Pack VS libarchive

The `pack`[0] compression utility that reached the HN front page the other day[1] is setting off my alarm bells right now. (It was at the time too, but now doubly so)

It's written in Pascal, and the only (semi-)documented way to build it yourself is to use a graphical IDE, and pull in pre-compiled library binaries (stored in the git repo of a dependency which afaict Pack is the only dependent of - appears to be maintained by the same pseudonymous author but from a different account).

I've opened an issue[2] outlining my concerns. I'm certainly not accusing them of having backdoored binaries, but if I was setting up a project to be deliberately backdoorable, it'd look a lot like this.

[0] https://pack.ac/

[1] https://news.ycombinator.com/item?id=39793805

[2] https://github.com/PackOrganization/Pack/issues/10

29. October 2021 At this point Jia Tan pops up, and the first thing we see from him is an innocuous patch to the xz repository, and while a lot of people believe he started out trying his luck with another library also known as libarchive, this is not the case, I would bet it’s more of a backup looking at the dates, being that there are a few days in between as shown in this commit.

Potentially malicious commit by same author on libarchive: https://github.com/libarchive/libarchive/pull/1609

Full agreement, and with the addition of xpk¹/xfd² as natural extensions to that extensibility too. I see things like xfd supporting xz¹, and I'm simultaneously amazed that it exists and happy that I don't need to do xz {,de}compression on 68k ;)

I guess we have something similar-ish with libarchive⁴, but nobody(including me) has pushed the extra mile to get file dialogs to support random compression and decompression formats.

Beyond OT: I didn't realise how much stuff was still going on at aminet, but I love love LOVE that people are still dropping new car sets for Geoff Crammond's F1GP.

¹ http://aminet.net/package/util/pack/xpk_User

² http://aminet.net/package/util/pack/xfdmaster

³ http://aminet.net/package/util/pack/xfd_lzma.lha

⁴ https://www.libarchive.org/

I don't have a preview channel install handy to check, but apparently they're using libarchive so here's the full list assuming they expose everything it supports:

https://github.com/libarchive/libarchive/wiki/LibarchiveForm...

As announced at the Build conference back in May, this build adds native support for reading additional archive file formats using the libarchive open-source project such as

LibarchiveFormats · libarchive/libarchive Wiki · GitHub

Seems what they're using is BSD-liscensed: https://github.com/libarchive/libarchive/wiki