fwupd abandons xz compression for zstd amid security concerns
Following the discovery of malicious code, fwupd, the popular firmware update utility, has decided to transition from xz to zstd compression for its metadata. Richard Hughes, the lead developer behind fwupd, outlined the rationale behind this decision in a recent blog post.
For years, fwupd has relied on compressed metadata to facilitate firmware updates for a wide array of hardware. This metadata, essentially a large XML file, was initially compressed using gzip, resulting in a 1.6MB download for end-users. However, in 2021, the fwupd team switched to xz compression, further reducing the file size to 1.1MB and saving significant bandwidth.