hatchzip Files

Security

This release fixes two security issues. Update if you extract archives into folders that already hold files, or open archives that came together with other files.

• GHSA-cq63-4gv9-w2gc (High), reported by @KKonaNN and independently by Rian (@andzis11). HatchZip first writes each extracted file under its name plus .hatchzip-part. Before this release, a link at that name, such as one an earlier archive extracted into the same folder, made HatchZip write the file wherever the link pointed, outside the output folder, and a file at that name was truncated and replaced. That name is now created only where nothing exists and never through a link, and an archive or output folder that would collide with it is refused before anything is touched. The temporary files behind the progress files next to the archive are created the same way.
• GHSA-m6m5-qcjx-55gv (Medium), reported by Rian (@andzis11). Progress files supplied together with an archive could make a resume delete and replace files already in the archive's default output folder. A resume now uses progress files only for an extraction started on this computer, which records its output folder in your user profile, or when you name the folder again with -o.

An extraction that 0.1.5 or earlier started in the default folder has no such record. To resume it with 0.1.6, name the folder again, for example hatchzip extract game.zip -o game.

Changes

• Replace existing files. When files an archive would write are already in the destination, hatchzip extract --replace, or "Replace" when the app asks, moves them aside until the extraction completes, so a restore can put them back. Without it, HatchZip still refuses before anything is touched.
• Check for updates in the app's Help menu opens the latest release page in your browser. The app itself makes no network connections.
• Portable Windows zip. HatchZip-x64-portable.zip holds the app and the command line tool with nothing to install. Unzip it anywhere and run hatchzip-gui.exe; Settings, "Show in the Explorer context menu", adds the right-click entries for that location and removes them again.
• Crafted archives are refused before anything is touched, or read correctly:
• 7z: a block with no packed bytes no longer truncates the block after it; a header inside the packed data and packed streams that no block uses are refused; headers are indexed without panicking.
• tar: a hard link listed before its file is counted at the file's size.
• .tar.gz: the gzip header is checked as it is read, and its name and comment are capped.
• RAR: quick open copies are checked against the headers and UnRAR's header fields against HatchZip's own, and old-style volume names stop at .z99.
• Every format: data past the end of the file, sizes that add up past what a disk holds, and a new extraction with more than 1 GB after the last entry are refused.
• install.sh runs nothing until the whole script has arrived.
• Each release carries its signed build provenance as a file, and its Windows and macOS programs are checked to import no networking library or socket function before it is published.

Downloads

Every file comes with a SHA-256 checksum and signed build provenance. To check a download:

:::sh
gh attestation verify HatchZip-x64.msi --repo xevrion/hatchzip

Checksums and VirusTotal links for every file: Verify your download.

Package managers: brew install xevrion/tap/hatchzip (command line), brew install --cask xevrion/tap/hatchzip (app), and scoop bucket add xevrion https://github.com/xevrion/scoop-bucket followed by scoop install xevrion/hatchzip.

RAR archives are decoded by UnRAR, under its own license, included with every download.

Full Changelog: https://github.com/xevrion/hatchzip/compare/v0.1.5...v0.1.6