Skip to content

Configurable Salt for AES for Deterministic Zips #223

Open
@Philip-Trettner

Description

@Philip-Trettner

I'm building a reproducible/deterministic build/action system and some parts require password protected zip files.

Some builds were not reproducible and I could narrow it down to the password protected zips.

In particular, the AesWriter::new creates a salt using rand::thread_rng() (https://github.com/zip-rs/zip2/blob/master/src/aes.rs#L240).

As far as I understand it, this makes it impossible to have deterministic/reproducible zips with Aes as you cannot seed the thread_rng.

So my feature request for one of the following:

  • add an option to provide a custom Rng
  • add an option to provide a custom Seed
  • add an option to provide a custom Salt
  • add an option to fall back to a fixed Salt
  • or some other option that makes the process deterministic

(I basically need only a single way to get determinism here. The password itself is derived from a build hash, so there is no security implication in my case afaict.)

I'd be happy to make a PR if you're ok with such an option and provide me with a preferred way.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions