4 Commits

Author SHA1 Message Date
unkin-agent 27b182f1c3 Report a directory that collides with a file
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
vim.fn.mkdir raises when a path component is an existing file, and an
archive can arrange that by shipping a file and then a path under it.
Return nil, err from mkdirp and propagate it.
2026-09-10 23:30:48 +10:00
unkin-agent 11c8fbf485 Aim the truncated-directory test at the raising path
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
A record whose name is cut short already reported; the raise needed a
zero-length name and a directory offset pointing into the trailing
comment. Build that case instead.
2026-09-10 23:27:22 +10:00
unkin-agent 78a5df6cf3 Test the DEFLATE path with real compressed fixtures
The fixture builder only produced stored entries, so the vendored inflate
never ran under test. Add a small DEFLATE encoder and drive zip and
tar.gz entries through it: round-trips for fixed and dynamic huffman,
empty and large payloads, plus wrong CRC, wrong stated size, truncated
and corrupted streams, and a traversal name on a compressed entry.

Also cover the central directory and local header truncations that used
to raise.
2026-09-10 23:27:22 +10:00
unkin-agent 5809a843c8 Extract archives in pure Lua
ci/woodpecker/pr/test Pipeline was successful
ci/woodpecker/pr/lint Pipeline was successful
ci/woodpecker/pr/pre-commit Pipeline was successful
Installing a plugin no longer needs unzip or tar on PATH, and entry paths
are vetted in Lua instead of trusting an external tool.

Add arti-pack.archive: a zip reader over zzlib's inflate and a tar reader
over its gunzip.
Reject absolute, parent-walking, backslashed and NUL-bearing entry names,
and any entry that is not a regular file or directory.
Verify every zip entry's CRC32 and size, and fail the install on mismatch.
Carry only the executable bit from archive modes.
Replace fs.extract_cmd with fs.extract and call it synchronously.
Drop unzip from the test pipeline and the stated requirements.
2026-09-10 22:48:25 +10:00