bugGNU Boot - Bugs: bug #66346, releases: don't trust .xz

 
 

bug #66346: releases: don't trust .xz

Submitter:  GNUtoo <gnutoo>
Submitted:  Thu 17 Oct 2024 03:03:28 PM UTC
   
 
Category:  None Priority:  1 - Later
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Computer:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 17 Oct 2024 03:03:28 PM UTC, original submission:  

Hi,

The xz format is known not to be fit for long term archiving: https://www.nongnu.org/lzip/xz_inadequate.html

But that doesn't mean it should not be used for releases that meant for long term archiving.

Linux for instance uses xz and gzip but it signs the tarball instead of signing the compressed tarball (https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/).

The advantage are (if we do that):
- We can recompress the archive differently if needed and not break signatures.
- If .xz doesn't work anymore or that the files are corrupted somehow, it's possible to check the integrity of the tarball itself without having to trust xz in the process.
- It's easier to reconstruct tarballs from differently damaged files.

The disadvantages is probably that people are more used to check the signature before decompression.

So at some point we probably need to fix the build system to have a release process where the uncompressed files are signed instead and to handle that in the documentation as well.

Using lzip2 is also possible but it's less common and it look painfully slow in some situations and the files are usually bigger than xz -9e.

Denis.

GNUtoo <gnutoo>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gnutoo (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-10-17 gnutoo Priority5 - Normal 1 - Later

    Back to the top

    Powered by Savane 3.14-3b9d.
    Corresponding source code