xz

tukaani-project活跃维护

XZ Utils 是提供 xz 压缩格式的命令行工具和 C 库,主打高压缩比,常用于打包发布和系统镜像压缩。

XZ Utils

v5.8.4发布于 2026-09-09 16:43 UTC1,716star +3 / 7 天280fork同步于 2026-11-10 23:47 UTC

怎么上手

由 README 提炼,执行前请确认
./autogen.sh
mkdir tmp-build && cd tmp-build
../configure --disable-shared --enable-debug --prefix=$PWD/inst
硬件要求按 README 说明

README 未说明具体硬件要求;仅提到 LZMA2 高压缩比模式会消耗大量 CPU 时间,并可能占用数百 MB 内存。

下载:源码 zip·GitHub Releases(安装包)本站不镜像安装包

项目说明

由 README 自动翻译提炼

通用数据压缩库加命令行工具,用 LZMA2 生成比 gzip 小约 30% 的 .xz 文件

XZ Utils 是提供 xz 压缩格式的命令行工具和 C 库,主打高压缩比,常用于打包发布和系统镜像压缩。

核心能力

  • 提供 liblzma 压缩库与 xz 命令行工具
  • 原生 .xz 格式,兼容旧 .lzma 格式
  • 主过滤器 LZMA2,典型文件比 gzip 小约 30%
  • 支持最多四层过滤器链,如 BCJ 前置提升可执行文件压缩率
  • 支持多线程压缩,暂不支持多线程解压

容易踩的坑

从 Git 仓库构建需先运行 ./autogen.sh 生成 Autotools 文件,tarball 不需要;高压缩比模式可能占用数百 MB 内存,需预留资源;目前只支持多线程压缩,解压仍是单线程。

内容由模型根据 README 生成,可能不完整或不准确,以官方文档为准。看原文 README

最近发版

5 个版本v5.8.4
  1. v5.8.4XZ Utils 5.8.4 (stable)最新正式版2026-09-09 · 2026-09-09 16:43 UTC

    IMPORTANT: This includes a fix for a security issue that affects all XZ Utils versions since 5.0.0. This and a few other fixes have also been committed to the old stable branches (v5.2, v5.4, and v5.6) in the xz Git repository. Those fixes are marked below. No new 5.2.x, 5.4.x, or 5.6.x releases will be made.

    5.8.4 (2026-09-09)
    
        * liblzma:
    
            - lzma_alone_decoder(), lzma_lzip_decoder(),
              lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
              invalid memory access after memory allocation has failed and
              the application reinitializes the existing decoder to decode
              a different file. This bug could at least result in a crash.
              This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
              (Also in v5.2, v5.4, and v5.6.)
    
            - lzma_stream_buffer_decode(): Fix wrong error code and,
              in debug builds, assertion failure. LZMA_BUF_ERROR could
              be returned with truncated inputs while LZMA_DATA_ERROR
              is the correct one in this function.
              (Also in v5.2, v5.4, and v5.6.)
    
            - Fix a performance issue in the typical use case of
              lzma_index_cat(). Internally liblzma calls it from
              lzma_file_info_decoder(), so that was affected too. The
              problem occurred if the input .xz file was created by
              concatenating a large number of .xz files. A crafted file
              could make "xz --list" very slow or effectively hang.
              Normal decompression doesn't use these functions and
              thus wasn't affected.
              (Also in v5.2, v5.4, and v5.6.)
    
            - Fix a theoretical integer overflow in lzma_index_cat().
              (Also in v5.2, v5.4, and v5.6.)
    
            - Fix bogus memory usage report in lzma_index_decoder() when
              the .xz Index is obviously invalid. A huge bogus value could
              cause an integer overflow in lzma_file_info_decoder()'s
              memory usage reporting due to a missing overflow check,
              making lzma_memused() report an incorrect tiny value. This
              bug didn't affect the memory usage limiter in these two
              decoders; only the reporting via lzma_memused() was affected.
              (Also in v5.2, v5.4, and v5.6.)
    
