The compression flag and lzma dependency were removed with nothing consuming them; xz support returns for foreign-cache substitution (cache.nixos.org serves .nar.xz). The decoder must be output-bounded: the consumer knows the narinfo's declared NarSize before decompressing, so decompression takes that bound and fails past it - a small compressed input cannot expand to arbitrary memory ahead of the hash check.
Consumed by nova-nix's foreign-cache substitution issue.
The compression flag and lzma dependency were removed with nothing consuming them; xz support returns for foreign-cache substitution (cache.nixos.org serves .nar.xz). The decoder must be output-bounded: the consumer knows the narinfo's declared NarSize before decompressing, so decompression takes that bound and fails past it - a small compressed input cannot expand to arbitrary memory ahead of the hash check.
Consumed by nova-nix's foreign-cache substitution issue.