# Installer xz avec Homebrew, apk, dnf, MacPorts, Nix, pacman, zypper, scoop, apt

Consultez les chemins d'installation, exécutables, métadonnées et notes de sécurité de xz pour les workflows d'agents IA.

## installation

```sh
sudo av install brew:xz
```

Commandes d'installation supplémentaires:

### macOS

- Homebrew (100%):

```sh
brew install xz
```

  Preuve: local Homebrew formula metadata

- MacPorts (94%):

```sh
sudo port install xz
```

  Preuve: MacPorts ports tree: archivers/xz/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

### Linux

- apk (92%):

```sh
sudo apk add xz
```

  Preuve: Alpine Linux edge package indexes: xz from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz

- dnf (92%):

```sh
sudo dnf install xz
```

  Preuve: Fedora Rawhide package metadata: xz from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst

- Nix (92%):

```sh
nix profile install nixpkgs#xz
```

  Preuve: nixpkgs package indexes: pkgs/by-name/xz/xz/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

- pacman (92%):

```sh
sudo pacman -S xz
```

  Preuve: Arch Linux sync databases: xz from https://geo.mirror.pkgbuild.com/core/os/x86_64/core.db.tar.gz

- zypper (92%):

```sh
sudo zypper install xz
```

  Preuve: openSUSE Tumbleweed package metadata: xz from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst

- Debian apt (92%):

```sh
sudo apt install lzma
```

  Preuve: Debian stable package indexes: lzma from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz

### Windows

- Scoop (92%):

```sh
scoop install main/xz
```

  Preuve: Scoop official bucket manifest trees: bucket/xz.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

## Faits du paquet

- **Clé du paquet:** brew:xz
- **Gestionnaire de paquets:** Homebrew
- **Version:** 5.8.3
- **Résumé source:** General-purpose data compression with high compression ratio
- **Page d'accueil:** <https://tukaani.org/xz/>
- **Dépôt:** <https://github.com/tukaani-project/xz>
- **Dernière mise à jour:** 2026-07-17T09:01:35-04:00
- **Généré:** 2026-08-03T19:37:03+00:00

## exécutables

- lzcat (alias)
- lzcmp (alias)
- lzdiff (alias)
- lzegrep (alias)
- lzfgrep (alias)
- lzgrep (alias)
- lzless (alias)
- lzma (alias)
- lzmadec (alias)
- lzmainfo (alias)
- lzmore (alias)
- unlzma (alias)
- unxz (alias)
- xz (alias)
- xzcat (alias)
- xzcmp (alias)
- xzdec (alias)
- xzdiff (alias)
- xzegrep (alias)
- xzfgrep (alias)
- xzgrep (alias)
- xzless (alias)
- xzmore (alias)

## Comportement d'installation

- Bouteille: non disponible

## Version et fraîcheur

- page générée: 2026-08-03
- version du gestionnaire: 5.8.3
## Historique du projet et usages

XZ Utils is the standard free-software implementation of the .xz container format, the LZMA2 compression method, and liblzma. It matters to package ecosystems because .tar.xz release archives, source packages, initramfs images, distribution payloads, and build systems rely on xz and liblzma for high-ratio lossless compression.

### Historique du projet

XZ Utils comes from the Tukaani Project and the earlier LZMA Utils lineage maintained by Lasse Collin. The project generalized Igor Pavlov's LZMA-family compression ideas into the .xz format and liblzma API used by Unix-like systems.

The 5.0.0 release on 2010-10-23 was a major packaging milestone because the NEWS file marks liblzma API and ABI as stable and bumps the shared-library soname to 5.0.0. From a distro perspective, that turned xz from a promising compressor into a dependable system library.

The project continued to evolve around multithreading, build-system support, portability, translated documentation, and platform coverage. The official site lists support across GNU/Linux, BSDs, macOS/Darwin, Solaris, AIX, Windows, DOS, and several more specialized systems, which explains why package managers treat it as base infrastructure.

