(#3285) Upgrade 7z to 23.01

There are no known CVE's associated with the previous release, however, since there are improved support for some compression algoritms and without updating the bundled 7zip version used will cause such archives to not be able to decompress, it was decided to updated the bundled binaries
chocolatey · Aug 2, 2023 · 436ceeb · 436ceeb
1 parent 76b9ca9
commit 436ceeb
Show file tree

Hide file tree

Showing 5 changed files with 53 additions and 19 deletions.
diff --git a/docs/legal/CREDITS.md b/docs/legal/CREDITS.md
@@ -6,7 +6,7 @@
   - [Contributors](#contributors)
 - [Third Party Licenses - Development](#third-party-licenses---development)
 - [Third Party Licenses - Runtime](#third-party-licenses---runtime)
-  - [7-Zip @ 21.07](#7-zip--2107)
+  - [7-Zip @ 23.01](#7-zip--2301)
   - [AlphaFS @ 2.1.3](#alphafs--213)
   - [Checksum @ 0.2.0](#checksum--020)
   - [log4net @ 2.0.12](#log4net--2012)
@@ -73,7 +73,7 @@ We would like to credit other super sweet tools/frameworks that aid in the devel
 Chocolatey CLI (choco) uses a number of 3rd-party components.
 Their details are below.
 
-### 7-Zip @ 21.07
+### 7-Zip @ 23.01
 
 Chocolatey uses [7-Zip](http://www.7-zip.org/) for uncompressing archives.
 [License terms](http://www.7-zip.org/license.txt):
@@ -84,7 +84,7 @@ Chocolatey uses [7-Zip](http://www.7-zip.org/) for uncompressing archives.
   License for use and distribution
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-  7-Zip Copyright (C) 1999-2022 Igor Pavlov.
+  7-Zip Copyright (C) 1999-2023 Igor Pavlov.
 
   The licenses for files are:
 

diff --git a/src/chocolatey.resources/tools/7z.dll b/src/chocolatey.resources/tools/7z.dll
diff --git a/src/chocolatey.resources/tools/7z.exe b/src/chocolatey.resources/tools/7z.exe
diff --git a/src/chocolatey.resources/tools/7zip.license.txt b/src/chocolatey.resources/tools/7zip.license.txt
@@ -3,19 +3,20 @@
   License for use and distribution
   ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-  7-Zip Copyright (C) 1999-2016 Igor Pavlov.
+  7-Zip Copyright (C) 1999-2023 Igor Pavlov.
 
-  Licenses for files are:
+  The licenses for files are:
 
-    1) 7z.dll: GNU LGPL + unRAR restriction
-    2) All other files:  GNU LGPL
+    1) 7z.dll:
+         - The "GNU LGPL" as main license for most of the code
+         - The "GNU LGPL" with "unRAR license restriction" for some code
+         - The "BSD 3-clause License" for some code
+    2) All other files: the "GNU LGPL".
 
-  The GNU LGPL + unRAR restriction means that you must follow both 
-  GNU LGPL rules and unRAR restriction rules.
+  Redistributions in binary form must reproduce related license information from this file.
 
-
-  Note: 
-    You can use 7-Zip on any computer, including a computer in a commercial 
+  Note:
+    You can use 7-Zip on any computer, including a computer in a commercial
     organization. You don't need to register or pay for 7-Zip.
 
 
@@ -32,21 +33,54 @@
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     Lesser General Public License for more details.
 
-    You can receive a copy of the GNU Lesser General Public License from 
+    You can receive a copy of the GNU Lesser General Public License from
     http://www.gnu.org/
 
 
-  unRAR restriction
-  -----------------
 
-    The decompression engine for RAR archives was developed using source 
+
+  BSD 3-clause License
+  --------------------
+
+    The "BSD 3-clause License" is used for the code in 7z.dll that implements LZFSE data decompression.
+    That code was derived from the code in the "LZFSE compression library" developed by Apple Inc,
+    that also uses the "BSD 3-clause License":
+
+    ----
+    Copyright (c) 2015-2016, Apple Inc. All rights reserved.
+
+    Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+    1.  Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+    2.  Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer
+        in the documentation and/or other materials provided with the distribution.
+
+    3.  Neither the name of the copyright holder(s) nor the names of any contributors may be used to endorse or promote products derived
+        from this software without specific prior written permission.
+
+    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+    LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+    (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+    HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+    ----
+
+
+
+
+  unRAR license restriction
+  -------------------------
+
+    The decompression engine for RAR archives was developed using source
     code of unRAR program.
     All copyrights to original unRAR code are owned by Alexander Roshal.
 
     The license for original unRAR code has the following restriction:
 
-      The unRAR sources cannot be used to re-create the RAR compression algorithm, 
-      which is proprietary. Distribution of modified unRAR sources in separate form 
+      The unRAR sources cannot be used to re-create the RAR compression algorithm,
+      which is proprietary. Distribution of modified unRAR sources in separate form
       or as a part of other software is permitted, provided that it is clearly
       stated in the documentation and source comments that the code may
       not be used to develop a RAR (WinRAR) compatible archiver.

diff --git a/tests/chocolatey-tests/BundledApplications.Tests.ps1 b/tests/chocolatey-tests/BundledApplications.Tests.ps1
@@ -2,7 +2,7 @@
 
 Describe 'Ensuring correct version of <Name> is installed' -Tag BundledApplications -ForEach @(
     @{ Name = 'shimgen' ; Version = '2.0.0' ; ChocolateyVersion = '2.0.0-alpha' ; IsSigned = $true }
-    @{ Name = '7z' ; Version = '21.07' ; ChocolateyVersion = '1.1.0' ; IsSigned = $false }
+    @{ Name = '7z' ; Version = '23.01' ; ChocolateyVersion = '2.2.1-alpha' ; IsSigned = $false }
 ) -Skip:(-not (Test-ChocolateyVersionEqualOrHigherThan "1.0.0")) {
     Context '<Name> is correctly installed' -Skip:(-not (Test-ChocolateyVersionEqualOrHigherThan $ChocolateyVersion)) {
         BeforeAll {