[liblzma] x86-windows build failure about vcpkg

[SpiritDogstar]

is this a valid mirror to use?
https://github.com/xz-mirror/xz

[kossiBlaise]

Just performed git pull on Wed, April 02, 2024. Problem still exists.

[magni-mar]

I am also experiencing this, after a bit of googling I saw the repo has been disabled:

https://github.com/tukaani-project/xz

[SpiritDogstar]

What's the way forward here?

This is a cross-platform issue

[joamag]

I am also experiencing this, after a bit of googling I saw the repo has been disabled:

https://github.com/tukaani-project/xz

This is probably related to the CVE-2024-3094 incident https://jfrog.com/blog/xz-backdoor-attack-cve-2024-3094-all-you-need-to-know/

[SpiritDogstar]

Current workaround for me was to disable lzma until this is figured out. I'm using boost iostreams, so needed to do this in my manifest vcpkg file.

    {
        "name": "boost-iostreams",
        "default-features": false,
        "features": ["bzip2", "zlib", "zstd"]
    },

[WangWeiLin-MV]

Duplicate of #37893