The 2024 CVE-2024-3094 backdoor is now part of XZ Utils history. Official Tukaani pages state that XZ Utils 5.6.0 and 5.6.1 release tarballs contained a backdoor inserted by a malicious co-maintainer and discovered by Andres Freund before broad stable distribution. The incident made xz one of the central examples in open-source supply-chain security discussions.

### Historique d'adoption

XZ adoption followed its compression ratio and Unix-friendly tooling. The familiar xz, unxz, xzcat, xzgrep, xzless, and compatibility aliases made it a drop-in neighbor to gzip and bzip2, while liblzma let package managers and applications decode .xz streams without shelling out.

Distribution adoption became especially visible through .tar.xz source releases and compressed package artifacts. Many upstream projects now publish release tarballs as .tar.xz, and free operating systems commonly install xz or liblzma because so much source distribution and packaging machinery expects them.

After CVE-2024-3094, adoption history also includes a trust reset: project infrastructure moved back under Tukaani-controlled URLs, GitHub repositories were restored, and clean XZ Utils releases were made on 2024-05-29, according to the official backdoor page.

### Modes d'utilisation

Command-line users compress and decompress files with xz, unxz, and xzcat, inspect streams with xz --list, and use xzgrep/xzless style helpers for text workflows inside compressed files. It is common in source-release workflows as tar -cJf or tar.xz packaging.

Developers use liblzma directly or via bindings in languages such as Python, Perl, Haskell, Delphi, and Free Pascal. Package builders care about xz because archive format support, reproducible source distributions, and decompression availability can affect bootstrap chains.

### Pourquoi les passionnés de paquets s'y intéressent

XZ Utils is package-manager bedrock: small enough to be invisible most days, but important enough that a bad release can shake the whole distribution world. It sits in build roots, source tarball handling, package extraction, and language runtime bindings.

The backdoor incident made xz historically significant beyond compression. It showed how a low-glamour maintainer package can become a high-value target precisely because it is everywhere, and why tarball provenance, release signing, maintainer access, and distro staging matter.

### Chronologie

- 2000s: Lasse Collin's Tukaani Project develops LZMA Utils and then XZ Utils around the .xz format, LZMA2, and liblzma.
- 2010-10-23: XZ Utils 5.0.0 marks liblzma API and ABI stable with soname 5.0.0.
- 2014-12-21: XZ Utils 5.2.0 continues the stable series and documents later multithreading-related caveats in NEWS.
- 2022-04-07: A public patch fixes the xzgrep filename-handling issue tracked as CVE-2022-1271.
- 2024-02-24 and 2024-03-09: XZ Utils 5.6.0 and 5.6.1 tarballs are released and later identified as backdoored.
- 2024-03-29: Andres Freund's discovery of CVE-2024-3094 becomes public.
- 2024-05-29: Official notes state that new clean XZ Utils releases were made after the backdoor response.
- 2025-03-25: XZ Utils 5.8.0 continues the post-incident stable release line.

### Related projects

- LZMA Utils is the predecessor lineage and source of compatibility command aliases such as lzma, unlzma, and lzcat.
- 7-Zip and Igor Pavlov's LZMA work are related through the compression algorithms and ecosystem that influenced .xz/LZMA2 tooling.
- gzip and bzip2 are neighboring Unix compression utilities that xz often replaces when higher compression ratio matters.
- libarchive, tar, dpkg, rpm, pacman, and many build systems are downstream consumers of .xz support.

### Sources

- <https://github.com/tukaani-project/xz/blob/master/NEWS>
- <https://tukaani.org/xz-backdoor/>
- <https://tukaani.org/xz/>
- <https://www.openwall.com/lists/oss-security/2024/03/29/4>


## Notes de sécurité

broad file, network, media, or database tool signal.

