koni_zip 0.9.0

ZIP reader and writer (incl. WinZip AES) for the koni_archive ecosystem, including CBZ comic archives.

Changelog

0.9.0 - 2026-07-17

• Honors ArchiveReadOptions.maxEntryCount: a ZIP whose end-of-central-directory declares more entries than the limit is rejected before the central directory is walked (one record allocated per entry), not only afterward. maxEntrySize is enforced by the shared reader seam.

0.8.0 - 2026-07-16

• The writer honors ArchiveWriteOptions.allowUnsafePaths (see koni_archive_core 0.8.0): with it set, an entry path is written verbatim rather than validated. Round-trip tested, a raw ../escape.txt is written, then read back sanitized to escape.txt with pathEscapedRoot set, which is the property a consumer's Zip-Slip defense keys on.

0.7.0 - 2026-07-16

• Lockstep release; no changes to this package since 0.6.0.

0.6.0 - 2026-07-15

• P4-1: ZIP write-side encryption. ArchiveWriteOptions.password encrypts file/symlink entries with WinZip AES-256 (AE-2, method 99): per-entry random salt, PBKDF2-HMAC-SHA1 keys, AES-CTR keystream, HMAC-SHA1 tag (the CRC field is zeroed, as AE-2 requires); directories stay plaintext. Interop: real 7-Zip (7zz x -p) decrypts our output byte-for-byte and rejects a wrong password. Green on VM + dart2js + dart2wasm.
• First release published to pub.dev.

0.5.0 - 2026-07-15

• P3-2: ZIP decryption via ArchiveReadOptions.password. Traditional PKWARE ("zipcrypto") stream cipher and WinZip AES (method 99, AES-128/192/256-CTR + PBKDF2-HMAC-SHA1 + HMAC-SHA1 authentication; AE-1 verifies the plaintext CRC, AE-2 the MAC). Wrong password → InvalidPasswordException; ZIP strong encryption (SES) stays a typed error. Interop: zip(1)/7zz-authored fixtures decrypt byte-identically; green on VM + dart2js + dart2wasm.

0.4.0 - 2026-07-15

• P2-3: ZIP writing: ZipWriter / ZipWriteFormat. Stored + deflate (default, via koni_codecs RawDeflater), streaming append-only output (data descriptors, no seek-back), ZIP64 structures when a size, offset, or entry count overflows the 32-bit/16-bit fields, directories, symlinks, validateWritePath path safety. Interop DoD: Info-ZIP unzip validates and extracts our output byte-for-byte (incl. a 70k-entry ZIP64 archive).

0.3.0 - 2026-07-15

• Lockstep release; no changes since 0.2.0.

0.2.0 - 2026-07-15

• M7 hardening shipped here: see below.

0.1.0 - 2026-07-15

• M7: ZIP hardening.
  • ZIP64: EOCD64 + locator (prefix-tolerant backward scan), per-entry 0x0001 extras; multi-volume ZIP64 disk fields stay typed errors.
  • ArchiveReadOptions.entryNameDecoder hook for unflagged filename encodings (Shift-JIS mojibake).
  • AE-x entries surface the inner method from the 0x9901 extra; strong-encryption flag (bit 6) detected.
  • Data descriptors verified with and without the optional signature.
  • Fuzz-found hardening: hostile 64-bit header fields can no longer wrap negative (uniform 2^53 − 1 cap in core).
• M5: deflate (method 8) entries decode via koni_codecs; CBZ works end-to-end, with CRC-32 verification, decompression-bomb guarding against the claimed size, and decoded-size cross-checks.
• M3: ZIP reader, stored entries.
  • EOCD backward scan: comments, trailing junk, prefixed/SFX archives (offset delta recovery); ZIP64 and multi-volume detected with typed errors.
  • Central-directory parse with hardening (hostile entry counts fail cleanly); local headers validated lazily at openRead.
  • Stored entries stream with CRC-32 verified by default (verifyChecksums: false opt-out); data-descriptor archives read via central values.
  • UTF-8-flag/CP437 name decoding, DOS + UT timestamps, unix modes/symlink typing, encrypted-entry detection; every entry-scoped problem is a typed error at openRead, the rest stays readable.
  • Fixtures generated by Info-ZIP zip(1) (committed, provenance manifest), differential tests vs package:archive, fuzz smoke, and benchmarks recorded in bench/results/.
• M0: package scaffolding: pub workspace membership, shared strict lints, CI matrix (VM on Linux/macOS/Windows; web via dart2js and dart2wasm).