Re: GNU Coding Standards, automake, and the recent xz-utils backdoor

[Bob Friesenhahn]

> I'm also wondering whether the GNU system should recommend using zstd
> instead of or in addition to xz for compression purposes.  Automake
> gained support for dist-zstd back in 2019 [1], but I'm not sure how
> many projects are using it yet.
>
> [1] https://git.savannah.gnu.org/cgit/automake.git/commit/?id=5c466eaf

For several years, GraphicsMagick distributed a tarball compressed to 
zstd format.  This started before Automake offered support for it.

I used these rules:

# Rules to build a .tar.zst tarball (zstd compression)
dist-zstd: distdir
    tardir=$(distdir) && $(am__tar) | ZSTD_CLEVEL=$${ZSTD_CLEVEL-22} 
zstd --ultra -c >$(distdir).tar.zst
    $(am__post_remove_distdir)

With these options, the zst tarball came withing a hare's breath of the 
xz compressed file size.  I did not find any drawbacks.

I also had good experience with 'lzip', which has the benefit of a very 
small implementation and more compact coding than xz uses.

I stopped distributing anything but xz format since that is what almost 
everyone was choosing to download.

Bob

--
Bob Friesenhahn
bfriesen@simple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/
Public Key,     http://www.simplesystems.org/users/bfriesen/public-key.txt