rubyzip 3.6.0 → 3.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8ad461af594aaafc83f2a9af47a7e72681431835864534c174970e2245748764
-  data.tar.gz: 6c5bd535a0b049a606bd64ca90106e633c385926d91c32ca3db72314d2b031f0
+  metadata.gz: a74cb8c2351c40e483f8f97f3197d4c7629d69b09e820233e7905840ba141f03
+  data.tar.gz: a5f7473b90231c59e65d0e2a72fe42f61c3a2ac80c9e3c04998ad29ecd86bf49
 SHA512:
-  metadata.gz: ecd014dee5b905fe5a85af4273e564a0abbdb9c75409a489363352999b2298bfa6baf311c4722c022ddd87807e402d2b9b03f54ec2c110a4cf8c882ed916d301
-  data.tar.gz: 7711a4b6bd467e46d020b9d36b58ad726c0ff312d2247e49c9030cbdfb53d206dd5e16ddbb265f34f3f9802c728de06517926de352db7fac8f43ceafd3a3f496
+  metadata.gz: bca6294a1125d0af478c8e46b7cb53da2e1971c75a0994b68e35bddf897402eca9cb6dedb6d11b240c4b58177053de1aa442ba14aa0c303351b2d077f56ede74
+  data.tar.gz: 86c85eb799f2a89eeab405f758fffc31a707f1360bd135da0b16c05c1964e6b8fddc38eba512f23ac3531d807956a6f5e3a32fa2ca70b57ae1810a6a2569f4f5

data/Changelog.md

@@ -1,3 +1,14 @@
+# 3.7.0 (2026-09-18)
+
+- Add AES Encryption. [#678](https://github.com/rubyzip/rubyzip/pull/678)
+- Add methods to `Zip::File` for bulk adding and extraction of entries. [#679](https://github.com/rubyzip/rubyzip/pull/679)
+- Support setting the encoding of an `InputStream`. [#668](https://github.com/rubyzip/rubyzip/pull/668)
+
+Tooling/internal:
+
+- Add an AGENTS.md for those using such.
+- Attempt to fix transient failures in encryption tests.
+
 # 3.6.0 (2026-09-01)
 
 - Forward options from OutputStream.open without a block. [#674](https://github.com/rubyzip/rubyzip/pull/674)

data/README.md

@@ -118,7 +118,17 @@ Note that there are some extra fields that cannot be suppressed at all (e.g. `:a
 
 ### Zipping a directory recursively
 
-Copy from [here](https://github.com/rubyzip/rubyzip/blob/9d891f7353e66052283562d3e252fe380bb4b199/samples/example_recursive.rb)
+`Zip::File#add_recursive` adds the contents of a directory (not the directory itself) to an archive, recursing into subdirectories:
+
+```ruby
+Zip::File.open('archive.zip', create: true) do |zipfile|
+  zipfile.add_recursive('/path/to/directory')
+end
+```
+
+Pass `prefix:` (default `''`) to nest the contents under a prefix inside the archive, and `max_depth:` (default `16`) to limit how many directory levels are walked. Symlinks are always skipped (ignored, with a warning), rather than followed or added.
+
+For more manual control, here is a hand-rolled version of the same thing:
 
 ```ruby
 require 'zip'
@@ -229,6 +239,16 @@ Zip::File.open('foo.zip') do |zip_file|
 end
 ```
 
+To extract every entry in an archive at once, preserving its directory structure, use `Zip::File#extract_all`:
+
+```ruby
+Zip::File.open('foo.zip') do |zip_file|
+  zip_file.extract_all('/path/to/destination')
+end
+```
+
+As with `extract`, existing files at the destination will raise `Zip::DestinationExistsError` unless a block is passed to resolve the conflict (see [Existing Files](#existing-files) below). Symlink entries are always skipped (ignored, with a warning), rather than extracted.
+
 ### Reading a Zip file with `Zip::InputStream`
 
 `Zip::InputStream` can be used for faster reading of zip file content because it does not read the Central directory up front.
@@ -251,9 +271,9 @@ end # The `InputStream` is closed at the end of the block.
 
 Any attempt to move about in a zip file opened with `Zip::InputStream` could result in the incorrect entry being accessed and/or Zlib buffer errors. If you need random access in a zip file, use `Zip::File`.
 
-### Password Protection (experimental)
+### Encryption and Password Protection (experimental)
 
-Rubyzip supports reading zip files with AES encryption (version 3.1 and later), and reading and writing zip files with traditional zip encryption (a.k.a. "ZipCrypto"). Encryption is currently only available with the stream API, with either files or buffers, e.g.:
+Rubyzip supports reading and writing zip files with AES encryption (reading: version 3.1 and later; writing: version 3.7 and later), and reading and writing zip files with traditional zip encryption (a.k.a. "ZipCrypto"). Encryption is currently only available with the stream API, with either files or buffers, e.g.:
 
 #### Version 2.x (ZipCrypto only)
 
@@ -274,9 +294,16 @@ Zip::InputStream.open(buffer, 0, dec) do |input|
 end
 ```
 
-#### Version 3.x (AES reading and ZipCrypto read/write)
+#### Version 3.x (AES and ZipCrypto)
 
 ```ruby
+# Writing AES, version 3.7 and later.
+enc = Zip::AESEncrypter.new('password', Zip::AESEncryption::STRENGTH_256_BIT)
+Zip::OutputStream.open('aes-encrypted-file.zip', encrypter: enc) do |output|
+  output.put_next_entry('my_file.txt')
+  output.write my_data
+end
+
 # Reading AES, version 3.1 and later.
 dec = Zip::AESDecrypter.new('password', Zip::AESEncryption::STRENGTH_256_BIT)
 Zip::InputStream.open('aes-encrypted-file.zip', decrypter: dec) do |input|
@@ -285,14 +312,14 @@ Zip::InputStream.open('aes-encrypted-file.zip', decrypter: dec) do |input|
   puts input.read
 end
 
-# Writing.
+# Writing ZipCrypto.
 enc = Zip::TraditionalEncrypter.new('password')
 buffer = Zip::OutputStream.write_buffer(encrypter: enc) do |output|
   output.put_next_entry("my_file.txt")
   output.write my_data
 end
 
-# Reading.
+# Reading ZipCrypto.
 dec = Zip::TraditionalDecrypter.new('password')
 Zip::InputStream.open(buffer, decrypter: dec) do |input|
   entry = input.get_next_entry

data/lib/zip/constants.rb

@@ -14,6 +14,7 @@ module Zip
   VERSION_MADE_BY                        = 52 # this library's version
   VERSION_NEEDED_TO_EXTRACT              = 20
   VERSION_NEEDED_TO_EXTRACT_ZIP64        = 45
+  VERSION_NEEDED_TO_EXTRACT_AES          = 51
 
