rubyzip 3.5.0 → 3.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 127a7ca4438d6d96f18b7f9699d47491e416ddcc6dbcc0bc8f83f8335a2d516c
-  data.tar.gz: f305dbf4d5f909f1218f11c9400cf41b5645a20233ccdfec8b4416a533d558de
+  metadata.gz: 8ad461af594aaafc83f2a9af47a7e72681431835864534c174970e2245748764
+  data.tar.gz: 6c5bd535a0b049a606bd64ca90106e633c385926d91c32ca3db72314d2b031f0
 SHA512:
-  metadata.gz: c7aaa339ad47862c661b1f284cb1bd38ae65583fb623b85307e20b79f3d871fb3d87254b3a183aee3ba52a16cf8865ed88118919f8997d966384a60c98141234
-  data.tar.gz: d19bb9446945b5d5612e2b3c10dff6727f32d638fe738829ac7bcf5929d20e429683e76a3cc84543ae607c6e2d3941fcf104357e9d3d52670e0547667e43c849
+  metadata.gz: ecd014dee5b905fe5a85af4273e564a0abbdb9c75409a489363352999b2298bfa6baf311c4722c022ddd87807e402d2b9b03f54ec2c110a4cf8c882ed916d301
+  data.tar.gz: 7711a4b6bd467e46d020b9d36b58ad726c0ff312d2247e49c9030cbdfb53d206dd5e16ddbb265f34f3f9802c728de06517926de352db7fac8f43ceafd3a3f496

data/Changelog.md

@@ -1,3 +1,16 @@
+# 3.6.0 (2026-09-01)
+
+- Forward options from OutputStream.open without a block. [#674](https://github.com/rubyzip/rubyzip/pull/674)
+- Clamp DOS date and time to the range the fields can hold. [#671](https://github.com/rubyzip/rubyzip/pull/671)
+
+Tooling/internal:
+
+- Unix owner ids no longer default to 0 (root).
+- Legacy Unix owner ids no longer default to 0 (root).
+- Handle short reads in `copy_stream_n`. [#675](https://github.com/rubyzip/rubyzip/pull/675)
+- Retain required Zip64 offset fields. [#676](https://github.com/rubyzip/rubyzip/pull/676)
+- Load openssl only when AES encryption is used. [#672](https://github.com/rubyzip/rubyzip/pull/672)
+
 # 3.5.0 (2026-08-18)
 
 - Fix the link to Ruby doc in README to the latest version. [#670](https://github.com/rubyzip/rubyzip/pull/670)

data/lib/zip/crypto/aes_encryption.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require 'openssl'
-
 module Zip
   module AESEncryption # :nodoc:
     VERIFIER_LENGTH = 2
@@ -45,6 +43,11 @@ module Zip
     }.freeze
 
     def initialize(password, strength)
+      # Loaded here rather than at the top of the file so that `require 'zip'`
+      # does not pull in openssl. Only AES-encrypted archives need it, and it
+      # is the single largest cost of loading this library.
+      require 'openssl'
+
       @password = password
       @strength = strength
       @bits = BITS[@strength]

data/lib/zip/dos_time.rb

@@ -16,6 +16,18 @@ module Zip
     # bits 5-8 month (1-12)
     # bits 9-15 year (four digit year minus 1980)
 
+    # The MS-DOS date field is seven bits of "year minus 1980", so only
+    # 1980-01-01 00:00:00 through 2107-12-31 23:59:58 can be represented.
+    # Times outside that are clamped rather than allowed to wrap: the real
+    # time is still carried in the universal time (UT) extra field, but the
+    # DOS fields have to stay in range for readers that only look at those.
+    DOS_EPOCH_YEAR = 1980
+    DOS_MAX_YEAR = 2107
+    DOS_MIN_DATE = 0x0021 # 1980-01-01
+    DOS_MAX_DATE = 0xff9f # 2107-12-31
+    DOS_MIN_TIME = 0x0000 # 00:00:00
+    DOS_MAX_TIME = 0xbf7d # 23:59:58
+
     attr_writer :absolute_time # :nodoc:
 
     def absolute_time?
@@ -25,15 +37,21 @@ module Zip
     end
 
     def to_binary_dos_time
+      return DOS_MIN_TIME if year < DOS_EPOCH_YEAR
+      return DOS_MAX_TIME if year > DOS_MAX_YEAR
+
       (sec / 2) +
         (min << 5) +
         (hour << 11)
     end
 
     def to_binary_dos_date
+      return DOS_MIN_DATE if year < DOS_EPOCH_YEAR
+      return DOS_MAX_DATE if year > DOS_MAX_YEAR
+
       day +
         (month << 5) +
-        ((year - 1980) << 9)
+        ((year - DOS_EPOCH_YEAR) << 9)
     end
 
     # Deprecated. Remove for version 4.

data/lib/zip/extra_field/old_unix.rb

@@ -7,8 +7,8 @@ module Zip
     register_map
 
     def initialize(binstr = nil)
-      @uid = 0
-      @gid = 0
+      @uid = nil
+      @gid = nil
       @atime = nil
       @mtime = nil
       binstr && merge(binstr)

data/lib/zip/extra_field/unix.rb

@@ -7,8 +7,8 @@ module Zip
     register_map
 
     def initialize(binstr = nil)
-      @uid = 0
-      @gid = 0
+      @uid = nil
+      @gid = nil
       binstr && merge(binstr)
     end
 

data/lib/zip/extra_field/zip64.rb

@@ -59,8 +59,8 @@ module Zip
     # We can suppress the zip64 extra field unless we know the size is large or
     # the relative header offset is large (for central directory entries).
     def suppress?
-      !(@original_size && @original_size >= 0xFFFFFFFF) ||
-        (@relative_header_offset && @relative_header_offset >= 0xFFFFFFFF)
+      !((@original_size && @original_size >= 0xFFFFFFFF) ||
+        (@relative_header_offset && @relative_header_offset >= 0xFFFFFFFF))
     end
 
     def pack_for_local

data/lib/zip/ioextras.rb

@@ -13,8 +13,11 @@ module Zip
         toread = nbytes
         while toread > 0 && !istream.eof?
           tr = [toread, CHUNK_SIZE].min
-          ostream.write(istream.read(tr, +''))
-          toread -= tr
+          chunk = istream.read(tr, +'')
+          break if !chunk || chunk.empty?
+
+          ostream.write(chunk)
+          toread -= chunk.bytesize
         end
       end
     end

data/lib/zip/output_stream.rb

@@ -53,7 +53,13 @@ module Zip
       # stream is passed to the block and closed when the block
       # returns.
       def open(file_name, encrypter: nil, suppress_extra_fields: false)
-        return new(file_name) unless block_given?
+        unless block_given?
+          return new(
+            file_name,
+            encrypter:             encrypter,
+            suppress_extra_fields: suppress_extra_fields
+          )
+        end
 
         zos = new(file_name, stream: false, encrypter: encrypter,
                   suppress_extra_fields: suppress_extra_fields)

data/lib/zip/version.rb

@@ -2,5 +2,5 @@
 
 module Zip
   # The version of the Rubyzip library.
-  VERSION = '3.5.0'
+  VERSION = '3.6.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubyzip
 version: !ruby/object:Gem::Version
-  version: 3.5.0
+  version: 3.6.0
 platform: ruby
 authors:
 - Robert Haines
@@ -196,9 +196,9 @@ licenses:
 - BSD-2-Clause
 metadata:
   bug_tracker_uri: https://github.com/rubyzip/rubyzip/issues
-  changelog_uri: https://github.com/rubyzip/rubyzip/blob/v3.5.0/Changelog.md
-  documentation_uri: https://www.rubydoc.info/gems/rubyzip/3.5.0
-  source_code_uri: https://github.com/rubyzip/rubyzip/tree/v3.5.0
+  changelog_uri: https://github.com/rubyzip/rubyzip/blob/v3.6.0/Changelog.md
+  documentation_uri: https://www.rubydoc.info/gems/rubyzip/3.6.0
+  source_code_uri: https://github.com/rubyzip/rubyzip/tree/v3.6.0
   wiki_uri: https://github.com/rubyzip/rubyzip/wiki
   rubygems_mfa_required: 'true'
 rdoc_options: []