New Package Request: zstd

[bgilbert]

Please try to answer the following questions about the package you are requesting:

1. What, if any, are the additional dependencies on the package? (i.e. does it pull in Python, Perl, etc)

None.

2. What is the size of the package and its dependencies?

$ rpm -q --queryformat '%{SIZE}\n' zstd-1.5.2-2.fc36.x86_64
1608976

3. What problem are you trying to solve with this package? Or what functionality does the package provide?

Create initrd images with zstd compression, which would improve boot time and reduce initrd size.

4. Can the software provided by the package be run from a container? Explain why or why not.

In general, yes, but not for initrd creation.

5. Can the tool(s) provided by the package be helpful in debugging container runtime issues?

No.

6. Can the tool(s) provided by the package be helpful in debugging networking issues?

No.

8. Is it possible to layer the package onto the base OS as a day 2 operation? Explain why or why not.

No, zstd needs to be available during cosa build.

9. In the case of packages providing services and binaries, can the packaging be adjusted to just deliver binaries?

There are no services.

10. Can the tool(s) provided by the package be used to do things we’d rather users not be able to do in FCOS? (e.g. can it be abused as a Turing complete interpreter?)

No.

12. Does the software provided by the package have a history of CVEs?

Yes: CVE-2019-11922, CVE-2021-24031, CVE-2021-24032.

[cgwalters]

Big 👍 from me! zstd is the clear successor to gzip we should use by default.

[cgwalters]

(Tangentially related to this...OCI containers default to gzip, but as of relatively recently also support zstd, and at some point hopefully in...well let's be realistic two years...we can cut over our containers to use that)

[jlebon]

Stating the obvious but: note this add 1.5M, but reduces the initrd by ~15M. The initrd appears once in OSTrees, and twice in disk images. Compressed disk images should have a decent size reduction from this.

[jlebon]

This was discussed in today's FCOS community meeting:

12:50:34 < bgilbert> #agreed We will add the zstd package to FCOS, and switch our initrd to use it.

[dustymabe]

The fix for this went into next stream release 36.20220716.1.0. Please try out the new release and report issues.

[dustymabe]

The fix for this went into testing stream release 36.20220716.2.0. Please try out the new release and report issues.

[dustymabe]

The fix for this went into stable stream release 36.20220716.3.1.