Properly support permissions and symlinks in Zip files (500USD Bounty)

[lihaoyi]

---

From the maintainer Li Haoyi: I'm putting a 500USD bounty on this issue, payable by bank transfer on a merged PR fixing this.

See https://github.com/orgs/com-lihaoyi/discussions/6 for other bounties and the terms and conditions that bounties operate under

---

@kiendang hit some issues using os.zip in Mill (com-lihaoyi/mill#4503), some of which are permissions related. It seems that since 2019 the JDK's zip file APIs should be able to support permissions (https://bugs.java.com/bugdatabase/view_bug?bug_id=8213031), so we should make sure OS-Lib takes advantage to preserve permissions when zipping and unzipping files and folders

[kiendang]

Turned out the problem was all permission related. It worked after executable perm was given to files inside bin and libexec.

Anw can see 2 problems with os.unzip: It does not perserve file permissions and symlinks. After being unzipped from cosmocc.zip (https://cosmo.zip/pub/cosmocc/) with either os.unzip or os.unzip.stream, the files are stripped of permissions (files in bin no longer have executable permission) and all the original symlinks are replaced with copies of the destination files.

[sideeffffect]

https://unix.stackexchange.com/a/509337

Info-Zip 3.0 SUPPORTS preserving files/dirs UNIX permissions and UID/GID ownership data. zip stores it by default but you need to use unzip in an special way to restore them:

• unzip must be used with the -X flag.
• unzip must run as root to set the files/dirs UID/GID. If you run it as a normal user then the UID will be always the one of the current user and the GID will be restored ONLY IF the current user belongs to that group.

Note: you can also use unzip with the -K flag to also restore SUID/SGID/Sticky bits.

[kiendang]

Extra fields have been used to store information about POSIX permissions and symlink though. jdk.zipfs does support POSIX permissions from JDK 14.

os-lib uses java.util.zip.ZipEntry which does not expose this information though. It's stored in the private ZipEntry.extraAttributes field. There's talk on making it accessible but I don't think it's gonna be resolved any time soon judging on the lack of activity.

Apache Commons and Apache Ant's own implementation of ZipEntry does support permissions (but obviously we're not adding external deps here).

So for a quick fix I think can use jdk.zipfs to support permissions for os.zip and os.unzip (only for Path, not .stream).

[kiendang]

@sideeffffect java.util.zip is based on the Info-ZIP format anyway. Just that the field that contains the information is unexposed...