#1085278 zip: backport AES128 and AES256 support from upstream zip 3.1 beta

Package:
zip
Source:
zip
Description:
Archiver for .zip files
Submitter:
Joshua Hudson
Date:
2024-10-19 12:48:01 UTC
Severity:
normal
#1085278#5
Date:
2024-10-17 14:38:02 UTC
From:
To:
Dear Maintainer,

A thing has happened; the upstream info-zip team had released a beta
version of info-zip that has support for AES-128 and AES-256 encrypted
zip files; however the upstream beta never gets any security fixes.

For that matter, the main upstream package doesn't get security fixes
either, which is why the version we have already says "by Debian".

Therefore I find myself in the unexpected place of having to request
a backport of the AES support code to Debian's zip 3.0 and unzip 6.0,
and ultimately I'd prefer for it to use the direct implementation of
AES rather than take a dependency on libressl; the upstream AES support
code should be usable with a manual merge.
#1085278#10
Date:
2024-10-19 12:44:17 UTC
From:
To:
  > A thing has happened; the upstream info-zip team had released a beta
 > version of info-zip that has support for AES-128 and AES-256 encrypted
 > zip files; however the upstream beta never gets any security fixes.
 >
 > For that matter, the main upstream package doesn't get security fixes
 > either, which is why the version we have already says "by Debian".

 >

 > Therefore find myself in the unexpected place of having to request
 > a backport of the AES support code to Debian's zip 3.0 and unzip 6.0,
 > and ultimately I'd prefer for it to use the direct implementation of
 > AES rather than take a dependency on libressl; the upstream AES support
 > code should be usable with a manual merge.


I'm a member of the upstream infozip team. I can work with you to
backport this feature if needed.


I think that the public beta already has the most up to date code for
the AES support. If not, I can get you the latest changes.