From 97326c3af9881143cc84588ccecd9ee3821f6532 Mon Sep 17 00:00:00 2001 From: "M.Hoffmann" Date: Wed, 21 Oct 2026 02:17:34 -0300 Subject: [PATCH] docs: a warning on xz next to every xz size; `just size` uses the pinned xz The ptbr-pdf and ptbr-tools READMEs give sizes measured with `xz -9`. Nothing ships an .xz file, but a future release asset could. Each size table now has a warning: use xz 5.8.4 or newer from the lab's pinned nixpkgs, never the host's. XZ Utils had a backdoor in 5.6.0 and 5.6.1 (CVE-2024-3094) and memory-safety fixes in 5.8.1 (CVE-2025-31115), 5.8.3 (CVE-2026-34743) and 5.8.4 (GHSA-5qpq-xqfv-j9pg). The warning also says to prefer zstd or gzip for assets. The root README links the warning from its benchmark line. `just size` in labs/ptbr-tools used the host's xz. On the machine where the sizes were measured, that was 5.8.3. It now runs xz from the lab's locked nixpkgs (5.8.4). The result is the same 241 720 bytes. Tested: just size in labs/ptbr-tools (xz 5.8.4 from the lock, 241 720 bytes); just --list; the advisories read from github.com/tukaani-project/xz/security-advisories Co-Authored-By: Claude --- README.md | 2 ++ labs/ptbr-pdf/README.md | 9 +++++++++ labs/ptbr-tools/README.md | 9 +++++++++ labs/ptbr-tools/justfile | 4 ++-- 4 files changed, 22 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 0e5b58f..f7c3ace 100644 --- a/README.md +++ b/README.md @@ -86,6 +86,8 @@ Each lab README has the recipes, what the lab pins (`What it pins`) and how to r to download); Rust + Typst, static, needs 25.2 MiB (8.1 MiB with `xz -9`). The method and the platforms are in [`labs/ptbr-pdf`](labs/ptbr-pdf#benchmark-from-pandoc-to-rust). +⚠ The xz figure is a measurement only; see the [xz warning](labs/ptbr-pdf/README.md#benchmark-from-pandoc-to-rust) (CVE-2024-3094 and later fixes up to 5.8.4) before you ship an `.xz` file. + ## tools/ One Cargo workspace. Run a crate with `nix run ./tools#`. diff --git a/labs/ptbr-pdf/README.md b/labs/ptbr-pdf/README.md index d746434..4450d78 100644 --- a/labs/ptbr-pdf/README.md +++ b/labs/ptbr-pdf/README.md @@ -32,6 +32,15 @@ and ptbr-writer's `scripts/pdf-bench.sh`. | 2. Rust + Typst, first build | one binary, all of `typst-assets`' fonts | 46.7 MiB static | 13.7 MiB (`xz -9`) | 17 min through Nix ⚠ | | 3. **Rust + Typst, slim** | six fonts, `opt-level = "z"`, `lto = "fat"`, `panic = "abort"`, stripped | **25.2 MiB static** | **8.1 MiB** (`xz -9`), 10.8 MiB (gzip) | **0.2 s** to convert a page | +> **⚠ xz.** The xz sizes are a measurement only: nothing here ships an `.xz` file. If a release +> asset is ever compressed with xz, use xz 5.8.4 or newer from the lab's pinned nixpkgs (the lock +> has 5.8.4), never the host's. XZ Utils had a backdoor in 5.6.0 and 5.6.1 +> ([CVE-2024-3094](https://nvd.nist.gov/vuln/detail/CVE-2024-3094)) and memory-safety fixes in 5.8.1 +> ([CVE-2025-31115](https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2)), +> 5.8.3 ([CVE-2026-34743](https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv)) +> and 5.8.4 ([GHSA-5qpq-xqfv-j9pg](https://github.com/tukaani-project/xz/security/advisories/GHSA-5qpq-xqfv-j9pg)). +> Prefer zstd or gzip for assets. + - Step 1 to step 3: **29× less on disk and 25× less to download.** - ⚠ Through Nix, row 2 took 17 minutes on a fresh 4-core runner: the binary is not in cache.nixos.org, so Nix compiles Typst and 326 crates. Download the prebuilt static binary diff --git a/labs/ptbr-tools/README.md b/labs/ptbr-tools/README.md index 6c2433b..1301002 100644 --- a/labs/ptbr-tools/README.md +++ b/labs/ptbr-tools/README.md @@ -69,6 +69,15 @@ Measured on x86_64-linux, 2026-10-21, `nix build`, stripped, `opt-level = "z"`, | `packages.static-aarch64` (musl, static) | 528 696 bytes | 517.4 KiB | | `packages.default` (glibc) | 480 176 bytes | 47.4 MiB (glibc and libgcc_s from the store) | +> **⚠ xz.** The xz sizes are a measurement only: nothing here ships an `.xz` file. If a release +> asset is ever compressed with xz, use xz 5.8.4 or newer from the lab's pinned nixpkgs (the lock +> has 5.8.4), never the host's. XZ Utils had a backdoor in 5.6.0 and 5.6.1 +> ([CVE-2024-3094](https://nvd.nist.gov/vuln/detail/CVE-2024-3094)) and memory-safety fixes in 5.8.1 +> ([CVE-2025-31115](https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2)), +> 5.8.3 ([CVE-2026-34743](https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv)) +> and 5.8.4 ([GHSA-5qpq-xqfv-j9pg](https://github.com/tukaani-project/xz/security/advisories/GHSA-5qpq-xqfv-j9pg)). +> Prefer zstd or gzip for assets. + The three separate binaries each carry their own copy of `std`. One binary that dispatches on its name is 2.5 times smaller in total, so the lab ships that one. `checks.size` fails if the static binary grows more than 10% over 570 112 bytes (a ceiling of 627 123 bytes). diff --git a/labs/ptbr-tools/justfile b/labs/ptbr-tools/justfile index b6a5768..0ac8653 100644 --- a/labs/ptbr-tools/justfile +++ b/labs/ptbr-tools/justfile @@ -14,9 +14,9 @@ test: build: nix build "{{here}}#static" --print-build-logs --out-link "{{here}}/result" && ls -lL "{{here}}/result/bin/" -# The size of the static binary, its xz size and the closure a consumer downloads. +# The size of the static binary, its xz size (xz from the lab's pinned nixpkgs, never the host's: see the README's xz warning) and the closure a consumer downloads. size: - p="$(nix build "{{here}}#static" --no-link --print-out-paths)"; stat -L -c '%s bytes %n' "$p/bin/ptbr"; xz -9 -c "$p/bin/ptbr" | wc -c; nix path-info -Sh "$p" + p="$(nix build "{{here}}#static" --no-link --print-out-paths)"; stat -L -c '%s bytes %n' "$p/bin/ptbr"; rev="$(nix flake metadata --json --no-update-lock-file "{{here}}" | jq -r .locks.nodes.nixpkgs.locked.rev)"; nix run "github:NixOS/nixpkgs/$rev#xz" -- -9 -c "$p/bin/ptbr" | wc -c; nix path-info -Sh "$p" # Enter the shell: rustc, cargo, clippy, rustfmt and rust-analyzer on PATH. shell: