rubyzip 3.0.2 → 3.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c4afc6447f838d0d2edc82bb44ab842a5c45f50bd47d453aae1a7b487c9dcbee
-  data.tar.gz: 776833d664351c8e0323826263d16b2b11486fee80a7ceda1a8385d05dd2a38e
+  metadata.gz: 6f572a7ce284e7e1dcdd10b0ba8e278c862957e9ac47d1b00dad5ea26db6fcba
+  data.tar.gz: 8afd167d9dcd0b902d79d1dc4111964c3edb75739419cd30cff9ebc36c38bdc7
 SHA512:
-  metadata.gz: b52059d2cfba5c05959bb347383d4bfe79c8f3c0f945cba64362462267c750f0e16e13f63fbf272b2cf0935173678b876164c3993ddae85fb89dec726afea940
-  data.tar.gz: 83a932fbadf6fbafa0a1e64434f0b2a2b7f58fb56d9015350eae217430f9afaf5492254a56de9be124bdf9676a8a5aa373515c996ce2f74966aceb87b72472d1
+  metadata.gz: e09c8b007382e0243cdb57d63560d5b6c8ef9a153c8dafc35a1c284ad41dc49c5afc284cf6175ffc311691e98dcdd81221cee8f2d1b060a665ade5de11d00c58
+  data.tar.gz: 306dfe485b10b421d4232c44314bd609c14004b3f0b1b8d76d7ef78234f6a34dc76eae38126a53ac34553f7538a87a807991be1d5b06b8788a81bd8eba723fdc

data/Changelog.md

@@ -1,3 +1,11 @@
+# 3.1.0 (2025-09-06)
+
+- Support AES decryption. [#579](https://github.com/rubyzip/rubyzip/pull/579) and [#645](https://github.com/rubyzip/rubyzip/pull/645)
+
+Tooling/internal:
+
+- Add various useful zip specification documents to the repo for ease of finding them in the future. These are not included in the gem release.
+
 # 3.0.2 (2025-08-21)
 
 - Fix `InputStream#sysread` to handle frozen string literals. [#643](https://github.com/rubyzip/rubyzip/pull/643)

data/README.md

@@ -201,11 +201,11 @@ end
 
 Any attempt to move about in a zip file opened with `Zip::InputStream` could result in the incorrect entry being accessed and/or Zlib buffer errors. If you need random access in a zip file, use `Zip::File`.
 
-### Password Protection (Experimental)
+### Password Protection (experimental)
 
-Rubyzip supports reading/writing zip files with traditional zip encryption (a.k.a. "ZipCrypto"). AES encryption is not yet supported. It can be used with buffer streams, e.g.:
+Rubyzip supports reading zip files with AES encryption (version 3.1 and later), and reading and writing zip files with traditional zip encryption (a.k.a. "ZipCrypto"). Encryption is currently only available with the stream API, with either files or buffers, e.g.:
 
-#### Version 2.x
+#### Version 2.x (ZipCrypto only)
 
 ```ruby
 # Writing.
@@ -224,9 +224,17 @@ Zip::InputStream.open(buffer, 0, dec) do |input|
 end
 ```
 
-#### Version 3.x
+#### Version 3.x (AES reading and ZipCrypto read/write)
 
 ```ruby
+# Reading AES, version 3.1 and later.
+dec = Zip::AESDecrypter.new('password', Zip::AESEncryption::STRENGTH_256_BIT)
+Zip::InputStream.open('aes-encrypted-file.zip', decrypter: dec) do |input|
+  entry = input.get_next_entry
+  puts "Contents of '#{entry.name}':"
+  puts input.read
+end
+
 # Writing.
 enc = Zip::TraditionalEncrypter.new('password')
 buffer = Zip::OutputStream.write_buffer(encrypter: enc) do |output|
@@ -243,7 +251,7 @@ Zip::InputStream.open(buffer, decrypter: dec) do |input|
 end
 ```
 
-_This is an experimental feature and the interface for encryption may change in future versions._
+_This is an evolving feature and the interface for encryption may change in future versions._
 
 ## Known issues
 

data/lib/zip/crypto/aes_encryption.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+require 'openssl'
+
+module Zip
+  module AESEncryption # :nodoc:
+    VERIFIER_LENGTH = 2
+    BLOCK_SIZE = 16
+    AUTHENTICATION_CODE_LENGTH = 10
+
+    VERSION_AE_1 = 0x01
+    VERSION_AE_2 = 0x02
+
+    VERSIONS = [
+      VERSION_AE_1,
+      VERSION_AE_2
+    ].freeze
+
+    STRENGTH_128_BIT = 0x01
+    STRENGTH_192_BIT = 0x02
+    STRENGTH_256_BIT = 0x03
+
+    STRENGTHS = [
+      STRENGTH_128_BIT,
+      STRENGTH_192_BIT,
+      STRENGTH_256_BIT
+    ].freeze
+
+    BITS = {
+      STRENGTH_128_BIT => 128,
+      STRENGTH_192_BIT => 192,
+      STRENGTH_256_BIT => 256
+    }.freeze
+
+    KEY_LENGTHS = {
+      STRENGTH_128_BIT => 16,
+      STRENGTH_192_BIT => 24,
+      STRENGTH_256_BIT => 32
+    }.freeze
+
+    SALT_LENGTHS = {
+      STRENGTH_128_BIT => 8,
+      STRENGTH_192_BIT => 12,
+      STRENGTH_256_BIT => 16
+    }.freeze
+
+    def initialize(password, strength)
+      @password = password
+      @strength = strength
+      @bits = BITS[@strength]
+      @key_length = KEY_LENGTHS[@strength]
+      @salt_length = SALT_LENGTHS[@strength]
+    end
+
+    def header_bytesize
+      @salt_length + VERIFIER_LENGTH
+    end
+
+    def gp_flags
+      0x0001
+    end
+  end
+
+  class AESDecrypter < Decrypter # :nodoc:
+    include AESEncryption
+
+    def decrypt(encrypted_data)
+      @hmac.update(encrypted_data)
+
+      idx = 0
+      decrypted_data = +''
+      amount_to_read = encrypted_data.size
+
+      while amount_to_read.positive?
+        @cipher.iv = [@counter + 1].pack('Vx12')
+        begin_index = BLOCK_SIZE * idx
+        end_index = begin_index + [BLOCK_SIZE, amount_to_read].min
+        decrypted_data << @cipher.update(encrypted_data[begin_index...end_index])
+        amount_to_read -= BLOCK_SIZE
+        @counter += 1
+        idx += 1
+      end
+
+      # JRuby requires finalization of the cipher. This is a bug, as noted in
+      # jruby/jruby-openssl#182 and jruby/jruby-openssl#183.
+      decrypted_data << @cipher.final if defined?(JRUBY_VERSION)
+      decrypted_data
+    end
+
+    def reset!(header)
+      raise Error, "Unsupported encryption AES-#{@bits}" unless STRENGTHS.include? @strength
+
+      salt = header[0...@salt_length]
+      pwd_verify = header[-VERIFIER_LENGTH..]
+      key_material = OpenSSL::KDF.pbkdf2_hmac(
+        @password,
+        salt:       salt,
+        iterations: 1000,
+        length:     (2 * @key_length) + VERIFIER_LENGTH,
+        hash:       'sha1'
+      )
+      enc_key = key_material[0...@key_length]
+      enc_hmac_key = key_material[@key_length...(2 * @key_length)]
+      enc_pwd_verify = key_material[-VERIFIER_LENGTH..]
+
+      raise Error, 'Bad password' if enc_pwd_verify != pwd_verify
+
+      @counter = 0
+      @cipher = OpenSSL::Cipher::AES.new(@bits, :CTR)
+      @cipher.decrypt
+      @cipher.key = enc_key
+      @hmac = OpenSSL::HMAC.new(enc_hmac_key, OpenSSL::Digest.new('SHA1'))
+    end
+
+    def check_integrity(auth_code)
+      raise Error, 'Integrity fault' if @hmac.digest[0...AUTHENTICATION_CODE_LENGTH] != auth_code
+    end
+  end
+end

data/lib/zip/crypto/decrypted_io.rb

@@ -4,9 +4,11 @@ module Zip
   class DecryptedIo # :nodoc:all
     CHUNK_SIZE = 32_768
 
