Re: Switching away from XZ

[Jonathan Schleifer <js%NetBSD.org@localhost>]

Am 04.04.24 um 08:18 schrieb Martin Husemann:

> I am not sure what you suggest to do. Running sed from a script and
> replacing all .tar.xz suffixes in pkgsrc makefiles obviously won't
> work. It is not our choice how other projects package their sources.

The suggestion would be for packages that offer both xz and another 
format, to switch to the other format, to make sure that we have as few 
packages on xz as possible to keep the attack surface as small as possible.

> Manually going through all packages using .tar.xz, checking if upstream
> provides different compression formats (as some of them do) and
> selecting a different one, testing and committing that change is
> something that would work.

Yep, that was exactly the proposal.

> Arbitrarily declaring a new prefered format (like zstd) is nice but has no
> practical effect, IMHO.

And that was never the proposal :). The proposal was to be pragmatic and 
switch what we easily can.

--
Jonathan