a moment and also non-oss/non-free software especially proprietary, see the whole mess with nagware, malware etc on the windows world, I am not ready to install corporate ware or any kind of commercial darkware onto open source platforms... just yet....
and you can get zip-3.0-lp150.2.7.x86_64 from OSS
i have plenty of packages installed on this leap 15.2 and I simply live a simple noob life on the kde desktop. I take the rar or 7zip archive files corporates transfer over to me. I try to click em in dolphin as a noob gui approach.
i get an error inside a gui window titled "ark" or something. showing me it cant handle the content. of either file. rar or 7zip.
so I even go to Konsole. I fire up a
/usr/bin/7z t rarname.here.rar
or even a
usr/bin/7z t 7zipfilename.here.7zip
and that command shows me it is similarly aged and ancient 7zip
7-Zip [64] 16.02 : Copyright (c) 1999-2016 Igor Pavlov : 2016-05-21 p7zip Version 16.02 (locale=en_US.UTF-8,Utf16=on,HugeFiles=on,64 bits,.....
Scanning the drive for archives: 1 file,....
... Path =.... Type = Rar5 Physical Size = .... ..... Solid = - Blocks = .... Encrypted = - Multivolume = - Volumes = ....
ERROR: Unsupported Method : .... inside file name here ERROR: Unsupported Method : .... inside file name here ERROR: Unsupported Method : .... inside file name here ..... Sub items Errors: .... Archives with Errors: 1 Sub items Errors: ....
Testing archive:> Are you saying these versions of rar and zip don't work with current .rar and .zip files?
exactly. that is what this whole thread is about. the only approach so far I could barely manage to make use of the archive files is via wine and using windows x64 7zip installer and its results from inside wine. very odd that a neat open source project such as 7zip did never make it into the rest of the open source world with its current releases, let alone gui interfaces or plugins or libraries for that dolphin ark whatever api library external calls or something approach
kind of had the illusion that oss would be profiting from each other's works ;(
cagsm wrote:
very odd that a neat open source project such as 7zip did never make it into the rest of the open source world with its current releases, let alone gui interfaces or plugins or libraries for that dolphin ark whatever api library external calls or something approach
kind of had the illusion that oss would be profiting from each other's works ;(
Only if someone _does_ the work, it doesn't happen automagically. In this case, I guess nobody's been interested.
On 11/07/2020 11.34, cagsm wrote:
On Fri, Jul 10, 2020 at 11:00 AM David C. Rankin <> wrote:
packman repo has rar-5.7.1-lp150.1.1.x86_64
leaving nonofficial repos aside of this discussion for a moment and also non-oss/non-free software especially proprietary, see the whole mess with nagware, malware etc on the windows world, I am not ready to install corporate ware or any kind of commercial darkware onto open source platforms... just yet....
There is nothing evil in the shareware "rar". It is not even a corporation. And in fact, you can cheat and forget to pay, the program keeps working, it doesn't check.
It is just a programmer that had a bright idea for compressing files almost 30 years ago, and wanted to get some money for his work, in a polite manner.
He even published on the public domain some of this code and methods, so that Linux has the free "unrar".
Definitely not evil. Nothing will happen to your machine for installing rar from packman or from the developer site.
Testing archive:> Are you saying these versions of rar and zip don't work with current .rar and .zip files?
exactly. that is what this whole thread is about. the only approach so far I could barely manage to make use of the archive files is via wine and using windows x64 7zip installer and its results from inside wine. very odd that a neat open source project such as 7zip did never make it into the rest of the open source world with its current releases, let alone gui interfaces or plugins or libraries for that dolphin ark whatever api library external calls or something approach
kind of had the illusion that oss would be profiting from each other's works ;(
Notice that the "unrar" code in 7zip is the same as in the tool "unrar", It is the same code that the developer of "rar" published, and it can not open the more advanced rar compression schemes. Not now, but since ever.
On Sat, Jul 11, 2020 at 1:09 PM Carlos E. R. robin.listas@telefonica.net wrote:
There is nothing evil in the shareware "rar". It is not even a corporation. And in fact, you can cheat and forget to pay, the program keeps working, it doesn't check.
well whatever I am speaking about running only oss on oss platform. say what you will do wonder why we are even using suse leap here to begin with? if it suffices that someone simply states, nothing bad happened so far, or nothing bad happend, for 1, 10, 100 or thousand years. doesnt put it into the same league as oss.
It is just a programmer that had a bright idea for compressing files almost 30 years ago, and wanted to get some money for his work, in a polite manner. He even published on the public domain some of this code and methods, so that Linux has the free "unrar". Definitely not evil. Nothing will happen to your machine for installing rar from packman or from the developer site.
the 7zip developer did something with its source code, evolved it, fixed it, incorporated newer rar5 file format capability, reverse engineered or however they achived it, as 7zip version 19.00 does unpack and handle rar5 fileformat properly. the current stuff shipping with leap 15.2, that 7zip 16.02something doesnt handle it. also I am not an expert what software component, library or api or methods do enable that kde gui ark or something to handle the various archive formats. maybe it has a rar library of its own, maybe it does use something that the 7zip 16.02something package comes with or anything in between.
unfortunately I need to use wine for such tasks. but I am glad that worked. but at least thats open source 7zip windows version on open source wine on open source opensuse. and this is the only thing that currently works when sticking to oss and not infesting a happy oss system with non-oss, unfree and nontrustable software components.
On Sat, Jul 11, 2020 at 12:40 PM Per Jessen per@computer.org wrote:
Only if someone _does_ the work, it doesn't happen automagically. In this case, I guess nobody's been interested.
obviously somebody always has to work on things. and apparently, hopefully 7zip gets more spread and current in non-windows systems as well, or people refrain from using proprietary file formats such as .rar and its various versions.
