Repository navigation
docs: a warning on xz next to every xz size; just size uses the pinned xz - #133
Merged
Merged
Conversation
…ned xz The ptbr-pdf and ptbr-tools READMEs give sizes measured with `xz -9`. Nothing ships an .xz file, but a future release asset could. Each size table now has a warning: use xz 5.8.4 or newer from the lab's pinned nixpkgs, never the host's. XZ Utils had a backdoor in 5.6.0 and 5.6.1 (CVE-2024-3094) and memory-safety fixes in 5.8.1 (CVE-2025-31115), 5.8.3 (CVE-2026-34743) and 5.8.4 (GHSA-5qpq-xqfv-j9pg). The warning also says to prefer zstd or gzip for assets. The root README links the warning from its benchmark line. `just size` in labs/ptbr-tools used the host's xz. On the machine where the sizes were measured, that was 5.8.3. It now runs xz from the lab's locked nixpkgs (5.8.4). The result is the same 241 720 bytes. Tested: just size in labs/ptbr-tools (xz 5.8.4 from the lock, 241 720 bytes); just --list; the advisories read from github.com/tukaani-project/xz/security-advisories Co-Authored-By: Claude <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A warning on xz, next to every size that was measured with
xz -9.labs/ptbr-pdf/README.mdandlabs/ptbr-tools/README.mdsay that the xz sizes are a measurement only. If a release asset is ever compressed with xz, use xz 5.8.4 or newer from the lab's pinned nixpkgs, never the host's. Prefer zstd or gzip for assets. The root README links the warning from its benchmark line.just sizein labs/ptbr-tools now runs xz from the lab's locked nixpkgs (5.8.4), not the host's. The host here had 5.8.3. The measured size does not change (241 720 bytes).What a consumer has to do: nothing. No
.xzfile is shipped.Tested:
just size(xz 5.8.4, 241 720 bytes);just --list.