-    def initialize(io, decrypter)
+    def initialize(io, decrypter, compressed_size)
       @io = io
       @decrypter = decrypter
+      @offset = io.tell
+      @compressed_size = compressed_size
     end
 
     def read(length = nil, outbuf = +'')
@@ -18,6 +20,10 @@ module Zip
         buffer << produce_input
       end
 
+      if @decrypter.kind_of?(::Zip::AESDecrypter) && input_finished?
+        @decrypter.check_integrity(@io.read(::Zip::AESEncryption::AUTHENTICATION_CODE_LENGTH))
+      end
+
       outbuf.replace(buffer.slice!(0...(length || buffer.bytesize)))
     end
 
@@ -31,12 +37,19 @@ module Zip
       @buffer ||= +''
     end
 
+    def pos
+      @io.tell - @offset
+    end
+
     def input_finished?
-      @io.eof
+      @io.eof || pos >= @compressed_size
     end
 
     def produce_input
-      @decrypter.decrypt(@io.read(CHUNK_SIZE))
+      chunk_size = [CHUNK_SIZE, @compressed_size - pos].min
+      return '' unless chunk_size.positive?
+
+      @decrypter.decrypt(@io.read(chunk_size))
     end
   end
 end

data/lib/zip/entry.rb

@@ -203,6 +203,11 @@ module Zip
       !@extra['Zip64'].nil?
     end
 
+    # Is this entry encrypted with AES encryption?
+    def aes?
+      !@extra['AES'].nil?
+    end
+
     def file_type_is?(type) # :nodoc:
       ftype == type
     end
@@ -382,6 +387,7 @@ module Zip
 
       read_extra_field(extra, local: true)
       parse_zip64_extra(true)
+      parse_aes_extra
       @local_header_size = calculate_local_header_size
     end
 
@@ -511,6 +517,7 @@ module Zip
       check_c_dir_entry_comment_size
       set_ftype_from_c_dir_entry
       parse_zip64_extra(false)
+      parse_aes_extra
     end
 
     def file_stat(path) # :nodoc:
@@ -800,6 +807,20 @@ module Zip
       end
     end
 
+    def parse_aes_extra # :nodoc:
+      return unless aes?
+
+      if @extra['AES'].vendor_id != 'AE'
+        raise Error, "Unsupported encryption method #{@extra['AES'].vendor_id}"
+      end
+
+      unless ::Zip::AESEncryption::VERSIONS.include? @extra['AES'].vendor_version
+        raise Error, "Unsupported encryption style #{@extra['AES'].vendor_version}"
+      end
+
+      @compression_method = @extra['AES'].compression_method if ftype != :directory
+    end
+
     # For DEFLATED compression *only*: set the general purpose flags 1 and 2 to
     # indicate compression level. This seems to be mainly cosmetic but they are
     # generally set by other tools - including in docx files. It is these flags

data/lib/zip/extra_field/aes.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+module Zip
+  # Info-ZIP Extra for AES encryption
+  class ExtraField::AES < ExtraField::Generic # :nodoc:
+    attr_reader :vendor_version, :vendor_id, :encryption_strength, :compression_method
+
+    HEADER_ID = [0x9901].pack('v')
+    register_map
+
+    def initialize(binstr = nil)
+      @vendor_version = nil
+      @vendor_id = nil
+      @encryption_strength = nil
+      @compression_method = nil
+      binstr && merge(binstr)
+    end
+
+    def ==(other)
+      @vendor_version == other.vendor_version &&
+        @vendor_id == other.vendor_id &&
+        @encryption_strength == other.encryption_strength &&
+        @compression_method == other.compression_method
+    end
+
+    def merge(binstr)
+      return if binstr.empty?
+
+      size, content = initial_parse(binstr)
+      (size && content) || return
+
+      @vendor_version, @vendor_id,
+        @encryption_strength, @compression_method = content.unpack('va2Cv')
+    end
+
+    def pack_for_local
+      [@vendor_version, @vendor_id,
+       @encryption_strength, @compression_method].pack('va2Cv')
+    end
+
+    def pack_for_c_dir
+      pack_for_local
+    end
+  end
+end

data/lib/zip/extra_field.rb

@@ -91,6 +91,7 @@ require 'zip/extra_field/old_unix'
 require 'zip/extra_field/unix'
 require 'zip/extra_field/zip64'
 require 'zip/extra_field/ntfs'
+require 'zip/extra_field/aes'
 
