从 Git 仓库构建需先运行 ./autogen.sh 生成 Autotools 文件,tarball 不需要;高压缩比模式可能占用数百 MB 内存,需预留资源;目前只支持多线程压缩,解压仍是单线程。
./autogen.sh
mkdir tmp-build && cd tmp-build
../configure --disable-shared --enable-debug --prefix=$PWD/instREADME 未说明具体硬件要求;仅提到 LZMA2 高压缩比模式会消耗大量 CPU 时间,并可能占用数百 MB 内存。
通用数据压缩库加命令行工具,用 LZMA2 生成比 gzip 小约 30% 的 .xz 文件
XZ Utils 是提供 xz 压缩格式的命令行工具和 C 库,主打高压缩比,常用于打包发布和系统镜像压缩。
核心能力
- 提供 liblzma 压缩库与 xz 命令行工具
- 原生 .xz 格式,兼容旧 .lzma 格式
- 主过滤器 LZMA2,典型文件比 gzip 小约 30%
- 支持最多四层过滤器链,如 BCJ 前置提升可执行文件压缩率
- 支持多线程压缩,暂不支持多线程解压
容易踩的坑
- v5.8.4XZ Utils 5.8.4 (stable)最新正式版2026-09-09 · 2026-09-09 16:43 UTC
IMPORTANT: This includes a fix for a security issue that affects all XZ Utils versions since 5.0.0. This and a few other fixes have also been committed to the old stable branches (v5.2, v5.4, and v5.6) in the xz Git repository. Those fixes are marked below. No new 5.2.x, 5.4.x, or 5.6.x releases will be made.
5.8.4 (2026-09-09) * liblzma: - lzma_alone_decoder(), lzma_lzip_decoder(), lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an invalid memory access after memory allocation has failed and the application reinitializes the existing decoder to decode a different file. This bug could at least result in a crash. This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending. (Also in v5.2, v5.4, and v5.6.) - lzma_stream_buffer_decode(): Fix wrong error code and, in debug builds, assertion failure. LZMA_BUF_ERROR could be returned with truncated inputs while LZMA_DATA_ERROR is the correct one in this function. (Also in v5.2, v5.4, and v5.6.) - Fix a performance issue in the typical use case of lzma_index_cat(). Internally liblzma calls it from lzma_file_info_decoder(), so that was affected too. The problem occurred if the input .xz file was created by concatenating a large number of .xz files. A crafted file could make "xz --list" very slow or effectively hang. Normal decompression doesn't use these functions and thus wasn't affected. (Also in v5.2, v5.4, and v5.6.) - Fix a theoretical integer overflow in lzma_index_cat(). (Also in v5.2, v5.4, and v5.6.) - Fix bogus memory usage report in lzma_index_decoder() when the .xz Index is obviously invalid. A huge bogus value could cause an integer overflow in lzma_file_info_decoder()'s memory usage reporting due to a missing overflow check, making lzma_memused() report an incorrect tiny value. This bug didn't affect the memory usage limiter in these two decoders; only the reporting via lzma_memused() was affected. (Also in v5.2, v5.4, and v5.6.) - Fix a too low memory usage report in lzma_index_decoder() if lzma_memused() is called after a part of the Index has already been decoded. The typical use case is to call lzma_memused() immediately after LZMA_MEMLIMIT_ERROR, which did work correctly. - Fix copying of check type in lzma_index_dup(). Calling lzma_index_checks() on the duplicated lzma_index returned return garbage a result. lzma_index_dup() is rarely used; liblzma doesn't use it internally and xz itself doesn't use it either. (Also in v5.2, v5.4, and v5.6.) - lzma_file_info_decoder() and lzma_index_decoder(): Reject an obviously-invalid Number of Records field earlier. (Partially also in v5.2, v5.4, and v5.6.) - Fix a missing synchronization in the threaded .xz decoder. It could make lzma_get_progress() return incorrect progress info. (Also in v5.4 and v5.6.) - Detect certain kinds of corrupt inputs slightly earlier in the LZMA2 decoder. - ARM64 and LoongArch: Don't use aligned reads on unaligned buffers. This makes the code work on strict-align processors and fixes a sanitizer error in other cases. (Since 5.7.1alpha) * xz: - Fix a use-after-free when showing an error message if --files or --files0 was specified in the environment variables XZ_OPT or XZ_DEFAULTS. (Also in v5.2, v5.4, and v5.6.) - Fix a use-after-free bug when --verbose is use - v5.8.3XZ Utils 5.8.3 (stable)2026-03-31 · 2026-03-31 16:43 UTC
查看更新说明
IMPORTANT: This includes a fix for CVE-2026-34743 which affects all XZ Utils versions since 5.0.0. No new 5.2.x, 5.4.x, or 5.6.x releases will be made, but the fix is in the v5.2, v5.4, and v5.6 branches in the xz Git repository.
