[liblzma] x86-windows build failure

[kossiBlaise]

Operating system

Windows 10

Compiler

MSVC

Steps to reproduce the behavior

vcpkg install liblzma:x86-windows

Failure logs

Computing installation plan...
The following packages will be built and installed:
liblzma:x86-windows@5.4.4
Detecting compiler hash for triplet x86-windows...
Compiler found: C:/Program Files/Microsoft Visual Studio/2022/Community/VC/Tools/MSVC/14.39.33519/bin/Hostx64/x86/cl.exe
Restored 0 package(s) from P:\VCPKG-CACHE in 618 us. Use --debug to see more details.
Installing 1/1 liblzma:x86-windows@5.4.4...
Building liblzma:x86-windows@5.4.4...
-- Downloading https://github.com/tukaani-project/xz/archive/v5.4.4.tar.gz -> tukaani-project-xz-v5.4.4.tar.gz...
[DEBUG] To include the environment variables in debug output, pass --debug-env
[DEBUG] Disabling metrics because vcpkg.disable-metrics exists
[DEBUG] Trying to load bundleconfig from E:\vcpkg\vcpkg-bundle.json
[DEBUG] Failed to open: E:\vcpkg\vcpkg-bundle.json
[DEBUG] Bundle config: readonly=false, usegitregistry=false, embeddedsha=nullopt, deployment=Git, vsversion=nullopt
[DEBUG] Feature flag 'binarycaching' unset
[DEBUG] Feature flag 'compilertracking' unset
[DEBUG] Feature flag 'registries' unset
[DEBUG] Feature flag 'versions' unset
[DEBUG] Feature flag 'dependencygraph' unset
Downloading https://github.com/tukaani-project/xz/archive/v5.4.4.tar.gz
[DEBUG] Trying to hash E:\vcpkg\downloads\tukaani-project-xz-v5.4.4.tar.gz.18864.part
[DEBUG] E:\vcpkg\downloads\tukaani-project-xz-v5.4.4.tar.gz.18864.part has hash d2d585b46918264745e17a415f492e864bbdcb4bdc259525ef58a898047392a298f079f14665f988077b8a630b140bc54788472b2aa083cdffe9c318e78969a8
error: Failed to download from mirror set
error: File does not have the expected hash:
url: https://github.com/tukaani-project/xz/archive/v5.4.4.tar.gz
File: E:\vcpkg\downloads\tukaani-project-xz-v5.4.4.tar.gz.18864.part
Expected hash: c28461123562564e030f3f733f078bc4c840e87598d9f4b718d4bca639120d8133f969c45d7bdc62f33f081d789ec0f14a1791fb7da18515682bfe3c0c7362e0
Actual hash: d2d585b46918264745e17a415f492e864bbdcb4bdc259525ef58a898047392a298f079f14665f988077b8a630b140bc54788472b2aa083cdffe9c318e78969a8
[DEBUG] D:\a_work\1\s\src\vcpkg\base\downloads.cpp(1031):
[DEBUG] Time in subprocesses: 0us
[DEBUG] Time in parsing JSON: 4us
[DEBUG] Time in JSON reader: 0us
[DEBUG] Time in filesystem: 196us
[DEBUG] Time in loading ports: 0us
[DEBUG] Exiting after 588 ms (587645us)

CMake Error at scripts/cmake/vcpkg_download_distfile.cmake:32 (message):

  Failed to download file with error: 1
  If you are using a proxy, please check your proxy setting. Possible causes are:
  
  1. You are actually using an HTTP proxy, but setting HTTPS_PROXY variable
     to `https://address:port`. This is not correct, because `https://` prefix
     claims the proxy is an HTTPS proxy, while your proxy (v2ray, shadowsocksr
     , etc..) is an HTTP proxy. Try setting `http://address:port` to both
     HTTP_PROXY and HTTPS_PROXY instead.
  
  2. If you are using Windows, vcpkg will automatically use your Windows IE Proxy Settings
     set by your proxy software. See https://github.com/microsoft/vcpkg-tool/pull/77
     The value set by your proxy might be wrong, or have same `https://` prefix issue.
  
  3. Your proxy's remote server is out of service.
  
  If you've tried directly download the link, and believe this is not a temporary
  download server failure, please submit an issue at https://github.com/Microsoft/vcpkg/issues
  to report this upstream download server failure.

Call Stack (most recent call first):
scripts/cmake/vcpkg_download_distfile.cmake:270 (z_vcpkg_download_distfile_show_proxy_and_fail)
scripts/cmake/vcpkg_from_github.cmake:106 (vcpkg_download_distfile)
ports/liblzma/portfile.cmake:1 (vcpkg_from_github)
scripts/ports.cmake:175 (include)

error: building liblzma:x86-windows failed with: BUILD_FAILED
Elapsed time to handle liblzma:x86-windows: 695 ms
Please ensure you're using the latest port files with git pull and vcpkg update.
Then check for known issues at:
https://github.com/microsoft/vcpkg/issues?q=is%3Aissue+is%3Aopen+in%3Atitle+liblzma
You can submit a new issue at:
https://github.com/microsoft/vcpkg/issues/new?title=[liblzma]+Build+error+on+x86-windows&body=Copy+issue+body+from+E%3A%2Fvcpkg%2Finstalled%2Fvcpkg%2Fissue_body.md

Additional context

No response

[kossiBlaise]

Just performed git pull on Wed, April 02, 2024. Problem still exists.

[magni-mar]

I am also experiencing this, after a bit of googling I saw the repo has been disabled:

https://github.com/tukaani-project/xz

[SpiritDogstar]

What's the way forward here?

This is a cross-platform issue

[joamag]

I am also experiencing this, after a bit of googling I saw the repo has been disabled:

https://github.com/tukaani-project/xz

This is probably related to the CVE-2024-3094 incident https://jfrog.com/blog/xz-backdoor-attack-cve-2024-3094-all-you-need-to-know/

[SpiritDogstar]

is this a valid mirror to use?
https://github.com/xz-mirror/xz

[SpiritDogstar]

Current workaround for me was to disable lzma until this is figured out. I'm using boost iostreams, so needed to do this in my manifest vcpkg file.

    {
        "name": "boost-iostreams",
        "default-features": false,
        "features": ["bzip2", "zlib", "zstd"]
    },

[WangWeiLin-MV]

Duplicate of #37893