HatchZip v0.1.5

Security

This release fixes GHSA-446w-m5mg-2f58 (High), reported by @Valcyle. Update if you open archives that came together with other files.

HatchZip keeps two progress files next to an archive while it extracts, <archive>.hatchzip and <archive>.hatchzip-tail, so a stopped extraction can resume. Before this release, progress files planted next to an archive, for example inside a downloaded bundle, could make a resume shrink or delete other files, or create links outside the output folder. A resume now uses them only when:

• every volume they name is one of that archive's own volumes, and none of them is a link;
• every link they name is inside the output folder, and no link already in the output folder lies on the way;
• the output folder is the default one next to the archive, a folder chosen on this computer, or the folder named again with -o.

Anything else is refused before a file is changed. Folders you choose with -o or in the app are recorded in your user profile, so a resume on the same computer works as before. To continue on another computer, name the folder again with -o.

Also published: GHSA-6rh6-c2xg-gj28 (High), reported by Benjamin Kincses (@Dextheking1), a link entry below another link entry. It was already fixed in 0.1.3.

Changes

• hatchzip restore accepts -o to name the output folder of the extraction it undoes.
• HatchZip refuses to extract into a default output folder that is a link, and to change an archive volume that is a link.
• CodeQL analysis of the Rust code and the workflows runs on every change.

Downloads

Every file comes with a SHA-256 checksum and signed build provenance. To check a download:

gh attestation verify HatchZip-x64.msi --repo xevrion/hatchzip

Checksums and VirusTotal links for every file: Verify your download.

Package managers: brew install xevrion/tap/hatchzip (command line), brew install --cask xevrion/tap/hatchzip (app), and scoop bucket add xevrion https://github.com/xevrion/scoop-bucket followed by scoop install xevrion/hatchzip.

RAR archives are decoded by UnRAR, under its own license, included with every download.

Full Changelog: v0.1.4...v0.1.5