            - Fix a too low memory usage report in lzma_index_decoder()
              if lzma_memused() is called after a part of the Index has
              already been decoded. The typical use case is to call
              lzma_memused() immediately after LZMA_MEMLIMIT_ERROR,
              which did work correctly.
    
            - Fix copying of check type in lzma_index_dup(). Calling
              lzma_index_checks() on the duplicated lzma_index returned
              return garbage a result. lzma_index_dup() is rarely used;
              liblzma doesn't use it internally and xz itself doesn't use
              it either.
              (Also in v5.2, v5.4, and v5.6.)
    
            - lzma_file_info_decoder() and lzma_index_decoder(): Reject
              an obviously-invalid Number of Records field earlier.
              (Partially also in v5.2, v5.4, and v5.6.)
    
            - Fix a missing synchronization in the threaded .xz decoder. It
              could make lzma_get_progress() return incorrect progress info.
              (Also in v5.4 and v5.6.)
    
            - Detect certain kinds of corrupt inputs slightly earlier in
              the LZMA2 decoder.
    
            - ARM64 and LoongArch: Don't use aligned reads on unaligned
              buffers. This makes the code work on strict-align processors
              and fixes a sanitizer error in other cases. (Since 5.7.1alpha)
    
        * xz:
    
            - Fix a use-after-free when showing an error message if --files
              or --files0 was specified in the environment variables XZ_OPT
              or XZ_DEFAULTS.
              (Also in v5.2, v5.4, and v5.6.)
    
            - Fix a use-after-free bug when --verbose is use
    
  2. v5.8.3XZ Utils 5.8.3 (stable)2026-03-31 · 2026-03-31 16:43 UTC
    查看更新说明

    IMPORTANT: This includes a fix for CVE-2026-34743 which affects all XZ Utils versions since 5.0.0. No new 5.2.x, 5.4.x, or 5.6.x releases will be made, but the fix is in the v5.2, v5.4, and v5.6 branches in the xz Git repository.

    5.8.3 (2026-03-31)
    
        * liblzma:
    
            - Fix a buffer overflow in lzma_index_append(): If
              lzma_index_decoder() was used to decode an Index that
              contained no Records, the resulting lzma_index was left in
              a state where where a subsequent lzma_index_append() would
              allocate too little memory, and a buffer overflow would occur.
    
              The lzma_index functions are rarely used by applications
              directly. In the few applications that do use these functions,
              the combination of function calls required to trigger this bug
              are unlikely to exist, because there typically is no reason to
              append Records to a decoded lzma_index. Thus, it's likely that
              this bug cannot be triggered in any real-world application.
    
              The bug was reported and discovered by Cantina using their
              AppSec agent, Apex.
    
            - Fix the build on Windows ARM64EC.
    
            - Add "License: 0BSD" to liblzma.pc.
    
        * xz:
    
            - Fix invalid memory access in --files and --files0. All of
              the following must be true to trigger it:
    
                1. A string being read (which supposedly is a filename) is
                   at least SIZE_MAX / 2 bytes long. This size is plausible
                   on 32-bit platforms (2 GiB - 1 B).
    
                2. realloc(ptr, SIZE_MAX / 2 + 1) must succeed.
                   On glibc >= 2.30 it shouldn't because the value
                   exceeds PTRDIFF_MAX.
    
                3. An integer overflow results in a realloc(ptr, 0) call.
                   If it doesn't return NULL, then invalid memory access
                   will occur.
    
            - On QNX, don't use fsync() on directories because it fails.
    
        * Autotools: Enable 32-bit x86 assembler on Hurd by default.
          It was already enabled in the CMake-based build.
    
        * Translations: Add Arabic man page translations.
    
  3. v5.8.2XZ Utils 5.8.2 (stable)2025-12-17 · 2025-12-17 14:16 UTC
    查看更新说明
    5.8.2 (2025-12-17)
    
        * liblzma:
    
            - Fix the build on ARM64 on glibc versions older than
              2.24 (2016). They don't have HWCAP_CRC32 in <sys/auxv.h>.
    
            - Disable CLMUL CRC code when building for 32-bit x86 with
              old MSVC versions. This avoids a compiler bug. The exact
              compiler version in which the issue was fixed is unknown,
              but VS 2022 17.13 (MSVC 19.43.34808) is known to work, so
              CLMUL CRC on 32-bit x86 is disabled with MSVC versions
              older than that.
    
        * xz:
    
            - Add a workaround for Red Hat Enterprise Linux 9 kernel bug
              which made xz fail with "xz: Failed to enable the sandbox".
              It only occurs with xz 5.8.0 and 5.8.1 binaries built for
              other distros. For example, running Debian 13 in a container
              on RHEL/CentOS 9 would trigger the issue.
    
              The bug was introduced in RHEL 9 kernel 5.14.0-603.el9
              (2025-07-30) and fixed in 5.14.0-648.el9 (2025-12-05).
              However, as of writing, the fixed kernel isn't available
              to RHEL 9 users yet, so including the workaround in this
              xz release seems reasonable. The workaround will be removed
              when it's no longer needed.
    
              xzdec was also affected by this issue.
    
            - On AIX, don't use fsync() on directories because it fails.
    
            - Fix the build on Emscripten.
    
            - Fix the build on clang-cl on Windows.
    
            - Take resource limits (RLIMIT_DATA, RLIMIT_AS, and RLIMIT_VMEM)
              into account when determining the default memory usage limit
              for multithreaded mode. This should prevent xz from failing
              when a resource limit has been set to a value that is less
              than 1/4 of total RAM. Other memory limits can still trigger
              the same issue, for example, Linux cgroup v2 memory.max.
    
        * Build systems:
    
            - When symbol versioning is enabled, pass --undefined-version
              to the linker if the option is supported. This fixes the
              build when using LLVM's lld and some liblzma features have
              been disabled at build time.
    
            - ARM64: Fix autodetection of fast unaligned memory access when
              using GCC and -mstrict-align is in effect. Previously the
              build systems would incorrectly guess that unaligned access
              is fast, which would result in much slower binaries than
              needed. The fix is a workaround for GCC bug 111555;
              autodetection already worked with Clang.
    
            - LoongArch: Autodetect if fast unaligned memory access is
              supported. This can improve compression speed by 15 % (but
              not decompression speed).
    
        * Translations:
    
            - Update the Spanish translation.
    
            - Add Swedish man page translations.
    
            - Update Italian, Korean, Romanian, Serbian, and Ukrainian
              man page translations.
    
  4. v5.8.1XZ Utils 5.8.1 (stable)2025-04-03 · 2025-04-03 15:04 UTC
    查看更新说明

    IMPORTANT: This includes a security fix for CVE-2025-31115 which affects XZ Utils from 5.3.3alpha to 5.8.0. See the security advisory for details.

    5.8.1 (2025-04-03)
    
        * Multithreaded .xz decoder (lzma_stream_decoder_mt()):
    
            - Fix a bug that could at least result in a crash with
              invalid input. (CVE-2025-31115)
    
            - Fix a performance bug: Only one thread was used if the whole
              input file was provided at once to lzma_code(), the output
              buffer was big enough, timeout was disabled, and LZMA_FINISH
              was used. There are no bug reports about this, thus it's
              possible that no real-world application was affected.
    
        * Avoid <stdalign.h> even with C11/C17 compilers. This fixes the
          build with Oracle Developer Studio 12.6 on Solaris 10 when the
          compiler is in C11 mode (the header doesn't exist).
    
        * Autotools: Restore compatibility with GNU make versions older
          than 4.0 by creating the package using GNU gettext 0.23.1
          infrastructure instead of 0.24.
    
        * Update Croatian translation.
    
  5. v5.8.0XZ Utils 5.8.0 (stable)2025-03-25 · 2025-03-25 17:42 UTC
    查看更新说明
    5.8.0 (2025-03-25)
    
        This bumps the minor version of liblzma because new features were
        added. The API and ABI are still backward compatible with liblzma
        5.6.x, 5.4.x, 5.2.x, and 5.0.x.
    
