dependency_support/boost: switch lzma to a safer repo

Author: proppy

dependency_support/boost/boost.bzl

@@ -34,5 +34,7 @@ def boost():
             # that the rest of XLS uses.
             Label("@rules_hdl//dependency_support/boost:add_python.patch"),
             Label("@rules_hdl//dependency_support/boost:libbacktrace.patch"),
+            # See: https://github.com/nelhage/rules_boost/issues/555
+            Label("@rules_hdl//dependency_support/boost:downgrade_lzma.patch"),
         ],
     )

dependency_support/boost/downgrade_lzma.patch

@@ -0,0 +1,17 @@
+diff --git boost/boost.bzl boost/boost.bzl
+index 4381996..587a37d 100644
+--- boost/boost.bzl
++++ boost/boost.bzl
+@@ -140,9 +140,9 @@ def boost_deps():
+         http_archive,
+         name = "org_lzma_lzma",
+         build_file = "@com_github_nelhage_rules_boost//:lzma.BUILD",
+-        url = "https://github.com/tukaani-project/xz/releases/download/v5.4.3/xz-5.4.3.tar.gz",
+-        sha256 = "1c382e0bc2e4e0af58398a903dd62fff7e510171d2de47a1ebe06d1528e9b7e9",
+-        strip_prefix = "xz-5.4.3",
++        url = "https://src.fedoraproject.org/lookaside/extras/xz/xz-5.4.6.tar.gz/sha512/b08a61d8d478d3b4675cb1ddacdbbd98dc6941a55bcdd81a28679e54e9367d3a595fa123ac97874a17da571c1b712e2a3e901c2737099a9d268616a1ba3de497/xz-5.4.6.tar.gz",
++        sha256 = "aeba3e03bf8140ddedf62a0a367158340520f6b384f75ca6045ccc6c0d43fd5c",
++        strip_prefix = "xz-5.4.6",
+     )
+ 
+     maybe(