Pierre Bourdon on Nostr: to avoid buffering archives in their packed form (either to RAM or to disk), Nix ...

to avoid buffering archives in their packed form (either to RAM or to disk), Nix streams unpacking to the /nix/store and checks the signature of the extracted data at the end. Which in theory is fine... until you have a vuln at unpacking time like this one. Or a vuln in the NAR parser (which isn't fuzzed, afaik).