On 11/07/2020 13.27, cagsm wrote:
On Sat, Jul 11, 2020 at 1:09 PM Carlos E. R. robin.listas@telefonica.net wrote:
There is nothing evil in the shareware "rar". It is not even a corporation. And in fact, you can cheat and forget to pay, the program keeps working, it doesn't check.
well whatever I am speaking about running only oss on oss platform. say what you will do wonder why we are even using suse leap here to begin with? if it suffices that someone simply states, nothing bad happened so far, or nothing bad happend, for 1, 10, 100 or thousand years. doesnt put it into the same league as oss.
I simply use the tools needed for each task, preferably oss, but otherwise I'll use others.
There are "evil" tools out there. And there are intrusive tools. Rar is none of that. It is really honest software.
It is just a programmer that had a bright idea for compressing files almost 30 years ago, and wanted to get some money for his work, in a polite manner. He even published on the public domain some of this code and methods, so that Linux has the free "unrar". Definitely not evil. Nothing will happen to your machine for installing rar from packman or from the developer site.
the 7zip developer did something with its source code, evolved it, fixed it, incorporated newer rar5 file format capability, reverse engineered or however they achived it, as 7zip version 19.00 does unpack and handle rar5 fileformat properly.
That would be illegal.
the current stuff shipping with leap 15.2, that 7zip 16.02something doesnt handle it. also I am not an expert what software component, library or api or methods do enable that kde gui ark or something to handle the various archive formats. maybe it has a rar library of its own, maybe it does use something that the 7zip 16.02something package comes with or anything in between.
unfortunately I need to use wine for such tasks. but I am glad that worked. but at least thats open source 7zip windows version on open source wine on open source opensuse. and this is the only thing that currently works when sticking to oss and not infesting a happy oss system with non-oss, unfree and nontrustable software components.
Man, you are paranoid.
On 10/07/2020 05:00, David C. Rankin wrote:
On 07/09/2020 04:45 AM, cagsm wrote:
I have not found any really meaningful information out there either, additional repositories, or projects to port more recent unrar or better 7zip source code and libraries over to the linux etc world. I guess 7zip SDK and source code would suffice, as a current 7zip on the windows platform can reand and at least extract also current rar archive formats.
Anyone know how to solve these issues?
packman repo has rar-5.7.1-lp150.1.1.x86_64
and you can get
zip-3.0-lp150.2.7.x86_64 from OSS
zypper info unzip zip
Information for package unzip: ------------------------------ Repository : 151_Archiving Name : unzip Version : 6.00-lp151.93.1 Arch : x86_64 Vendor : obs://build.opensuse.org/Archiving Installed Size : 262.8 KiB Installed : Yes Status : up-to-date Source package : unzip-6.00-lp151.93.1.src Summary : A program to unpack compressed files
Information for package zip: ---------------------------- Repository : 151_Archiving Name : zip Version : 3.0-lp151.39.2 Arch : x86_64 Vendor : obs://build.opensuse.org/Archiving Installed Size : 838.4 KiB Installed : Yes Status : up-to-date Source package : zip-3.0-lp151.39.2.src Summary : File compression program
and # zypper rm unzip zip Reading installed packages... Resolving package dependencies...
The following 42 packages are going to be REMOVED: GimpResourcesThumbnailer baloo_kcm breeze4-style kcm-servicemenus kde-thumbnailer-msoole kde-thumbnailer-ooxml kde4-kgreeter-plugins kdebase4-runtime kdebase4-workspace-addons kdebase4-workspace-liboxygenstyle kdebase4-workspace-libs kdelibs4 kdelibs4-core kdepimlibs4 kdm krandr kscd kvkbd libakonadi4 libkde4 libkdegames6 libkdepimlibs4 libkscreen libksuseinstall1 polka unzip yast2-bootloader yast2-country yast2-installation yast2-ldap yast2-metapackage-handler yast2-multipath yast2-network yast2-nfs-client yast2-ntp-client yast2-online-update yast2-packager yast2-storage-ng yast2-tune yast2-update yast2-users zip
42 packages to remove.
Are you saying these versions of rar and zip don't work with current .rar and .zip files?
On 07/11/2020 04:34 AM, cagsm wrote:
Testing archive:> Are you saying these versions of rar and zip don't work with current .rar and .zip files?
exactly. that is what this whole thread is about. the only approach so far I could barely manage to make use of the archive files is via wine and using windows x64 7zip installer and its results from inside wine. very odd that a neat open source project such as 7zip did never make it into the rest of the open source world with its current releases, let alone gui interfaces or plugins or libraries for that dolphin ark whatever api library external calls or something approach
Chuckling,
Yes, then that is a problem for all utilities, not just 7z if mickeysoft and friends have added to the compression formats, archives, sub-archives (things I have not looked into, because so far everything has just worked). I would be interested if you could point me to one of these links so I can see and reproduce the issue. 7zip is open-source, so if there is some .7zip file you are having problems with, I wonder why?
The official source is available as well as several github forks:
https://stackoverflow.com/questions/1754705/where-is-7-zips-compression-sour... https://sourceforge.net/projects/sevenzip/ https://www.7-zip.org/download.html
https://github.com/kornelski/7z https://github.com/mcmilk/7-Zip
I bet between the brain-trust here some good set of eyes could at least look at an *short* example file that shows the problem behavior and deduce at least what the problem is exactly.
-
Anton Aylward -
cagsm -
Carlos E. R. -
Dave Howorth -
David C. Rankin -
David Haller -
David T-G -
Lew Wolfgang -
Per Jessen