From 9994e4df96fdedd44fba7f11d37ad8600467d494 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Fri, 16 Aug 2024 17:01:15 -0700
Subject: [PATCH 1/3] tinyxxd: init at 1.3.5

---
 pkgs/by-name/ti/tinyxxd/package.nix | 50 +++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 pkgs/by-name/ti/tinyxxd/package.nix

diff --git a/pkgs/by-name/ti/tinyxxd/package.nix b/pkgs/by-name/ti/tinyxxd/package.nix
new file mode 100644
index 000000000000..a19f9d7ef3f3
--- /dev/null
+++ b/pkgs/by-name/ti/tinyxxd/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  installShellFiles,
+  vim,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tinyxxd";
+  version = "1.3.5";
+
+  src = fetchFromGitHub {
+    repo = "tinyxxd";
+    owner = "xyproto";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-W7BrQga98ACrhTHF3UlGQMRmcdJaxgorDP6FpD5mr2A=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installFlags = [ "PREFIX=$(out)" ];
+
+  postInstall = ''
+    installManPage tinyxxd.1
+
+    # Allow using `tinyxxd` as `xxd`. This is similar to the Arch packaging.
+    # https://gitlab.archlinux.org/archlinux/packaging/packages/tinyxxd/-/blob/main/PKGBUILD
+    ln -s $out/bin/{tiny,}xxd
+    ln -s $out/share/man/man1/{tiny,}xxd.1.gz
+  '';
+
+  meta = {
+    homepage = "https://github.com/xyproto/tinyxxd";
+    description = "Drop-in replacement and standalone version of the hex dump utility that comes with ViM";
+    license = [
+      lib.licenses.mit # or
+      lib.licenses.gpl2Only
+    ];
+    mainProgram = "tinyxxd";
+    maintainers = with lib.maintainers; [
+      emily
+      philiptaron
+    ];
+    platforms = lib.platforms.unix;
+
+    # If the two `xxd` providers are present, choose this one.
+    priority = (vim.xxd.meta.priority or lib.meta.defaultPriority) - 1;
+  };
+})

From 7118909e8222d9d7dd4dbf8c153c8a0cae9a87a1 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Fri, 16 Aug 2024 17:23:49 -0700
Subject: [PATCH 2/3] unixtools: use tinyxxd to serve up xxd

---
 pkgs/top-level/unixtools.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/top-level/unixtools.nix b/pkgs/top-level/unixtools.nix
index 959d87d5864d..93bb34bba20d 100644
--- a/pkgs/top-level/unixtools.nix
+++ b/pkgs/top-level/unixtools.nix
@@ -224,9 +224,9 @@ let
       darwin = pkgs.darwin.basic_cmds;
     };
     xxd = {
-      linux = pkgs.vim.xxd;
-      darwin = pkgs.vim.xxd;
-      freebsd = pkgs.vim.xxd;
+      linux = pkgs.tinyxxd;
+      darwin = pkgs.tinyxxd;
+      freebsd = pkgs.tinyxxd;
     };
   };
 

From 04cf7c0cd4faa09e36f264bfb326c21e7d63a349 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Fri, 16 Aug 2024 17:17:44 -0700
Subject: [PATCH 3/3] doc: add release note about `xxd` now being provided by
 `tinyxxd` instead of `vim.xxd`

---
 nixos/doc/manual/release-notes/rl-2411.section.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2411.section.md b/nixos/doc/manual/release-notes/rl-2411.section.md
index dd8d377e14eb..f9672d9bfe57 100644
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@@ -417,6 +417,8 @@
 
 - The `shadowstack` hardening flag has been added, though disabled by default.
 
+- `xxd` is now provided by the `tinyxxd` package, rather than `vim.xxd`, to reduce closure size and vulnerability impact. Since it has the same options and semantics as Vim's `xxd` utility, there is no user impact. Vim's `xxd` remains available as the `vim.xxd` package.
+
 - `restic` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.restic.backups.<name>.inhibitsSleep`](#opt-services.restic.backups._name_.inhibitsSleep).
 
 - Support for *runner registration tokens* has been [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/380872)