Wuffs build fails on Nix nixpkgs-unstable because of ESET Antivirus flagging google wuffs test/data/ hippopotamus-bad-comment-length.jpeg as Trojan Win32/Exploit.MS04-028

[jcollie]

Discussed in #13786

^{Originally posted by KrappRamiro August 13, 2026}

Issue

On systems where an ESET Antivirus inspects files as they're written to disk (e.g. ESET Endpoint with on-access protection), building Ghostty via Nix fails.

This happens because on the build, the test/data/ directory of wuffs is included.
In that directory, there is a file called hippopotamus-bad-comment-length.jpeg , a deliberately malformed JPEG created for testing.

ESET incorrectly flags that file as a Trojan (Win32/Exploit.MS04-028) , breaking the build.

From what i saw on pkg/wuffs/build.zig line 78 , only wuffs release/c/ folder is used.

That means the whole test/data folder is unnecesary, and could be excluded, fixing the issue.

Suggested Fix

The Wuffs maintainer (@nigeltao) suggested in google/wuffs#164 that downstream consumers use google/wuffs-mirror-release-c instead of the full google/wuffs repo.

That mirror contains only the release/c/ directory, which is what pkg/wuffs/build.zig uses

They said It's also smaller and changes less frequently.

Alternatively, the repackaged tarball at deps.files.ghostty.org could simply exclude the test/ directory when it's generated, since the build never reads from it (from what i could see in pkg/wuffs/build.zig

Relevant Info

Please see issue google/wuffs#164 and also #11976