updated sources

- There are some issues when the s390x optimizations are turned on - the hufts test fails
- This will need some further investigation, for the time, I've disabled the optimizations

.fmf/version

@@ -0,0 +1 @@
+1

.gitignore

@@ -6,3 +6,6 @@ gzip-1.4.tar.xz
 /gzip-1.9.tar.xz
 /gzip-1.10.tar.xz
 /gzip-1.11.tar.xz
+/gzip-1.12.tar.xz
+/gzip-1.13.tar.xz
+/gzip-1.14.tar.xz

cve-2022-1271-part1.patch

@@ -1,43 +0,0 @@
-From dc9740df61e575e8c3148b7bd3c147a81ea00c7c Mon Sep 17 00:00:00 2001
-From: Lasse Collin <lasse.collin@tukaani.org>
-Date: Mon, 4 Apr 2022 23:52:49 -0700
-Subject: zgrep: avoid exploit via multi-newline file names
-
-* zgrep.in: The issue with the old code is that with multiple
-newlines, the N-command will read the second line of input,
-then the s-commands will be skipped because it's not the end
-of the file yet, then a new sed cycle starts and the pattern
-space is printed and emptied. So only the last line or two get
-escaped. This patch makes sed read all lines into the pattern
-space and then do the escaping.
-
-This vulnerability was discovered by:
-cleemy desu wayo working with Trend Micro Zero Day Initiative
----
- zgrep.in | 10 +++++++---
- 1 file changed, 7 insertions(+), 3 deletions(-)
-
-diff --git a/zgrep.in b/zgrep.in
-index 345dae3..bdf7da2 100644
---- a/zgrep.in
-+++ b/zgrep.in
-@@ -222,9 +222,13 @@ do
- '* | *'&'* | *'\'* | *'|'*)
-         i=$(printf '%s\n' "$i" |
-             sed '
--              $!N
--              $s/[&\|]/\\&/g
--              $s/\n/\\n/g
-+              :start
-+              $!{
-+                N
-+                b start
-+              }
-+              s/[&\|]/\\&/g
-+              s/\n/\\n/g
-             ');;
-       esac
-       sed_script="s|^|$i:|"
--- 
-cgit v1.1
-

cve-2022-1271-part2.patch

@@ -1,77 +0,0 @@
-From d74a30d45c6834c8e9f87115197370fe86656d81 Mon Sep 17 00:00:00 2001
-From: Jim Meyering <meyering@fb.com>
-Date: Mon, 4 Apr 2022 23:52:49 -0700
-Subject: zgrep: add NEWS and tests for this exploitable bug
-
-* tests/zgrep-abuse: New file, based on PoC by cleemy desu wayo.
-* tests/Makefile.am (TESTS): Add it.
-* NEWS: Mention the exploit.
-The bug appears to have been present since the beginning.
----
- tests/Makefile.am |  1 +
- tests/zgrep-abuse | 41 +++++++++++++++++++++++++++++++++++++++++
- 3 files changed, 45 insertions(+)
- create mode 100755 tests/zgrep-abuse
-
-diff --git a/tests/Makefile.am b/tests/Makefile.am
-index d09672e..5f148d6 100644
---- a/tests/Makefile.am
-+++ b/tests/Makefile.am
-@@ -36,6 +36,7 @@ TESTS =					\
-   z-suffix				\
-   zdiff					\
-   zgrep-f				\
-+  zgrep-abuse				\
-   zgrep-context				\
-   zgrep-signal				\
-   znew-k
-diff --git a/tests/zgrep-abuse b/tests/zgrep-abuse
-new file mode 100755
-index 0000000..3e8a8f9
---- /dev/null
-+++ b/tests/zgrep-abuse
-@@ -0,0 +1,41 @@
-+#!/bin/sh
-+# Show how zgrep applied to a crafted file name may overwrite
-+# a selected file with chosen content.  Fixed in gzip-1.12.
-+
-+# Copyright (C) 2022 Free Software Foundation, Inc.
-+
-+# This program is free software: you can redistribute it and/or modify
-+# it under the terms of the GNU General Public License as published by
-+# the Free Software Foundation, either version 3 of the License, or
-+# (at your option) any later version.
-+
-+# This program is distributed in the hope that it will be useful,
-+# but WITHOUT ANY WARRANTY; without even the implied warranty of
-+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+# GNU General Public License for more details.
-+
-+# You should have received a copy of the GNU General Public License
-+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
-+# limit so don't run it by default.
-+
-+. "${srcdir=.}/init.sh"; path_prepend_ ..
-+
-+: > z || framework_failure_
-+echo test |gzip > 'z|
-+p
-+1s|.*|chosen-content|
-+1w hacked
-+etouch .\x2fhacked2
-+d
-+#
-+#' || framework_failure_
-+
-+fail=0
-+
-+zgrep test z* > /dev/null
-+
-+# Before the fix, each of these would be created.
-+test -f hacked && fail=1
-+test -f hacked2 && fail=1
-+
-+Exit $fail
--- 
-cgit v1.1
-

