Fwupd Switches From XZ To Zstd Compression: More Trust & Slightly Better Performance

Driven by the XZ security fiasco with malicious code aimed at remote code execution, more open-source projects are re-evaluating their dependence on XZ out of an abundance of caution. The latest to take action is the Fwupd Linux firmware updating utility with LVFS that will now prefer Zstd compression instead of XZ.

Fwupd has relied on XZ for compressing its large XML payload for speeding up network downloads and conserving CDN resources. XZ allowed for better compression than Gzip previously used. But out of an abundance of caution given concerns over the XZ project, Richard Hughes has now moved over to using Zstd instead.

Not only is Zstd more trustworthy but it ended up yielding compressed metadata around 3% smaller than XZ and is faster at decompressing the data too.

This change will go into the Fwupd release due out next week. More details on Fwupd moving from XZ to Zstd via this blog post.