 # Copyright (C) 2002, 2003 Thomas Sondergaard
 # rubyzip is free software; you can redistribute it and/or

data/lib/zip/input_stream.rb

@@ -154,7 +154,20 @@ module Zip
       header = @archive_io.read(@decrypter.header_bytesize)
       @decrypter.reset!(header)
 
-      ::Zip::DecryptedIo.new(@archive_io, @decrypter)
+      compressed_size =
+        if @current_entry.incomplete? && @current_entry.crc == 0 &&
+           @current_entry.compressed_size == 0 && @complete_entry
+          @complete_entry.compressed_size
+        else
+          @current_entry.compressed_size
+        end
+
+      if @decrypter.kind_of?(::Zip::AESDecrypter)
+        compressed_size -= @decrypter.header_bytesize
+        compressed_size -= ::Zip::AESEncryption::AUTHENTICATION_CODE_LENGTH
+      end
+
+      ::Zip::DecryptedIo.new(@archive_io, @decrypter, compressed_size)
     end
 
     def get_decompressor # :nodoc:

data/lib/zip/version.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
 module Zip
-  VERSION = '3.0.2'
+  # The version of the Rubyzip library.
+  VERSION = '3.1.0'
 end

data/lib/zip.rb

@@ -30,6 +30,7 @@ require 'zip/crypto/decrypted_io'
 require 'zip/crypto/encryption'
 require 'zip/crypto/null_encryption'
 require 'zip/crypto/traditional_encryption'
+require 'zip/crypto/aes_encryption'
 require 'zip/inflater'
 require 'zip/deflater'
 require 'zip/streamable_stream'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubyzip
 version: !ruby/object:Gem::Version
-  version: 3.0.2
+  version: 3.1.0
 platform: ruby
 authors:
 - Robert Haines
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-08-21 00:00:00.000000000 Z
+date: 2025-09-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -141,6 +141,7 @@ files:
 - lib/zip/central_directory.rb
 - lib/zip/compressor.rb
 - lib/zip/constants.rb
+- lib/zip/crypto/aes_encryption.rb
 - lib/zip/crypto/decrypted_io.rb
 - lib/zip/crypto/encryption.rb
 - lib/zip/crypto/null_encryption.rb
@@ -153,6 +154,7 @@ files:
 - lib/zip/entry_set.rb
 - lib/zip/errors.rb
 - lib/zip/extra_field.rb
+- lib/zip/extra_field/aes.rb
 - lib/zip/extra_field/generic.rb
 - lib/zip/extra_field/ntfs.rb
 - lib/zip/extra_field/old_unix.rb
@@ -195,9 +197,9 @@ licenses:
 - BSD-2-Clause
 metadata:
   bug_tracker_uri: https://github.com/rubyzip/rubyzip/issues
-  changelog_uri: https://github.com/rubyzip/rubyzip/blob/v3.0.2/Changelog.md
-  documentation_uri: https://www.rubydoc.info/gems/rubyzip/3.0.2
-  source_code_uri: https://github.com/rubyzip/rubyzip/tree/v3.0.2
+  changelog_uri: https://github.com/rubyzip/rubyzip/blob/v3.1.0/Changelog.md
+  documentation_uri: https://www.rubydoc.info/gems/rubyzip/3.1.0
+  source_code_uri: https://github.com/rubyzip/rubyzip/tree/v3.1.0
   wiki_uri: https://github.com/rubyzip/rubyzip/wiki
   rubygems_mfa_required: 'true'
 post_install_message:
@@ -215,7 +217,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.1
+rubygems_version: 3.4.19
 signing_key:
 specification_version: 4
 summary: rubyzip is a ruby module for reading and writing zip files