xz Utils

[awgcooper]

I'm guessing the answer is yes but best to check: is it still safe to use lzma compression given the recent xz Utils scare - https://arstechnica.com/security/2024/04/what-we-know-about-the-xz-utils-backdoor-that-almost-infected-the-world/

[ThomasWaldmann]

Well, as far as things are currently known, only the backdoored releases are problematic.

The stable Linux dists usually did not already include these versions and the unstable/rolling release dists reverted to safe versions.

For borg, the situation is like this:

• source code based releases (git, pip / pypi.org, most linux/bsd/... packages): Problem is out of borg scope because borg does not include lzma source code, but uses lzma compression via Python stdlib.
• binary releases as provided on github releases page: I build these on misc. stable releases of Linux, FreeBSD and macOS and they do not use the backdoored versions.

Considering trust in liblzma in general: borg could not just remove lzma compression, because that would render all lzma compressed repos unusable. The only point in time we could do that is when migrating from borg1 to borg2 where we could recompress stuff to something non-lzma.

[awgcooper]

Thanks very much for the clarification.

[ThomasWaldmann]

Closing this as outdated: it has seen no activity for a long time and predates the current borg releases.

If this still affects you on a current version - borg 1.4.x (stable) or the borg 2.0.0 beta - please open a new discussion with up-to-date details.