# Install xz with Homebrew, apk, dnf, MacPorts, Nix, pacman, scoop, zypper, apt General-purpose data compression with high compression ratio. Version 5.8.3 via Homebrew; verified from local package data. ## Install ```sh sudo av install brew:xz ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install xz ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install xz ``` Evidence: MacPorts ports tree: archivers/xz/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add xz ``` Evidence: Alpine Linux edge package indexes: xz from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz - dnf (92%): ```sh sudo dnf install xz ``` Evidence: Fedora Rawhide package metadata: xz from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#xz ``` Evidence: nixpkgs package indexes: xz from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix - pacman (92%): ```sh sudo pacman -S xz ``` Evidence: Arch Linux sync databases: xz from https://geo.mirror.pkgbuild.com/core/os/x86_64/core.db.tar.gz - zypper (92%): ```sh sudo zypper install liblzma5 ``` Evidence: openSUSE Tumbleweed package metadata: liblzma5 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst - Debian apt (92%): ```sh sudo apt install lzma ``` Evidence: Debian stable package indexes: lzma from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz ### Windows - Scoop (92%): ```sh scoop install main/xz ``` Evidence: Scoop official bucket manifest trees: bucket/xz.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:xz - **Package manager:** Homebrew - **Package manager page:** - **Version:** 5.8.3 - **Source summary:** General-purpose data compression with high compression ratio - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** 0BSD AND GPL-2.0-or-later - **Source archive:** - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - lzcat (cli) - lzcmp (cli) - lzdiff (cli) - lzegrep (cli) - lzfgrep (cli) - lzgrep (cli) - lzless (cli) - lzma (cli) - lzmadec (cli) - lzmainfo (cli) - lzmore (cli) - unlzma (cli) - unxz (cli) - xz (cli) - xzcat (cli) - xzcmp (cli) - xzdec (cli) - xzdiff (cli) - xzegrep (cli) - xzfgrep (cli) - xzgrep (cli) - xzless (cli) - xzmore (cli) - lzcat (alias) - lzcmp (alias) - lzdiff (alias) - lzegrep (alias) - lzfgrep (alias) - lzgrep (alias) - lzless (alias) - lzma (alias) - lzmadec (alias) - lzmainfo (alias) - lzmore (alias) - unlzma (alias) - unxz (alias) - xz (alias) - xzcat (alias) - xzcmp (alias) - xzdec (alias) - xzdiff (alias) - xzegrep (alias) - xzfgrep (alias) - xzgrep (alias) - xzless (alias) - xzmore (alias) ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sequoia, sonoma, tahoe, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 5.8.3 - Local data: ok - Upstream repository: https://github.com/tukaani-project/xz - info: No package-manager update timestamp was available. - info: No cached GitHub release or tag data was available. ## Project history and usage XZ Utils is the standard free-software implementation of the .xz container format, the LZMA2 compression method, and liblzma. It matters to package ecosystems because .tar.xz release archives, source packages, initramfs images, distribution payloads, and build systems rely on xz and liblzma for high-ratio lossless compression. ### Project history XZ Utils comes from the Tukaani Project and the earlier LZMA Utils lineage maintained by Lasse Collin. The project generalized Igor Pavlov's LZMA-family compression ideas into the .xz format and liblzma API used by Unix-like systems. The 5.0.0 release on 2010-10-23 was a major packaging milestone because the NEWS file marks liblzma API and ABI as stable and bumps the shared-library soname to 5.0.0. From a distro perspective, that turned xz from a promising compressor into a dependable system library. The project continued to evolve around multithreading, build-system support, portability, translated documentation, and platform coverage. The official site lists support across GNU/Linux, BSDs, macOS/Darwin, Solaris, AIX, Windows, DOS, and several more specialized systems, which explains why package managers treat it as base infrastructure. The 2024 CVE-2024-3094 backdoor is now part of XZ Utils history. Official Tukaani pages state that XZ Utils 5.6.0 and 5.6.1 release tarballs contained a backdoor inserted by a malicious co-maintainer and discovered by Andres Freund before broad stable distribution. The incident made xz one of the central examples in open-source supply-chain security discussions. ### Adoption history XZ adoption followed its compression ratio and Unix-friendly tooling. The familiar xz, unxz, xzcat, xzgrep, xzless, and compatibility aliases made it a drop-in neighbor to gzip and bzip2, while liblzma let package managers and applications decode .xz streams without shelling out. Distribution adoption