server/repository/zip-entry/Cargo.toml
[package]
name = "holger-zip-entry"
version = "3.1.1"
edition = "2021"
authors = ["Ignalina ApS", "Vetra Automation AB"]
description = "Bounded ZIP central-directory reader for holger's archive-backed backends — reads ONE named member out of a .nupkg / Composer dist zip without trusting the declared sizes, refusing traversal paths and decompression bombs."
license = "AGPL-3.0-only"
repository = "https://git.gunnar.rs/nordisk/holger"
categories = ["command-line-utilities","development-tools"]
keywords = ["zip", "deflate", "nupkg", "composer", "airgap"]
[dependencies]
anyhow = "1.0.104"
# Raw-DEFLATE inflate for the one member being read. Already in-tree (deb, gem,
# npm, rust all pull flate2 1.x), so this adds no new crate to the airgap
# dependency surface. The decode is STREAMED through `Read::take`, so a crafted
# member cannot allocate past the caller's cap no matter what the central
# directory declares. Unlike the tar.gz path there is no `lgz` equivalent here:
# `lgz` splits a GZIP stream into members, and a zip member is a bare DEFLATE
# stream of a single small metadata file (.nuspec / composer.json), so there is
# nothing to parallelise inside one read — the parallelism in this lane is
# ACROSS members, driven by the caller.
flate2 = "1"
# nornir-testmatrix functional-status emitter — gated, optional, compiled OUT for
# release. `--features testmatrix` turns the self-test emit calls into real rows
# that `nornir test` reads; OFF by default the dep is never pulled.
[dependencies.nornir-testmatrix]
version = "0.2.13"
optional = true
[features]
# `fixtures` exposes the in-crate zip WRITER (`fixture::zip`) to the two
# consumer crates' tests, so a `.nupkg` / Composer dist fixture is built once
# here instead of twice there. Never on in a shipped build.
fixtures = []
testmatrix = ["dep:nornir-testmatrix", "nornir-testmatrix/testmatrix"]
[dev-dependencies]
traits = { package = "holger-traits", path = "../../../traits", features = ["test-support"] }