        * liblzma on 32/64-bit x86: When possible, use SSE2 intrinsics
          instead of memcpy() in the LZMA/LZMA2 decoder. In typical cases,
          this may reduce decompression time by 0-5 %. However, when built
          against musl libc, over 15 % time reduction was observed with
          highly compressed files.
    
        * CMake: Make the feature test macros match the Autotools-based
          build on NetBSD, Darwin, and mingw-w64.
    
        * Update the Croatian, Italian, Portuguese, and Romanian
          translations.
    
        * Update the German, Italian, Korean, Romanian, Serbian, and
          Ukrainian man page translations.
    
        Summary of changes in the 5.7.x development releases:
    
        * Mark the following LZMA Utils script aliases as deprecated:
          lzcmp, lzdiff, lzless, lzmore, lzgrep, lzegrep, and lzfgrep.
    
        * liblzma:
    
            - Improve LZMA/LZMA2 encoder speed on 64-bit PowerPC (both
              endiannesses) and those 64-bit RISC-V processors that
              support fast unaligned access.
    
            - Add low-level APIs for RISC-V, ARM64, and x86 BCJ filters
              to lzma/bcj.h. These are primarily for erofs-utils.
    
            - x86/x86-64/E2K CLMUL CRC code was rewritten.
    
            - Use the CRC32 instructions on LoongArch.
    
        * xz:
    
            - Synchronize the output file and its directory using fsync()
              before deleting the input file. No syncing is done when xz
              isn't going to delete the input file.
    
            - Add --no-sync to disable the sync-before-delete behavior.
    
            - Make --single-stream imply --keep.
    
        * xz, xzdec, lzmainfo: When printing messages, replace
          non-printable characters with question marks.
    
        * xz and xzdec on Linux: Support Landlock ABI versions 5 and 6.
    
        * CMake: Revise the configuration variables and some of their
          options, and document them in the file INSTALL. CMake support
          is no longer experimental. (It was already not experimental
          when building for native Windows.)
    
        * Add build-aux/license-check.sh.
    

用户点评

登录用户的真实使用记录,可按版本和硬件筛选
共 0 条

    还没有人点评。第一个说出真实体验的人最有价值。

    README 原文

    未翻译

    XZ Utils

    0. Overview
    1. Documentation
       1.1. Overall documentation
       1.2. Documentation for command-line tools
       1.3. Documentation for liblzma
    2. Version numbering
    3. Reporting bugs
    4. Translations
       4.1. Testing translations
    5. Other implementations of the .xz format
    6. Contact information
    

    0. Overview

    XZ Utils provide a general-purpose data-compression library plus
    command-line tools. The native file format is the .xz format, but
    also the legacy .lzma format is supported. The .xz format supports
    multiple compression algorithms, which are called "filters" in the
    context of XZ Utils. The primary filter is currently LZMA2. With
    typical files, XZ Utils create about 30 % smaller files than gzip.
    
    To ease adapting support for the .xz format into existing applications
    and scripts, the API of liblzma is somewhat similar to the API of the
    popular zlib library. For the same reason, the command-line tool xz
    has a command-line syntax similar to that of gzip.
    
    When aiming for the highest compression ratio, the LZMA2 encoder uses
    a lot of CPU time and may use, depending on the settings, even
    hundreds of megabytes of RAM. However, in fast modes, the LZMA2 encoder
    competes with bzip2 in compression speed, RAM usage, and compression
    ratio.
    
    LZMA2 is reasonably fast to decompress. It is a little slower than
    gzip, but a lot faster than bzip2. Being fast to decompress means
    that the .xz format is especially nice when the same file will be
    decompressed very many times (usually on different computers), which
    is the case e.g. when distributing software packages. In such
    situations, it's not too bad if the compression takes some time,
    since that needs to be done only once to benefit many people.
    
    With some file types, combining (or "chaining") LZMA2 with an
    additional filter can improve the compression ratio. A filter chain may
    contain up to four filters, although usually only one or two are used.
    For example, putting a BCJ (Branch/Call/Jump) filter before LZMA2
    in the filter chain can improve compression ratio of executable files.
    
    Since the .xz format allows adding new filter IDs, it is possible that
    some day there will be a filter that is, for example, much faster to
    compress than LZMA2 (but probably with worse compression ratio).
    Similarly, it is possible that some day there is a filter that will
    compress better than LZMA2.
    
    XZ Utils supports multithreaded compression. XZ Utils doesn't support
    multithreaded decompression yet. It has been planned though and taken
    into account when designing the .xz file format. In the future, files
    that were created in threaded mode can be decompressed in threaded
    mode too.
    
    1. Documentation

    1.1. Overall documentation

    README                This file
    
    INSTALL.generic       Generic install instructions for those not
                          familiar with packages using GNU Autotools
    INSTALL               Installation instructions specific to XZ Utils
    PACKAGERS             Information to packagers of XZ Utils
    
    COPYING               XZ Utils copyright and license information
    COPYING.0BSD          BSD Zero Clause License
    COPYING.GPLv2         GNU General Public License version 2
    COPYING.GPLv3         GNU General Public License version 3
    COPYING.LGPLv2.1      GNU Lesser General Public License version 2.1
    
    AUTHORS               The main authors of XZ Utils
    THANKS                Incomplete list of people who have helped making
                          this software
    NEWS                  User-visible changes between XZ Utils releases
    ChangeLog             Detailed list of changes (commit log)
    TODO                  Known bugs and some sort of to-do list
    
    Note that only some of the above files are included in binary
    packages.
    

    1.2. Documentation for command-line tools

    The command-line tools are documented as man pages. In source code
    releases (and possibly also in some binary packages), the man pages
    are also provided in plain text (ASCII only) format in the directory
    "doc/man" to make the man pages more accessible to those whose
    operating system doesn't provide an easy way to view man pages.
    

    1.3. Documentation for liblzma

    The liblzma API headers include short docs about each function
    and data type as Doxygen tags. These docs should be quite OK as
    a quick reference.
    
    There are a few example/tutorial programs that should help in
    getting started with liblzma. In the source package the examples
    are in "doc/examples" and in binary packages they may be under
    "examples" in the same directory as this README.
    
    Since the liblzma API has similarities to the zlib API, some people
    may find it useful to read the zlib docs and tutorial too:
    
        https://zlib.net/manual.html
        https://zlib.net/zlib_how.html
    

    2. Version numbering

    The version number format of XZ Utils is X.Y.ZS:
    
      - X is the major version. When this is incremented, the library
        API and ABI break.
    
      - Y is the minor version. It is incremented when new features
        are added without breaking the existing API or ABI. An even Y
        indicates a stable release and an odd Y indicates unstable
        (alpha or beta version).
    
      - Z is the revision. This has a different meaning for stable and
        unstable releases:
    
          * Stable: Z is incremented when bugs get fixed without adding
            any new features. This is intended to be convenient for
            downstream distributors that want bug fixes but don't want
            any new features to minimize the risk of introducing new bugs.
    
          * Unstable: Z is just a counter. API or ABI of features added
            in earlier unstable releases having the same X.Y may break.
    
      - S indicates stability of the release. It is missing from the
        stable releases, where Y is an even number. When Y is odd, S
        is either "alpha" or "beta" to make it very clear that such
        versions are not stable releases. The same X.Y.Z combination is
        not used for more than one stability level, i.e. after X.Y.Zalpha,
        the next version can be X.Y.(Z+1)beta but not X.Y.Zbeta.
    