became especially visible through .tar.xz source releases and compressed package artifacts. Many upstream projects now publish release tarballs as .tar.xz, and free operating systems commonly install xz or liblzma because so much source distribution and packaging machinery expects them. After CVE-2024-3094, adoption history also includes a trust reset: project infrastructure moved back under Tukaani-controlled URLs, GitHub repositories were restored, and clean XZ Utils releases were made on 2024-05-29, according to the official backdoor page. ### How it is used Command-line users compress and decompress files with xz, unxz, and xzcat, inspect streams with xz --list, and use xzgrep/xzless style helpers for text workflows inside compressed files. It is common in source-release workflows as tar -cJf or tar.xz packaging. Developers use liblzma directly or via bindings in languages such as Python, Perl, Haskell, Delphi, and Free Pascal. Package builders care about xz because archive format support, reproducible source distributions, and decompression availability can affect bootstrap chains. ### Why package nerds care XZ Utils is package-manager bedrock: small enough to be invisible most days, but important enough that a bad release can shake the whole distribution world. It sits in build roots, source tarball handling, package extraction, and language runtime bindings. The backdoor incident made xz historically significant beyond compression. It showed how a low-glamour maintainer package can become a high-value target precisely because it is everywhere, and why tarball provenance, release signing, maintainer access, and distro staging matter. ### Timeline - 2000s: Lasse Collin's Tukaani Project develops LZMA Utils and then XZ Utils around the .xz format, LZMA2, and liblzma. - 2010-10-23: XZ Utils 5.0.0 marks liblzma API and ABI stable with soname 5.0.0. - 2014-12-21: XZ Utils 5.2.0 continues the stable series and documents later multithreading-related caveats in NEWS. - 2022-04-07: A public patch fixes the xzgrep filename-handling issue tracked as CVE-2022-1271. - 2024-02-24 and 2024-03-09: XZ Utils 5.6.0 and 5.6.1 tarballs are released and later identified as backdoored. - 2024-03-29: Andres Freund's discovery of CVE-2024-3094 becomes public. - 2024-05-29: Official notes state that new clean XZ Utils releases were made after the backdoor response. - 2025-03-25: XZ Utils 5.8.0 continues the post-incident stable release line. ### Related projects - LZMA Utils is the predecessor lineage and source of compatibility command aliases such as lzma, unlzma, and lzcat. - 7-Zip and Igor Pavlov's LZMA work are related through the compression algorithms and ecosystem that influenced .xz/LZMA2 tooling. - gzip and bzip2 are neighboring Unix compression utilities that xz often replaces when higher compression ratio matters. - libarchive, tar, dpkg, rpm, pacman, and many build systems are downstream consumers of .xz support. ### Sources - - - - ## Security Notes broad file, network, media, or database tool signal. - **Geiger risk:** blue / medium - broad file, network, media, or database tool signal ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** xz - **Version Scheme:** 1 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Nix - xz: normalized package name match | nixpkgs package indexes: xz from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix - apk - xz - 5.8.3-r0: normalized package name match | Alpine Linux edge package indexes: xz from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Library and CLI tools for XZ and LZMA compressed files | https://tukaani.org/xz/ - apk - xz-dev - 5.8.3-r0: normalized package name match | Alpine Linux edge package indexes: xz-dev from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Library and CLI tools for XZ and LZMA compressed files (development files) | https://tukaani.org/xz/ - apk - xz-doc - 5.8.3-r0: normalized package name match | Alpine Linux edge package indexes: xz-doc from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Library and CLI tools for XZ and LZMA compressed files (documentation) | https://tukaani.org/xz/ - apk - xz-libs - 5.8.3-r0: normalized package name match | Alpine Linux edge package indexes: xz-libs from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Library and CLI tools for XZ and LZMA compressed files (libraries) | https://tukaani.org/xz/ - apk - xz-static - 5.8.3-r0: normalized package name match | Alpine Linux edge package indexes: xz-static from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz | Library and CLI tools for XZ and LZMA compressed files (static library) | https://tukaani.org/xz/ - dnf - xz - 5.8.3-1.fc45: normalized package name match | Fedora Rawhide package metadata: xz from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | LZMA compression utilities | https://tukaani.org/xz/ - dnf - xz-devel - 5.8.3-1.fc45: normalized package name match | Fedora Rawhide package metadata: xz-devel from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Devel libraries & headers for liblzma | https://tukaani.org/xz/ - dnf - xz-libs - 5.8.3-1.fc45: normalized package name match | Fedora Rawhide package metadata: xz-libs from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Libraries for decoding LZMA compression | https://tukaani.org/xz/ - dnf - xz-lzma-compat - 5.8.3-1.fc45: normalized package name match | Fedora Rawhide package metadata: xz-lzma-compat from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Older LZMA format compatibility binaries | https://tukaani.org/xz/ - dnf - xz-static - 5.8.3-1.fc45: normalized package name match | Fedora Rawhide package metadata: xz-static from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Statically linked library for decoding LZMA compression | https://tukaani.org/xz/ - pacman - xz - 5.8.3-1: normalized package name match | Arch Linux sync databases: xz from https://geo.mirror.pkgbuild.com/core/os/x86_64/core.db.tar.gz | Library and command line tools for XZ and LZMA compressed files | https://tukaani.org/xz/ - zypper - liblzma5 - 5.8.3-1.2: normalized package name match | openSUSE Tumbleweed package metadata: liblzma5 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Lempel–Ziv–Markov chain algorithm compression library | https://tukaani.org/xz/ - zypper - liblzma5-32bit - 5.8.3-1.2: normalized package name match | openSUSE Tumbleweed package metadata: liblzma5-32bit from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Lempel–Ziv–Markov chain algorithm compression library | https://tukaani.org/xz/ - zypper - liblzma5-x86-64-v3 - 5.8.3-1.2: normalized package name match | openSUSE Tumbleweed package metadata: liblzma5-x86-64-v3 from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Lempel–Ziv–Markov chain algorithm compression library | https://tukaani.org/xz/ - zypper - xz - 5.8.3-1.2: normalized package name match | openSUSE Tumbleweed package metadata: xz from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | A Program for Compressing Files with the Lempel–Ziv–Markov algorithm | https://tukaani.org/xz/ ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Text processing packages](https://www.automicvault.com/pkg/text-processing-tools/) - Matched text, document, or structured-data processing metadata. - [Archive and compression packages](https://www.automicvault.com/pkg/archive-compression-tools/) - Matched archive or compression metadata. - [aarch64-elf-gdb](https://www.automicvault.com/pkg/brew/aarch64-elf-gdb/) - Popular package that depends on this formula. - [apt](https://www.automicvault.com/pkg/brew/apt/) - Popular package that depends on this formula. - [arm-none-eabi-gdb](https://www.automicvault.com/pkg/brew/arm-none-eabi-gdb/) - Popular package that depends on this formula. - [avfs](https://www.automicvault.com/pkg/brew/avfs/) - Popular package that depends on this formula. - [avro-c](https://www.automicvault.com/pkg/brew/avro-c/) - Popular package that depends on this formula. - [bedtools](https://www.automicvault.com/pkg/brew/bedtools/) - Popular package that depends on this formula. - [crosstool-ng](https://www.automicvault.com/pkg/brew/crosstool-ng/) - Popular package that depends on this formula. - [lzip](https://www.automicvault.com/pkg/brew/lzip/) - Shares av.db curated category or tags: cli, compression, lzma, system. - [clzip](https://www.automicvault.com/pkg/brew/clzip/) - Shares av.db curated category or tags: cli, compression, system. - [crabz](https://www.automicvault.com/pkg/brew/crabz/) - Shares av.db curated category or tags: cli, compression, system. - [dwarfs](https://www.automicvault.com/pkg/brew/dwarfs/) - Shares av.db curated category or tags: cli, compression, system. - [gzip](https://www.automicvault.com/pkg/brew/gzip/) - Shares av.db curated category or tags: cli, compression, system. - [lizard](https://www.automicvault.com/pkg/brew/lizard/) - Shares av.db curated category or tags: cli, compression, system. - [lrzip](https://www.automicvault.com/pkg/brew/lrzip/) - Shares av.db curated category or tags: cli, compression, system. - [lunzip](https://www.automicvault.com/pkg/brew/lunzip/) - Shares av.db curated category or tags: cli, compression, system. - [sevenzip](https://www.automicvault.com/pkg/brew/sevenzip/) - Local package facts share a topical domain. Shared terms: cli, compression, high, lzma, ratio. ## Combined YAML source View the package source record on GitHub. [combined/xz.yml](https://github.com/automic-vault/db/blob/main/combined/xz.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph