[liblzma] Build error on arm64-android

[rezzeted]

Package: liblzma:arm64-android@5.4.4

Host Environment

• Host: x64-windows
• Compiler: Clang 14.0.1
• vcpkg-tool version: 2024-02-07-8a83681f921b10d86ae626fd833c253f4f8c355b
  vcpkg-scripts version: ce19164 2024-03-30 (2 days ago)

To Reproduce

vcpkg install openimageio:arm64-android
Failure logs

-- Downloading https://github.com/tukaani-project/xz/archive/v5.4.4.tar.gz -> tukaani-project-xz-v5.4.4.tar.gz...
[DEBUG] To include the environment variables in debug output, pass --debug-env
[DEBUG] Trying to load bundleconfig from D:\tmp\vcpkg\vcpkg-bundle.json
[DEBUG] Failed to open: D:\tmp\vcpkg\vcpkg-bundle.json
[DEBUG] Bundle config: readonly=false, usegitregistry=false, embeddedsha=nullopt, deployment=Git, vsversion=nullopt
[DEBUG] Metrics enabled.
[DEBUG] Feature flag 'binarycaching' unset
[DEBUG] Feature flag 'compilertracking' unset
[DEBUG] Feature flag 'registries' unset
[DEBUG] Feature flag 'versions' unset
[DEBUG] Feature flag 'dependencygraph' unset
Downloading https://github.com/tukaani-project/xz/archive/v5.4.4.tar.gz
[DEBUG] Trying to hash D:\tmp\vcpkg\downloads\tukaani-project-xz-v5.4.4.tar.gz.29392.part
[DEBUG] D:\tmp\vcpkg\downloads\tukaani-project-xz-v5.4.4.tar.gz.29392.part has hash e9750c8f54e500c592a664d535baa7dd38cb1e70cef3d1dcb286d2e0da38d9b2625f0eb966fb4dd1e974f359caa5226bcb329e194bd5eb3b441e56044fe8f0ff
error: Failed to download from mirror set
error: File does not have the expected hash:
url: https://github.com/tukaani-project/xz/archive/v5.4.4.tar.gz
File: D:\tmp\vcpkg\downloads\tukaani-project-xz-v5.4.4.tar.gz.29392.part
Expected hash: c28461123562564e030f3f733f078bc4c840e87598d9f4b718d4bca639120d8133f969c45d7bdc62f33f081d789ec0f14a1791fb7da18515682bfe3c0c7362e0
Actual hash: e9750c8f54e500c592a664d535baa7dd38cb1e70cef3d1dcb286d2e0da38d9b2625f0eb966fb4dd1e974f359caa5226bcb329e194bd5eb3b441e56044fe8f0ff
[DEBUG] D:\a\_work\1\s\src\vcpkg\base\downloads.cpp(1030): 
[DEBUG] Time in subprocesses: 0us
[DEBUG] Time in parsing JSON: 1us
[DEBUG] Time in JSON reader: 0us
[DEBUG] Time in filesystem: 8026us
[DEBUG] Time in loading ports: 0us
[DEBUG] Exiting after 435 ms (413726us)

CMake Error at scripts/cmake/vcpkg_download_distfile.cmake:32 (message):
      
      Failed to download file with error: 1
      If you are using a proxy, please check your proxy setting. Possible causes are:
      
      1. You are actually using an HTTP proxy, but setting HTTPS_PROXY variable
         to `https://address:port`. This is not correct, because `https://` prefix
         claims the proxy is an HTTPS proxy, while your proxy (v2ray, shadowsocksr
         , etc..) is an HTTP proxy. Try setting `http://address:port` to both
         HTTP_PROXY and HTTPS_PROXY instead.
      
      2. If you are using Windows, vcpkg will automatically use your Windows IE Proxy Settings
         set by your proxy software. See https://github.com/microsoft/vcpkg-tool/pull/77
         The value set by your proxy might be wrong, or have same `https://` prefix issue.
      
      3. Your proxy's remote server is out of service.
      
      If you've tried directly download the link, and believe this is not a temporary
      download server failure, please submit an issue at https://github.com/Microsoft/vcpkg/issues
      to report this upstream download server failure.
      

Call Stack (most recent call first):
  scripts/cmake/vcpkg_download_distfile.cmake:270 (z_vcpkg_download_distfile_show_proxy_and_fail)
  scripts/cmake/vcpkg_from_github.cmake:106 (vcpkg_download_distfile)
  ports/liblzma/portfile.cmake:1 (vcpkg_from_github)
  scripts/ports.cmake:175 (include)

[AaronRM]

Seeing this on other platforms too. Vcpkg is attempting to download a tarball from the xz Utils repo which was disabled due to a supply chain attack.

[AaronRM]

Primary discussion is at #37839

[rezzeted]

@AaronRM I can’t understand when the repository will be restored? Nowadays a lot of libraries depend on liblzma; they cannot be build.

[AaronRM]

@strelokndv Agree :) I'm not a vcpkg maintainer. I only commented and +1'ed as a project I maintain was similarly affected. You could ask the vcpkg maintainers on the main issue: #37839.

[rezzeted]

@AaronRM tnx for answer. I was search information about restore xz repos and can't find it. That's why I asked on you.
The only solution I could find was to use the bminor/xz mirror. As far as I can tell, this version still contains a vulnerability.

[Cheney-W]

Duplicate of #37893