Support zip files as verifiable build sources.

Author: fnando

Cargo.lock

@@ -89,6 +89,7 @@ async-trait = "0.1.76"
 bollard = "0.20.2"
 tar = "0.4.46"
 flate2 = "1.0.30"
+zip = { version = "8.6.0", default-features = false, features = ["deflate"] }
 serde-aux = "4.1.2"
 serde_json = "1.0.82"
 serde = "1.0.82"

Cargo.toml

@@ -113,6 +113,7 @@ futures = "0.3.30"
 home = "0.5.9"
 flate2 = { workspace = true }
 tar = { workspace = true }
+zip = { workspace = true }
 bytesize = "1.3.0"
 humantime = "2.1.0"
 phf = { version = "0.11.2", features = ["macros"] }

cmd/soroban-cli/Cargo.toml

@@ -76,10 +76,53 @@ pub enum Error {
     #[error("could not extract source archive: {0}")]
     ArchiveExtract(std::io::Error),
 
+    #[error("could not extract source archive: {0}")]
+    ZipExtract(zip::result::ZipError),
+
     #[error(transparent)]
     Data(#[from] data::Error),
 }
 
+/// Container formats we can extract a source tree from. This only concerns how
+/// the tree is packed for transport; the tree itself is always wrapped in a
+/// single top-level directory (SEP-58), which callers check after extraction.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum ArchiveFormat {
+    /// Gzipped tarball — what `build --verifiable` produces.
+    TarGz,
+    /// Zip archive.
+    Zip,
+}
+
+/// Recognized archive extensions and the format each maps to, matched
+/// case-insensitively as a suffix of the archive's filename. Single source of
+/// truth for both format detection and the "accepted formats" error text.
+const ARCHIVE_EXTENSIONS: &[(&str, ArchiveFormat)] = &[
+    (".tar.gz", ArchiveFormat::TarGz),
+    (".tgz", ArchiveFormat::TarGz),
+    (".zip", ArchiveFormat::Zip),
+];
+
+impl ArchiveFormat {
+    /// The format named by `filename`'s extension, or `None` if unrecognized.
+    pub(crate) fn from_filename(filename: &str) -> Option<Self> {
+        let lower = filename.to_ascii_lowercase();
+        ARCHIVE_EXTENSIONS
+            .iter()
+            .find(|(ext, _)| lower.ends_with(ext))
+            .map(|(_, format)| *format)
+    }
+
+    /// Comma-separated list of accepted extensions, for error messages.
+    pub(crate) fn recognized_extensions() -> String {
+        ARCHIVE_EXTENSIONS
+            .iter()
+            .map(|(ext, _)| *ext)
+            .collect::<Vec<_>>()
+            .join(", ")
+    }
+}
+
 /// The source tree's root: always the current working directory. The archive is
 /// rooted there as-is — we do NOT search upward for a git repository or anchor on
 /// `--manifest-path`'s directory, since for a workspace member the build needs
@@ -305,11 +348,20 @@ pub(crate) fn unpack_targz(bytes: &[u8], dest: &Path) -> Result<(), Error> {
         .map_err(Error::ArchiveExtract)
 }
 
