Arch has already updated XZ by relying on the source code repository itself instead of the tarballs that did have the manipulations in them.
It's not ideal since we still rely on a potentially *otherwise* compromised piece of code still but it's a quick and effective workaround without massive technical trouble for the issue at hand.
That sucks if that's true. And would also ironically not be the first time AMD is getting denied a thing after they already have an implementation ready for it lol.
I can confirm that it works just fine for me. In my case I'm on Arch Linux btw and a 7900XTX, but it needed a few tweaks:
- Having xformers installed at all would sometimes break startup of stable-diffusion depending on the fork
- I had an internal and an external GPU, I want to set HIP_VISIBLE_DEVICE so that it only sees the correct one
- I had to update torch/torchvision and set HSA_OVERRIDE_GFX_VERSION
I threw what I did into https://github.com/icedream/sd-multiverse/blob/main/scripts/setup-venv.sh#L381-L386 to test several forks.
Until you use software that without up front notice Ubuntu decides to move from APT to Snap without a migration process in place for your settings or credentials. Like has happened with Telegram and with Chromium. And then stuff breaks in ways where you as a noobie would have no idea how to fix.
This is exactly what happened with the Ubuntu setup on my parents' laptop and I've since moved everything over to Linux Mint for them so they don't have to deal with that anymore.