5.8.3 (2026-03-31) * liblzma: - Fix a buffer overflow in lzma_index_append(): If lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. The lzma_index functions are rarely used by applications directly. In the few applications that do use these functions, the combination of function calls required to trigger this bug are unlikely to exist, because there typically is no reason to append Records to a decoded lzma_index. Thus, it's likely that this bug cannot be triggered in any real-world application. The bug was reported and discovered by Cantina using their AppSec agent, Apex. - Fix the build on Windows ARM64EC. - Add "License: 0BSD" to liblzma.pc. * xz: - Fix invalid memory access in --files and --files0. All of the following must be true to trigger it: 1. A string being read (which supposedly is a filename) is at least SIZE_MAX / 2 bytes long. This size is plausible on 32-bit platforms (2 GiB - 1 B). 2. realloc(ptr, SIZE_MAX / 2 + 1) must succeed. On glibc >= 2.30 it shouldn't because the value exceeds PTRDIFF_MAX. 3. An integer overflow results in a realloc(ptr, 0) call. If it doesn't return NULL, then invalid memory access will occur. - On QNX, don't use fsync() on directories because it fails. * Autotools: Enable 32-bit x86 assembler on Hurd by default. It was already enabled in the CMake-based build. * Translations: Add Arabic man page translations. - v5.8.2XZ Utils 5.8.2 (stable)2025-12-17 · 2025-12-17 14:16 UTC
查看更新说明
5.8.2 (2025-12-17) * liblzma: - Fix the build on ARM64 on glibc versions older than 2.24 (2016). They don't have HWCAP_CRC32 in <sys/auxv.h>. - Disable CLMUL CRC code when building for 32-bit x86 with old MSVC versions. This avoids a compiler bug. The exact compiler version in which the issue was fixed is unknown, but VS 2022 17.13 (MSVC 19.43.34808) is known to work, so CLMUL CRC on 32-bit x86 is disabled with MSVC versions older than that. * xz: - Add a workaround for Red Hat Enterprise Linux 9 kernel bug which made xz fail with "xz: Failed to enable the sandbox". It only occurs with xz 5.8.0 and 5.8.1 binaries built for other distros. For example, running Debian 13 in a container on RHEL/CentOS 9 would trigger the issue. The bug was introduced in RHEL 9 kernel 5.14.0-603.el9 (2025-07-30) and fixed in 5.14.0-648.el9 (2025-12-05). However, as of writing, the fixed kernel isn't available to RHEL 9 users yet, so including the workaround in this xz release seems reasonable. The workaround will be removed when it's no longer needed. xzdec was also affected by this issue. - On AIX, don't use fsync() on directories because it fails. - Fix the build on Emscripten. - Fix the build on clang-cl on Windows. - Take resource limits (RLIMIT_DATA, RLIMIT_AS, and RLIMIT_VMEM) into account when determining the default memory usage limit for multithreaded mode. This should prevent xz from failing when a resource limit has been set to a value that is less than 1/4 of total RAM. Other memory limits can still trigger the same issue, for example, Linux cgroup v2 memory.max. * Build systems: - When symbol versioning is enabled, pass --undefined-version to the linker if the option is supported. This fixes the build when using LLVM's lld and some liblzma features have been disabled at build time. - ARM64: Fix autodetection of fast unaligned memory access when using GCC and -mstrict-align is in effect. Previously the build systems would incorrectly guess that unaligned access is fast, which would result in much slower binaries than needed. The fix is a workaround for GCC bug 111555; autodetection already worked with Clang. - LoongArch: Autodetect if fast unaligned memory access is supported. This can improve compression speed by 15 % (but not decompression speed). * Translations: - Update the Spanish translation. - Add Swedish man page translations. - Update Italian, Korean, Romanian, Serbian, and Ukrainian man page translations. - v5.8.1XZ Utils 5.8.1 (stable)2025-04-03 · 2025-04-03 15:04 UTC
查看更新说明
IMPORTANT: This includes a security fix for CVE-2025-31115 which affects XZ Utils from 5.3.3alpha to 5.8.0. See the security advisory for details.