-/// Create a fresh temp directory, unpack the gzipped source tarball `bytes` into
-/// it, harden its permissions, and return the guard (the tree lives at its
-/// `path()`). Shared by `build --verifiable` (builds from the extracted copy)
-/// and `verify` (rebuilds from it); `prefix` names the dir so the two are
-/// distinguishable on disk.
+/// Unpack a zip archive into `dest`. `ZipArchive::extract` sanitizes each
+/// entry's path (dropping anything that would escape `dest`), so a hostile
+/// archive can't write outside the tempdir.
+pub(crate) fn unpack_zip(bytes: &[u8], dest: &Path) -> Result<(), Error> {
+    zip::ZipArchive::new(std::io::Cursor::new(bytes))
+        .and_then(|mut archive| archive.extract(dest))
+        .map_err(Error::ZipExtract)
+}
+
+/// Create a fresh temp directory, unpack the source archive `bytes` (in the
+/// given `format`) into it, harden its permissions, and return the guard (the
+/// tree lives at its `path()`). Shared by `build --verifiable` (builds from the
+/// extracted copy) and `verify` (rebuilds from it); `prefix` names the dir so
+/// the two are distinguishable on disk.
 ///
 /// The temp dir is created under `<data dir>/tmp`, NOT the OS temp dir: on macOS
 /// `$TMPDIR` lives under /var/folders, which container VMs (Docker Desktop,
@@ -321,6 +373,7 @@ pub(crate) fn unpack_targz(bytes: &[u8], dest: &Path) -> Result<(), Error> {
 pub(crate) fn extract_into_hardened_tempdir(
     bytes: &[u8],
     prefix: &str,
+    format: ArchiveFormat,
 ) -> Result<tempfile::TempDir, Error> {
     let base = data::data_local_dir()?.join("tmp");
     std::fs::create_dir_all(&base).map_err(|source| Error::ArchiveWrite {
@@ -331,7 +384,10 @@ pub(crate) fn extract_into_hardened_tempdir(
         .prefix(prefix)
         .tempdir_in(&base)
         .map_err(Error::ArchiveExtract)?;
-    unpack_targz(bytes, tmp.path())?;
+    match format {
+        ArchiveFormat::TarGz => unpack_targz(bytes, tmp.path())?,
+        ArchiveFormat::Zip => unpack_zip(bytes, tmp.path())?,
+    }
     enforce_hardened_tree(tmp.path()).map_err(Error::ArchiveExtract)?;
     Ok(tmp)
 }
@@ -342,6 +398,56 @@ mod tests {
     use crate::config::locator::enforce_hardened_tree;
     use sha2::{Digest, Sha256};
 
+    #[test]
+    fn archive_format_from_filename() {
+        assert_eq!(
+            ArchiveFormat::from_filename("src.tar.gz"),
+            Some(ArchiveFormat::TarGz)
+        );
+        assert_eq!(
+            ArchiveFormat::from_filename("SRC.TGZ"),
+            Some(ArchiveFormat::TarGz)
+        );
+        assert_eq!(
+            ArchiveFormat::from_filename("src.zip"),
+            Some(ArchiveFormat::Zip)
+        );
+        assert_eq!(ArchiveFormat::from_filename("src.rar"), None);
+        assert_eq!(ArchiveFormat::from_filename("src"), None);
+        // The listed extensions are exactly what the error surfaces.
+        assert_eq!(
+            ArchiveFormat::recognized_extensions(),
+            ".tar.gz, .tgz, .zip"
+        );
+    }
+
+    #[test]
+    fn unpack_zip_round_trips() {
+        use std::io::Write;
+        // Build a small zip with a single top-level `source/` dir.
+        let mut buf = Vec::new();
+        {
+            let mut zip = zip::ZipWriter::new(std::io::Cursor::new(&mut buf));
+            let opts: zip::write::FileOptions<'_, ()> = zip::write::FileOptions::default();
+            zip.start_file("source/Cargo.toml", opts).unwrap();
+            zip.write_all(b"# crate").unwrap();
+            zip.start_file("source/src/lib.rs", opts).unwrap();
+            zip.write_all(b"// code").unwrap();
+            zip.finish().unwrap();
+        }
+
+        let dest = tempfile::TempDir::new().unwrap();
+        unpack_zip(&buf, dest.path()).unwrap();
+        assert_eq!(
+            std::fs::read(dest.path().join("source/Cargo.toml")).unwrap(),
+            b"# crate"
+        );
+        assert_eq!(
+            std::fs::read(dest.path().join("source/src/lib.rs")).unwrap(),
+            b"// code"
+        );
+    }
+
     #[test]
     fn is_warned_matches_names_and_dotted_suffixes() {
         use std::ffi::OsStr;

cmd/soroban-cli/src/commands/contract/build/source_archive.rs

@@ -331,7 +331,11 @@ fn resolve_archive(cmd: &Cmd, source_root: &Path, print: &Print) -> Result<Archi
 
     // Extract and harden, then build from the extracted copy so the WASM is
     // produced from exactly the archived bytes.
-    let tmp = source_archive::extract_into_hardened_tempdir(&bytes, "verifiable-src-")?;
+    let tmp = source_archive::extract_into_hardened_tempdir(
+        &bytes,
+        "verifiable-src-",
+        source_archive::ArchiveFormat::TarGz,
+    )?;
     let extracted_root = tmp.path().to_path_buf();
     Ok(ArchiveResult {
         source_sha256: computed,