Update 7zip to latest 25.01

[JanneKiiskila]

The 7zip version that is being used is now quite old (23.01) and it has some known CVEs.
Ref: https://www.cvedetails.com/vendor/9220/7-zip.html

We also download the source code from sourceforge and the latest documentation for 7zip seems to point to 7-zip.org instead, i.e. use https://www.7-zip.org/a/7z2501-src.tar.xz for example that.

[Peter0x44]

Why are those CVEs important at all? The sfx stub only extracts ONE known good 7z, not arbitrary ones.

[skeeto]

Yup, as @Peter0x44 said, this is just for SFX and it processes exactly one good input, and so is unaffected by any CVEs. I've rigged up a custom 7z build script that works better for w64dk than the official build system. I expect it to be sensitive to upstream changes, so I don't want to update often, possibly never. The only reason to update is (1) if there was a bug affecting w64dk — highly unlikely — in which case I might just backport a fix instead, or (2) it gained some killer feature like scripting support in the SFX (versus running 7zr.exe).

[skeeto]

Tangential: One of the great tragedies of modern software development is the cargo culting of security practices. I've been doing this long enough to see the industry switch from under-reacting to over-reacting. Few CVEs describe real security bugs, yet everyone believes they must continuously update their dependencies/tools each time someone registers a CVE, without considering if the bug actually affects them. Or if it's even a bug at all! You can't make a determination without a security model, and almost nobody has a security model or any concept of their security boundaries. Few providers support old releases with security updates, especially if you're not paying them for it, and so security updates typically come with breaking changes. (To be clear, nobody is obligated to support their old releases for free.) An enormous amount of resources go into fixing things after unnecessary updates. So each CVE has a hefty, distributed price tag paid for by those who don't understand their own systems. A significant portion of my own salary is dealing with update breakage, practically none of which is necessary. (w64dk security model: It doesn't connect to the internet and most of the included software is not designed to process untrusted input. See Bintuils SECURITY.txt. So upstream CVEs generally do not apply to w64dk.)