cve-2022-1271-part3.patch

@@ -1,46 +0,0 @@
-From c99f320d5c0fd98fe88d9cea5407eb7ad9d50e8a Mon Sep 17 00:00:00 2001
-From: Paul Eggert <eggert@cs.ucla.edu>
-Date: Mon, 4 Apr 2022 23:52:49 -0700
-Subject: zgrep: port to POSIX sed
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-* zgrep.in (res): When escaping the file name do not rely on GNU
-sed’s extension to POSIX with respect to s/.../\n/.  Instead, use
-features that should also work with AIX and/or Solaris sed.  This is
-simpler anyway, and would have prevented the recently-fixed bug.
----
- zgrep.in | 15 ++++-----------
- 1 file changed, 4 insertions(+), 11 deletions(-)
-
-diff --git a/zgrep.in b/zgrep.in
-index bdf7da2..6a16dd1 100644
---- a/zgrep.in
-+++ b/zgrep.in
-@@ -220,18 +220,11 @@ do
-       case $i in
-       (*'
- '* | *'&'* | *'\'* | *'|'*)
--        i=$(printf '%s\n' "$i" |
--            sed '
--              :start
--              $!{
--                N
--                b start
--              }
--              s/[&\|]/\\&/g
--              s/\n/\\n/g
--            ');;
-+          icolon=$(printf '%s\n' "$i:" |
-+                     sed -e 's/[&\|]/\\&/g' -e '$!s/$/\\/');;
-+      (*) icolon="$i:";;
-       esac
--      sed_script="s|^|$i:|"
-+      sed_script="s|^|$icolon|"
- 
-       # Fail if grep or sed fails.
-       r=$(
--- 
-cgit v1.1
-

gzip.spec

@@ -1,9 +1,9 @@
 Summary: GNU data compression program
 Name: gzip
-Version: 1.11
-Release: 3%{?dist}
+Version: 1.14
+Release: 1%{?dist}
 # info pages are under GFDL license
-License: GPLv3+ and GFDL
+License: GPL-3.0-or-later AND GFDL-1.3-only
 Source0: https://ftp.gnu.org/gnu/gzip/gzip-%{version}.tar.xz
 Source1: https://www.gnu.org/licenses/fdl-1.3.txt
 
@@ -11,10 +11,7 @@ Source1: https://www.gnu.org/licenses/fdl-1.3.txt
 Source100: colorzgrep.csh
 Source101: colorzgrep.sh
 
-Patch1: gnulib.patch
-Patch2: cve-2022-1271-part1.patch
-Patch3: cve-2022-1271-part2.patch
-Patch4: cve-2022-1271-part3.patch
+Patch1: s390_errno.patch
 
 # Fixed in upstream code.
 # http://thread.gmane.org/gmane.comp.gnu.gzip.bugs/378
@@ -42,9 +39,8 @@ very commonly used data compression program.
 
 %prep
 %setup -q
-%patch2 -p1
-%patch3 -p1
-%patch4 -p1
+%patch 1 -p1
+
 cp %{SOURCE1} .
 autoreconf
 
@@ -54,7 +50,17 @@ export CPPFLAGS="-DHAVE_LSTAT"
 export CC="%{__cc}"
 export CPP="%{__cpp}"
 export CXX="%{__cxx}"
+%ifarch s390x
+
+#When the otpimizations are enabled, the huft test fails as of F44/gzip1.14
+#export CFLAGS="$RPM_OPT_FLAGS -Dalignas=_Alignas -DDFLTCC_LEVEL_MASK=0x7e"
+#use this in the next realease after gzip 1.13 export CFLAGS="$RPM_OPT_FLAGS -DDFLTCC_LEVEL_MASK=0x7e"
+#%configure --enable-dfltcc
+
 %configure
+%else
+%configure
+%endif
 make
 %check
 make check
@@ -85,8 +91,51 @@ install -p -m 644 %{SOURCE101} %{buildroot}%{profiledir}
 %{profiledir}/*
 
