Security
This release fixes GHSA-446w-m5mg-2f58 (High), reported by @Valcyle. Update if you open archives that came together with other files.
HatchZip keeps two progress files next to an archive while it extracts, <archive>.hatchzip and <archive>.hatchzip-tail, so a stopped extraction can resume. Before this release, progress files planted next to an archive, for example inside a downloaded bundle, could make a resume shrink or delete other files, or create links outside the output folder. A resume now uses them only when:
- every volume they name is one of that archive's own volumes, and none of them is a link;
- every link they name is inside the output folder, and no link already in the output folder lies on the way;
- the output folder is the default one next to the archive, a folder chosen on this computer, or the folder named again with
-o.
Anything else is refused before a file is changed. Folders you choose with -o or in the app are recorded in your user profile, so a resume on the same computer works as before. To continue on another computer, name the folder again with -o.
Also published: GHSA-6rh6-c2xg-gj28 (High), reported by Benjamin Kincses (@Dextheking1), a link entry below another link entry. It was already fixed in 0.1.3.
Changes
hatchzip restoreaccepts-oto name the output folder of the extraction it undoes.- HatchZip refuses to extract into a default output folder that is a link, and to change an archive volume that is a link.
- CodeQL analysis of the Rust code and the workflows runs on every change.
Downloads
Every file comes with a SHA-256 checksum and signed build provenance. To check a download:
:::sh
gh attestation verify HatchZip-x64.msi --repo xevrion/hatchzip
Checksums and VirusTotal links for every file: Verify your download.
Package managers: brew install xevrion/tap/hatchzip (command line), brew install --cask xevrion/tap/hatchzip (app), and scoop bucket add xevrion https://github.com/xevrion/scoop-bucket followed by scoop install xevrion/hatchzip.
RAR archives are decoded by UnRAR, under its own license, included with every download.
Full Changelog: https://github.com/xevrion/hatchzip/compare/v0.1.4...v0.1.5