    3. Reporting bugs

    Naturally it is easiest for me if you already know what causes the
    unexpected behavior. Even better if you have a patch to propose.
    However, quite often the reason for unexpected behavior is unknown,
    so here are a few things to do before sending a bug report:
    
      1. Try to create a small example how to reproduce the issue.
    
      2. Compile XZ Utils with debugging code using configure switches
         --enable-debug and, if possible, --disable-shared. If you are
         using GCC, use CFLAGS='-O0 -ggdb3'. Don't strip the resulting
         binaries.
    
      3. Turn on core dumps. The exact command depends on your shell;
         for example in GNU bash it is done with "ulimit -c unlimited",
         and in tcsh with "limit coredumpsize unlimited".
    
      4. Try to reproduce the suspected bug. If you get "assertion failed"
         message, be sure to include the complete message in your bug
         report. If the application leaves a coredump, get a backtrace
         using gdb:
           $ gdb /path/to/app-binary   # Load the app to the debugger.
           (gdb) core core   # Open the coredump.
           (gdb) bt   # Print the backtrace. Copy & paste to bug report.
           (gdb) quit   # Quit gdb.
    
    Report your bug via email or IRC (see Contact information below).
    Don't send core dump files or any executables. If you have a small
    example file(s) (total size less than 256 KiB), please include
    it/them as an attachment. If you have bigger test files, put them
    online somewhere and include a URL to the file(s) in the bug report.
    
    Always include the exact version number of XZ Utils in the bug report.
    If you are using a snapshot from the git repository, use "git describe"
    to get the exact snapshot version. If you are using XZ Utils shipped
    in an operating system distribution, mention the distribution name,
    distribution version, and exact xz package version; if you cannot
    repeat the bug with the code compiled from unpatched source code,
    you probably need to report a bug to your distribution's bug tracking
    system.
    

    4. Translations

    The xz command line tool and all man pages can be translated.
    The translations are handled via the Translation Project. If you
    wish to help translating xz, please join the Translation Project:
    
        https://translationproject.org/html/translators.html
    
    Updates to translations won't be accepted by methods that bypass
    the Translation Project because there is a risk of duplicate work:
    translation updates made in the xz repository aren't seen by the
    translators in the Translation Project. If you have found bugs in
    a translation, please report them to the Language-Team address
    which can be found near the beginning of the PO file.
    
    If you find language problems in the original English strings,
    feel free to suggest improvements. Ask if something is unclear.
    

    4.1. Testing translations

    Testing can be done by installing xz into a temporary directory.
    
    If building from Git repository (not tarball), generate the
    Autotools files:
    
        ./autogen.sh
    
    Create a subdirectory for the build files. The tmp-build directory
    can be deleted after testing.
    
        mkdir tmp-build
        cd tmp-build
        ../configure --disable-shared --enable-debug --prefix=$PWD/inst
    
    Edit the .po file in the po directory. Then build and install to
    the "tmp-build/inst" directory, and use translations.bash to see
    how some of the messages look. Repeat these  steps if needed:
    
        make -C po update-po
        make -j"$(nproc)" install
        bash ../debug/translation.bash | less
        bash ../debug/translation.bash | less -S  # For --list outputs
    
    To test other languages, set the LANGUAGE environment variable
    before running translations.bash. The value should match the PO file
    name without the .po suffix. Example:
    
        export LANGUAGE=fi
    

    5. Other implementations of the .xz format

    7-Zip and the p7zip port of 7-Zip support the .xz format starting
    from the version 9.00alpha.
    
        https://7-zip.org/
        https://p7zip.sourceforge.net/
    
    XZ Embedded is a limited implementation written for use in the Linux
    kernel, but it is also suitable for other embedded use.
    
        https://tukaani.org/xz/embedded.html
    
    XZ for Java is a complete implementation written in pure Java.
    
        https://tukaani.org/xz/java.html
    

    6. Contact information

    XZ Utils in general:
      - Home page: https://tukaani.org/xz/
      - Email to maintainer(s): [email protected]
      - IRC: #tukaani on Libera Chat
      - GitHub: https://github.com/tukaani-project/xz
    
    Lead maintainer:
      - Email: Lasse Collin <[email protected]>
      - IRC: Larhzu on Libera Chat