 %changelog
-* Wed Apr 13 2022 Jakub Martisko <jamartis@redhat.com> - 1.11-3
-- fix an arbitrary-file-write vulnerability in zgrep
+* Thu Aug 14 2025 Jakub Martisko <jamartis@redhat.com> - 1.14-1
+- Rebase to gzip 1.14
+- There are some issues when the s390x optimizations are turned on - the hufts test fails
+- This will need some further investigation, for the time, I've disabled the optimizations
+
+* Thu Jul 24 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.13-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
+
+* Fri Jan 17 2025 Fedora Release Engineering <releng@fedoraproject.org> - 1.13-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
+
+* Thu Jul 18 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.13-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
+
+* Thu Feb 01 2024 Jakub Martisko <jamartis@redhat.com> - 1.13-1
+- Rebase to gzip 1.13
+- There's a bug on s390x: https://lists.gnu.org/archive/html/bug-gzip/2023-10/msg00000.html
+- Revert the s390x build options in the next release
+Resolves: rhbz#2232890
+
+* Wed Jan 24 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.12-8
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Sat Jan 20 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.12-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
+
+* Wed Aug 02 2023 Jakub Martisko <jamartis@redhat.com> - 1.12-6
+- Enbale the s390x optimizations
+Resolves: rhbz#2175699
+
+* Thu Jul 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.12-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
+
+* Thu Apr 13 2023 Lukáš Zaoral <lzaoral@redhat.com> - 1.12-4
+- migrate to SPDX license format
+
+* Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 1.12-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
+
+* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.12-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+
+* Mon Apr 11 2022 Jakub Martisko <jamartis@redhat.com> - 1.12-1
+- Rebase to gzip 1.12
+Resolves: rhbz#2073133
 Resolves: CVE-2022-1271
 
 * Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1.11-2

plans/all.fmf

@@ -0,0 +1,6 @@
+summary: Basic smoke test
+discover:
+    how: fmf
+    url: https://src.fedoraproject.org/tests/gzip.git
+execute:
+    how: tmt

s390_errno.patch

@@ -0,0 +1,26 @@
+From c76affb4551630ff661ac1c1ee99353a17eb16e1 Mon Sep 17 00:00:00 2001
+From: Paul Eggert <eggert@cs.ucla.edu>
+Date: Fri, 30 May 2025 12:31:04 -0700
+Subject: gzip: fix s390x build failure
+
+Problem reported by Jakub Martisko <https://bugs.gnu.org/78618>.
+* dfltcc.c: Include errno.h.
+---
+ dfltcc.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/dfltcc.c b/dfltcc.c
+index 9f86581..8307a97 100644
+--- a/dfltcc.c
++++ b/dfltcc.c
+@@ -17,6 +17,7 @@
+ 
+ #include <config.h>
+ 
++#include <errno.h>
+ #include <stdlib.h>
+ 
+ #ifdef HAVE_SYS_SDT_H
+-- 
+cgit v1.2.3
+

sources

@@ -1 +1 @@
-SHA512 (gzip-1.11.tar.xz) = af297c173297d588722f4d0f140a2ae4d3ea3861464191772fb2e11e47be43644b5ae01ed63f0051d6eb4751666284de53e14c4dd9f0c1d25f61cf676fbf11f3
+SHA512 (gzip-1.14.tar.xz) = 82aef53188b3e69b51b7ddab5b8c44a11a5b73c0039b22a315a0c7d244694feab0146748add4265901eb1b4c0cee8a9eb69594995f098830d964091af97079c5

tests/.gitignore

@@ -1,2 +0,0 @@
-*.swp
-*.retry

tests/test-simple

@@ -1,11 +0,0 @@
-#!/bin/sh
-set -ex
-
-# exercise installed gzip/gunzip programs
-echo "Bla" > bla.file
-cp bla.file bla.file.orig
-gzip bla.file
-gunzip bla.file.gz
-cmp bla.file bla.file.orig
-echo "hi"
-rm bla.file bla.file.orig

tests/test_simple.yml

@@ -1,32 +0,0 @@
----
-- hosts: localhost
-  vars:
-  - artifacts: ./artifacts
-  tags:
-  - atomic
-  - classic
-  - container
-  remote_user: root
-  tasks:
-  - name: Create the folder where we will store the tests
-    action: file state=directory path={{ item }}
-            owner=root group=root
-    with_items:
-    - /usr/local/bin
-
-  - name: Install the test files
-    copy: src={{ item.file }} dest=/usr/local/bin/{{ item.dest }}
-           mode=0755
-    with_items:
-    - {file: test-simple, dest: test-simple }
-
-  - block:
-    - name: Execute the tests
-      shell: exec > /tmp/test.log && /usr/local/bin/test-simple 2>&1
-
-  - always:
-    - name: Pull out the logs
-      fetch:
-        dest: "{{ artifacts }}/"
-        src: "/tmp/test.log"
-        flat: yes

tests/tests.yml

@@ -1 +0,0 @@
-- include: test_simple.yml