From 9951e14ae085c818a11e28c0d530a111c1e2ab86 Mon Sep 17 00:00:00 2001
From: Eelco Dolstra <edolstra@gmail.com>
Date: Thu, 9 May 2024 19:33:09 +0200
Subject: [PATCH] Handle zip files containing symlinks

In streaming mode, libarchive doesn't handle symlinks in zip files
correctly. So write the entire file to disk so libarchive can access
it in random-access mode.

Fixes #10649. This was broken in cabee9815239af426cece729cb765810b8a716ce.
---
 src/libfetchers/tarball.cc          |  20 +++++++++++++++++++-
 tests/functional/flakes/prefetch.sh |   6 ++++++
 tests/functional/flakes/tree.zip    | Bin 0 -> 455 bytes
 tests/functional/local.mk           |   1 +
 4 files changed, 26 insertions(+), 1 deletion(-)
 create mode 100644 tests/functional/flakes/prefetch.sh
 create mode 100644 tests/functional/flakes/tree.zip

diff --git a/src/libfetchers/tarball.cc b/src/libfetchers/tarball.cc
index e19b1850560..d03ff82cedd 100644
--- a/src/libfetchers/tarball.cc
+++ b/src/libfetchers/tarball.cc
@@ -145,9 +145,27 @@ DownloadTarballResult downloadTarball(
 
     // TODO: fall back to cached value if download fails.
 
+    AutoDelete cleanupTemp;
+
     /* Note: if the download is cached, `importTarball()` will receive
        no data, which causes it to import an empty tarball. */
-    TarArchive archive { *source };
+    auto archive =
+        hasSuffix(toLower(parseURL(url).path), ".zip")
+        ? ({
+                /* In streaming mode, libarchive doesn't handle
+                   symlinks in zip files correctly (#10649). So write
+                   the entire file to disk so libarchive can access it
+                   in random-access mode. */
+                auto [fdTemp, path] = createTempFile("nix-zipfile");
+                cleanupTemp.reset(path);
+                debug("downloading '%s' into '%s'...", url, path);
+                {
+                    FdSink sink(fdTemp.get());
+                    source->drainInto(sink);
+                }
+                TarArchive{path};
+          })
+        : TarArchive{*source};
     auto parseSink = getTarballCache()->getFileSystemObjectSink();
     auto lastModified = unpackTarfileToSink(archive, *parseSink);
 
diff --git a/tests/functional/flakes/prefetch.sh b/tests/functional/flakes/prefetch.sh
new file mode 100644
index 00000000000..bfd0533f9d0
--- /dev/null
+++ b/tests/functional/flakes/prefetch.sh
@@ -0,0 +1,6 @@
+source common.sh
+
+# Test symlinks in zip files (#10649).
+path=$(nix flake prefetch --json file://$(pwd)/tree.zip | jq -r .storePath)
+[[ $(cat $path/foo) = foo ]]
+[[ $(readlink $path/bar) = foo ]]
diff --git a/tests/functional/flakes/tree.zip b/tests/functional/flakes/tree.zip
new file mode 100644
index 0000000000000000000000000000000000000000..f9e4d225fe04d51a8fed588cb94352bece51efe9
GIT binary patch
literal 455
zcmWIWW@h1H0D(ufD<i-RD8b4g!%$L`nyMcf!pXpV{jyCO2$xoHGcdBeU}j)oNdYPh
z0BdIgvK|7puShkjV*#>3m;<IgEk7S@!d0N|hnOY+rMV!c05yRfp_p3S12mrjgyE(n
zB^Kdx2hfxNZ$>6LW?X)e0GSR10t{~*K{V87tPr1J_zGeac7H*PVgwqpq|qK`6xf$Q
t(?Gt&VH(I<P#~lF59TlihW`s&VWxq7i_2}SY#@`Ef$%wyJ_X`10033~TCV^A

literal 0
HcmV?d00001

diff --git a/tests/functional/local.mk b/tests/functional/local.mk
index 65ab20f9a4f..17664cd7e3c 100644
--- a/tests/functional/local.mk
+++ b/tests/functional/local.mk
@@ -16,6 +16,7 @@ nix_tests = \
   flakes/absolute-attr-paths.sh \
   flakes/build-paths.sh \
   flakes/flake-in-submodule.sh \
+  flakes/prefetch.sh \
   gc.sh \
   nix-collect-garbage-d.sh \
   remote-store.sh \