- **Risque Geiger:** blue / moyen
- broad file, network, media, or database tool signal

## Autres enregistrements de gestionnaires de paquets

- Nix - xz: normalized package name match | nixpkgs package indexes: pkgs/by-name/xz/xz/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
- apk - xz - 5.8.3-r0: normalized package name match | Alpine Linux edge package indexes: xz from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Library and CLI tools for XZ and LZMA compressed files | https://tukaani.org/xz/
- apk - xz-dev - 5.8.3-r0: normalized package name match | Alpine Linux edge package indexes: xz-dev from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Library and CLI tools for XZ and LZMA compressed files (development files) | https://tukaani.org/xz/
- apk - xz-doc - 5.8.3-r0: normalized package name match | Alpine Linux edge package indexes: xz-doc from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Library and CLI tools for XZ and LZMA compressed files (documentation) | https://tukaani.org/xz/
- apk - xz-libs - 5.8.3-r0: normalized package name match | Alpine Linux edge package indexes: xz-libs from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Library and CLI tools for XZ and LZMA compressed files (libraries) | https://tukaani.org/xz/
- apk - xz-static - 5.8.3-r0: normalized package name match | Alpine Linux edge package indexes: xz-static from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Library and CLI tools for XZ and LZMA compressed files (static library) | https://tukaani.org/xz/
- dnf - xz - 5.8.3-2.fc45: normalized package name match | Fedora Rawhide package metadata: xz from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | LZMA compression utilities | https://tukaani.org/xz/
- dnf - xz-devel - 5.8.3-2.fc45: normalized package name match | Fedora Rawhide package metadata: xz-devel from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Devel libraries & headers for liblzma | https://tukaani.org/xz/
- dnf - xz-libs - 5.8.3-2.fc45: normalized package name match | Fedora Rawhide package metadata: xz-libs from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Libraries for decoding LZMA compression | https://tukaani.org/xz/
- dnf - xz-lzma-compat - 5.8.3-2.fc45: normalized package name match | Fedora Rawhide package metadata: xz-lzma-compat from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Older LZMA format compatibility binaries | https://tukaani.org/xz/
- dnf - xz-static - 5.8.3-2.fc45: normalized package name match | Fedora Rawhide package metadata: xz-static from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/07190dc5ae9f35ae73866675fed6d95fe6e8d9fe22c9d7cdf85862cb2ed24a4c-primary.xml.zst | Statically linked library for decoding LZMA compression | https://tukaani.org/xz/
- pacman - xz - 5.8.3-1: normalized package name match | Arch Linux sync databases: xz from https://geo.mirror.pkgbuild.com/core/os/x86_64/core.db.tar.gz | Library and command line tools for XZ and LZMA compressed files | https://tukaani.org/xz/
- zypper - liblzma5 - 5.8.3-1.4: normalized package name match | openSUSE Tumbleweed package metadata: liblzma5 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Lempel–Ziv–Markov chain algorithm compression library | https://tukaani.org/xz/
- zypper - liblzma5-32bit - 5.8.3-1.4: normalized package name match | openSUSE Tumbleweed package metadata: liblzma5-32bit from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Lempel–Ziv–Markov chain algorithm compression library | https://tukaani.org/xz/
- zypper - liblzma5-x86-64-v3 - 5.8.3-1.4: normalized package name match | openSUSE Tumbleweed package metadata: liblzma5-x86-64-v3 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | Lempel–Ziv–Markov chain algorithm compression library | https://tukaani.org/xz/
- zypper - xz - 5.8.3-1.4: normalized package name match | openSUSE Tumbleweed package metadata: xz from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | A Program for Compressing Files with the Lempel–Ziv–Markov algorithm | https://tukaani.org/xz/


## Combined YAML source

View the package source record on GitHub. [combined/xz.yml](https://github.com/mxcl/pkgdb/blob/main/combined/xz.yml)


## Sources

- pkg.so package database
- Geiger risk classifier
- curated package history
- pkgdb category and tag curation
- external package-manager database matches
- cross-ecosystem install command graph