nixos.containerTarball images are created with trailing garbage, confusing tar --ignore-zeros (e. g. machinectl import-tar)

[intelfx]

Describe the bug

nixos.containerTarball.x86_64-linux images produce errors when extracted with tar --ignore-zeros (as systemd-importd does, cf. systemd/systemd@e4ec782).

Steps To Reproduce

Steps to reproduce the behavior:

1. Go to https://hydra.nixos.org/build/188075138 (which is the last nixos.containerTarball.x86_64-linux build at the time of reporting)
2. Click on the link to download nixos-system-x86_64-linux.tar.xz
3. Download the tarball, verify SHA-256 (which is a5cb7e645c6d282ae917730800d834dbd0934ceee17d8799a12b81dbdfe82907 at the time of reporting)
4. Attempt to extract the tarball with GNU tar using a tar -x --ignore-zeros or a variation thereof, OR run machinectl import-tar
5. Observe a non-zero tar exit code

Expected behavior

The tarball is expected to extract cleanly.

Example output

$ curl -fLOJ 'https://hydra.nixos.org/build/188075138/download/1/nixos-system-x86_64-linux.tar.xz'
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  111M  100  111M    0     0  6264k      0  0:00:18  0:00:18 --:--:-- 7059k

$ sha256sum nixos-system-x86_64-linux.tar.xz
a5cb7e645c6d282ae917730800d834dbd0934ceee17d8799a12b81dbdfe82907  nixos-system-x86_64-linux.tar.xz

$ btrfs sub create out
Create subvolume './out'

# tar -xaf nixos-system-x86_64-linux.tar.xz --ignore-zeros -C out; echo $?
tar: Skipping to next header
tar: Exiting with failure status due to previous errors
2

Additional context

• systemd commit adding conflicting behavior: systemd/systemd@e4ec782
• systemd bug report that caused the behavior change: machinectl pull-tar fails with "broken pipe" for tarballs with trailing garbage systemd/systemd#16605
• in NixOS, pixz is apparently used to compress tarballs:

  nixpkgs/nixos/lib/make-system-tarball.nix

  Line 25 in 2a052ab

  , compressCommand ? "pixz"

• the root cause seems to be that that pixz silently appends an "index" to the uncompressed input: pixz | xz -d corrupts data vasi/pixz#65 (comment)
• the probable fix is to call pixz -t

Notify maintainers

N/A, hydra job page does not list maintainers

Metadata

N/A, not on a Nix system