5.8.1 (2025-04-03) * Multithreaded .xz decoder (lzma_stream_decoder_mt()): - Fix a bug that could at least result in a crash with invalid input. (CVE-2025-31115) - Fix a performance bug: Only one thread was used if the whole input file was provided at once to lzma_code(), the output buffer was big enough, timeout was disabled, and LZMA_FINISH was used. There are no bug reports about this, thus it's possible that no real-world application was affected. * Avoid <stdalign.h> even with C11/C17 compilers. This fixes the build with Oracle Developer Studio 12.6 on Solaris 10 when the compiler is in C11 mode (the header doesn't exist). * Autotools: Restore compatibility with GNU make versions older than 4.0 by creating the package using GNU gettext 0.23.1 infrastructure instead of 0.24. * Update Croatian translation. - v5.8.0XZ Utils 5.8.0 (stable)2025-03-25 · 2025-03-25 17:42 UTC
查看更新说明
5.8.0 (2025-03-25) This bumps the minor version of liblzma because new features were added. The API and ABI are still backward compatible with liblzma 5.6.x, 5.4.x, 5.2.x, and 5.0.x. * liblzma on 32/64-bit x86: When possible, use SSE2 intrinsics instead of memcpy() in the LZMA/LZMA2 decoder. In typical cases, this may reduce decompression time by 0-5 %. However, when built against musl libc, over 15 % time reduction was observed with highly compressed files. * CMake: Make the feature test macros match the Autotools-based build on NetBSD, Darwin, and mingw-w64. * Update the Croatian, Italian, Portuguese, and Romanian translations. * Update the German, Italian, Korean, Romanian, Serbian, and Ukrainian man page translations. Summary of changes in the 5.7.x development releases: * Mark the following LZMA Utils script aliases as deprecated: lzcmp, lzdiff, lzless, lzmore, lzgrep, lzegrep, and lzfgrep. * liblzma: - Improve LZMA/LZMA2 encoder speed on 64-bit PowerPC (both endiannesses) and those 64-bit RISC-V processors that support fast unaligned access. - Add low-level APIs for RISC-V, ARM64, and x86 BCJ filters to lzma/bcj.h. These are primarily for erofs-utils. - x86/x86-64/E2K CLMUL CRC code was rewritten. - Use the CRC32 instructions on LoongArch. * xz: - Synchronize the output file and its directory using fsync() before deleting the input file. No syncing is done when xz isn't going to delete the input file. - Add --no-sync to disable the sync-before-delete behavior. - Make --single-stream imply --keep. * xz, xzdec, lzmainfo: When printing messages, replace non-printable characters with question marks. * xz and xzdec on Linux: Support Landlock ABI versions 5 and 6. * CMake: Revise the configuration variables and some of their options, and document them in the file INSTALL. CMake support is no longer experimental. (It was already not experimental when building for native Windows.) * Add build-aux/license-check.sh.
用户点评
登录用户的真实使用记录,可按版本和硬件筛选还没有人点评。第一个说出真实体验的人最有价值。
XZ Utils
0. Overview
1. Documentation
1.1. Overall documentation
1.2. Documentation for command-line tools
1.3. Documentation for liblzma
2. Version numbering
3. Reporting bugs
4. Translations
4.1. Testing translations
5. Other implementations of the .xz format
6. Contact information
0. Overview
XZ Utils provide a general-purpose data-compression library plus
command-line tools. The native file format is the .xz format, but
also the legacy .lzma format is supported. The .xz format supports
multiple compression algorithms, which are called "filters" in the
context of XZ Utils. The primary filter is currently LZMA2. With
typical files, XZ Utils create about 30 % smaller files than gzip.
