Simon pointed out to me, over IRC, that I can't wget the tarball link that he provided. That fixed my problem. Everything looks good to me now and I'll be releasing the update shortly.
** Changed in: karchive (Ubuntu Xenial) Status: Incomplete => Confirmed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1712948 Title: [CVE] KNewstuff downloads can install files outside the extraction directory To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/karchive/+bug/1712948/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs