The xz reader is github.com/therootcompany/xz, declared in go.mod as build-agent declares it, with build-agent's framing walk copied (xz_framing.go and its tests): too many blocks or streams are refused before anything is decoded, a dictionary over 64 MiB is refused. The same release tar under gzip and under xz packs to the build agent's archive.