To ease adapting support for the .xz format into existing applications
and scripts, the API of liblzma is somewhat similar to the API of the
popular zlib library. For the same reason, the command-line tool xz
has a command-line syntax similar to that of gzip.
When aiming for the highest compression ratio, the LZMA2 encoder uses
a lot of CPU time and may use, depending on the settings, even
hundreds of megabytes of RAM. However, in fast modes, the LZMA2 encoder
competes with bzip2 in compression speed, RAM usage, and compression
ratio.
LZMA2 is reasonably fast to decompress. It is a little slower than
gzip, but a lot faster than bzip2. Being fast to decompress means
that the .xz format is especially nice when the same file will be
decompressed very many times (usually on different computers), which
is the case e.g. when distributing software packages. In such
situations, it's not too bad if the compression takes some time,
since that needs to be done only once to benefit many people.
With some file types, combining (or "chaining") LZMA2 with an
additional filter can improve the compression ratio. A filter chain may
contain up to four filters, although usually only one or two are used.
For example, putting a BCJ (Branch/Call/Jump) filter before LZMA2
in the filter chain can improve compression ratio of executable files.
Since the .xz format allows adding new filter IDs, it is possible that
some day there will be a filter that is, for example, much faster to
compress than LZMA2 (but probably with worse compression ratio).
Similarly, it is possible that some day there is a filter that will
compress better than LZMA2.
XZ Utils supports multithreaded compression. XZ Utils doesn't support
multithreaded decompression yet. It has been planned though and taken
into account when designing the .xz file format. In the future, files
that were created in threaded mode can be decompressed in threaded
mode too.
- Documentation
1.1. Overall documentation
README This file
INSTALL.generic Generic install instructions for those not
familiar with packages using GNU Autotools
INSTALL Installation instructions specific to XZ Utils
PACKAGERS Information to packagers of XZ Utils
COPYING XZ Utils copyright and license information
COPYING.0BSD BSD Zero Clause License
COPYING.GPLv2 GNU General Public License version 2
COPYING.GPLv3 GNU General Public License version 3
COPYING.LGPLv2.1 GNU Lesser General Public License version 2.1
AUTHORS The main authors of XZ Utils
THANKS Incomplete list of people who have helped making
this software
NEWS User-visible changes between XZ Utils releases
ChangeLog Detailed list of changes (commit log)
TODO Known bugs and some sort of to-do list
Note that only some of the above files are included in binary
packages.
1.2. Documentation for command-line tools
The command-line tools are documented as man pages. In source code
releases (and possibly also in some binary packages), the man pages
are also provided in plain text (ASCII only) format in the directory
"doc/man" to make the man pages more accessible to those whose
operating system doesn't provide an easy way to view man pages.
1.3. Documentation for liblzma
The liblzma API headers include short docs about each function
and data type as Doxygen tags. These docs should be quite OK as
a quick reference.
There are a few example/tutorial programs that should help in
getting started with liblzma. In the source package the examples
are in "doc/examples" and in binary packages they may be under
"examples" in the same directory as this README.
Since the liblzma API has similarities to the zlib API, some people
may find it useful to read the zlib docs and tutorial too:
https://zlib.net/manual.html
https://zlib.net/zlib_how.html
2. Version numbering
The version number format of XZ Utils is X.Y.ZS:
- X is the major version. When this is incremented, the library
API and ABI break.
- Y is the minor version. It is incremented when new features
are added without breaking the existing API or ABI. An even Y
indicates a stable release and an odd Y indicates unstable
(alpha or beta version).
- Z is the revision. This has a different meaning for stable and
unstable releases:
* Stable: Z is incremented when bugs get fixed without adding
any new features. This is intended to be convenient for
downstream distributors that want bug fixes but don't want
any new features to minimize the risk of introducing new bugs.
* Unstable: Z is just a counter. API or ABI of features added
in earlier unstable releases having the same X.Y may break.
- S indicates stability of the release. It is missing from the
stable releases, where Y is an even number. When Y is odd, S
is either "alpha" or "beta" to make it very clear that such
versions are not stable releases. The same X.Y.Z combination is
not used for more than one stability level, i.e. after X.Y.Zalpha,
the next version can be X.Y.(Z+1)beta but not X.Y.Zbeta.
3. Reporting bugs
Naturally it is easiest for me if you already know what causes the
unexpected behavior. Even better if you have a patch to propose.
However, quite often the reason for unexpected behavior is unknown,
so here are a few things to do before sending a bug report:
1. Try to create a small example how to reproduce the issue.
2. Compile XZ Utils with debugging code using configure switches
--enable-debug and, if possible, --disable-shared. If you are
using GCC, use CFLAGS='-O0 -ggdb3'. Don't strip the resulting
binaries.
3. Turn on core dumps. The exact command depends on your shell;
for example in GNU bash it is done with "ulimit -c unlimited",
and in tcsh with "limit coredumpsize unlimited".
4. Try to reproduce the suspected bug. If you get "assertion failed"
message, be sure to include the complete message in your bug
report. If the application leaves a coredump, get a backtrace
using gdb:
$ gdb /path/to/app-binary # Load the app to the debugger.
(gdb) core core # Open the coredump.
(gdb) bt # Print the backtrace. Copy & paste to bug report.
(gdb) quit # Quit gdb.
Report your bug via email or IRC (see Contact information below).
Don't send core dump files or any executables. If you have a small
example file(s) (total size less than 256 KiB), please include
it/them as an attachment. If you have bigger test files, put them
online somewhere and include a URL to the file(s) in the bug report.
Always include the exact version number of XZ Utils in the bug report.
If you are using a snapshot from the git repository, use "git describe"
to get the exact snapshot version. If you are using XZ Utils shipped
in an operating system distribution, mention the distribution name,
distribution version, and exact xz package version; if you cannot
repeat the bug with the code compiled from unpatched source code,
you probably need to report a bug to your distribution's bug tracking
system.
4. Translations
The xz command line tool and all man pages can be translated.
The translations are handled via the Translation Project. If you
wish to help translating xz, please join the Translation Project:
https://translationproject.org/html/translators.html
Updates to translations won't be accepted by methods that bypass
the Translation Project because there is a risk of duplicate work:
translation updates made in the xz repository aren't seen by the
translators in the Translation Project. If you have found bugs in
a translation, please report them to the Language-Team address
which can be found near the beginning of the PO file.
If you find language problems in the original English strings,
feel free to suggest improvements. Ask if something is unclear.
4.1. Testing translations
Testing can be done by installing xz into a temporary directory.
If building from Git repository (not tarball), generate the
Autotools files:
./autogen.sh
Create a subdirectory for the build files. The tmp-build directory
can be deleted after testing.
mkdir tmp-build
cd tmp-build
../configure --disable-shared --enable-debug --prefix=$PWD/inst
Edit the .po file in the po directory. Then build and install to
the "tmp-build/inst" directory, and use translations.bash to see
how some of the messages look. Repeat these steps if needed:
make -C po update-po
make -j"$(nproc)" install
bash ../debug/translation.bash | less
bash ../debug/translation.bash | less -S # For --list outputs
To test other languages, set the LANGUAGE environment variable
before running translations.bash. The value should match the PO file
name without the .po suffix. Example:
export LANGUAGE=fi
5. Other implementations of the .xz format
7-Zip and the p7zip port of 7-Zip support the .xz format starting
from the version 9.00alpha.
https://7-zip.org/
https://p7zip.sourceforge.net/
XZ Embedded is a limited implementation written for use in the Linux
kernel, but it is also suitable for other embedded use.
https://tukaani.org/xz/embedded.html
XZ for Java is a complete implementation written in pure Java.
https://tukaani.org/xz/java.html
6. Contact information
XZ Utils in general:
- Home page: https://tukaani.org/xz/
- Email to maintainer(s): [email protected]
- IRC: #tukaani on Libera Chat
- GitHub: https://github.com/tukaani-project/xz
Lead maintainer:
- Email: Lasse Collin <[email protected]>
- IRC: Larhzu on Libera Chat