   SPLIT_FILE_SIGNATURE = 0x08074b50
 

data/lib/zip/crypto/aes_encryption.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'securerandom'
+
 module Zip
   module AESEncryption # :nodoc:
     VERIFIER_LENGTH = 2
@@ -62,6 +64,105 @@ module Zip
     def gp_flags
       0x0001
     end
+
+    private
+
+    # Derive the encryption key, HMAC key and password-verification value
+    # from the password and a salt, as specified by the WinZip AES format.
+    def derive_keys(salt)
+      raise Error, "Unsupported encryption AES-#{@bits}" unless STRENGTHS.include? @strength
+
+      key_material = OpenSSL::KDF.pbkdf2_hmac(
+        @password,
+        salt:       salt,
+        iterations: 1000,
+        length:     (2 * @key_length) + VERIFIER_LENGTH,
+        hash:       'sha1'
+      )
+
+      [
+        key_material[0...@key_length],
+        key_material[@key_length...(2 * @key_length)],
+        key_material[-VERIFIER_LENGTH..]
+      ]
+    end
+  end
+
+  class AESEncrypter < Encrypter # :nodoc:
+    include AESEncryption
+
+    def header(_mtime)
+      @salt + @pwd_verify
+    end
+
+    # `Deflater`/`PassThruCompressor` call this with whatever, arbitrarily
+    # sized (and not necessarily block-aligned) buffer they happen to have
+    # flushed, potentially many times per entry. Only whole 16-byte blocks
+    # are actually run through the cipher here; any trailing partial block
+    # is buffered in `@pending` until either more data completes it or
+    # `trailer` forces the final flush. This keeps the CTR counter aligned
+    # with the true byte offset in the plaintext stream regardless of how
+    # callers happen to chunk their writes.
+    def encrypt(data)
+      @pending << data
+      encrypted_data = encrypt_blocks
+      @hmac.update(encrypted_data)
+      encrypted_data
+    end
+
+    def data_descriptor(*)
+      ''
+    end
+
+    def trailer
+      encrypted_data = encrypt_blocks(final: true)
+      @hmac.update(encrypted_data)
+      encrypted_data + @hmac.digest[0...AUTHENTICATION_CODE_LENGTH]
+    end
+
+    def crc(_computed_crc)
+      0
+    end
+
+    def reset!
+      @salt = SecureRandom.random_bytes(@salt_length)
+      enc_key, enc_hmac_key, @pwd_verify = derive_keys(@salt)
+
+      @counter = 0
+      @pending = +''.b
+      @cipher = OpenSSL::Cipher::AES.new(@bits, :CTR)
+      @cipher.encrypt
+      @cipher.key = enc_key
+      @hmac = OpenSSL::HMAC.new(enc_hmac_key, OpenSSL::Digest.new('SHA1'))
+    end
+
+    def prepare_entry(entry)
+      entry.prep_aes_extra(AESEncryption::VERSION_AE_2, @strength)
+    end
+
+    private
+
+    def encrypt_blocks(final: false)
+      length = final ? @pending.bytesize : (@pending.bytesize / BLOCK_SIZE) * BLOCK_SIZE
+      return '' if length.zero?
+
+      data = @pending.slice!(0, length)
+      encrypted_data = +''.b
+      offset = 0
+
+      while offset < data.bytesize
+        @cipher.iv = [@counter + 1].pack('Vx12')
+        encrypted_data << @cipher.update(data[offset, BLOCK_SIZE])
+        @counter += 1
+        offset += BLOCK_SIZE
+      end
+
+      # JRuby requires finalization of the cipher when the last block fed to
+      # it is a partial one. This is a bug, as noted in
+      # jruby/jruby-openssl#182 and jruby/jruby-openssl#183.
+      encrypted_data << @cipher.final if final && defined?(JRUBY_VERSION)
+      encrypted_data
+    end
   end
 
   class AESDecrypter < Decrypter # :nodoc:
@@ -91,20 +192,9 @@ module Zip
     end
 
     def reset!(header)
-      raise Error, "Unsupported encryption AES-#{@bits}" unless STRENGTHS.include? @strength
-
       salt = header[0...@salt_length]
       pwd_verify = header[-VERIFIER_LENGTH..]
-      key_material = OpenSSL::KDF.pbkdf2_hmac(
-        @password,
-        salt:       salt,
-        iterations: 1000,
-        length:     (2 * @key_length) + VERIFIER_LENGTH,
-        hash:       'sha1'
-      )
-      enc_key = key_material[0...@key_length]
-      enc_hmac_key = key_material[@key_length...(2 * @key_length)]
-      enc_pwd_verify = key_material[-VERIFIER_LENGTH..]
+      enc_key, enc_hmac_key, enc_pwd_verify = derive_keys(salt)
 
       raise Error, 'Bad password' if enc_pwd_verify != pwd_verify
 

data/lib/zip/crypto/encryption.rb

@@ -2,6 +2,15 @@
 
 module Zip
   class Encrypter # :nodoc:all
+    def trailer
+      ''
+    end
+
+    def crc(computed_crc)
+      computed_crc
+    end
+
+    def prepare_entry(_entry); end
   end
 
   class Decrypter # :nodoc:all

data/lib/zip/entry.rb

@@ -208,6 +208,21 @@ module Zip
       !@extra[:aes].nil?
     end
 
+    # Called by `AESEncrypter#prepare_entry` before the local header is first
+    # written, so the extra field is in place before its size is measured.
+    # Directories have no content to encrypt, so they are left untouched.
+    def prep_aes_extra(vendor_version, strength) # :nodoc:
+      return if directory?
+
+      @version_needed_to_extract =
+        [@version_needed_to_extract, Zip::VERSION_NEEDED_TO_EXTRACT_AES].max
+      aes = @extra[:aes] || @extra.create(:aes)
+      aes.vendor_version = vendor_version
+      aes.vendor_id = 'AE'
+      aes.encryption_strength = strength
+      aes.compression_method = compression_method
+    end
+
     def file_type_is?(type) # :nodoc:
       ftype == type
     end
@@ -286,7 +301,16 @@ module Zip
     #
     # NB: The caller is responsible for making sure `destination_directory` is
     # safe, if it is passed.
-    def extract(entry_path = @name, destination_directory: '.', &block)
+    #
+    # `create_parent_directories`, if true, creates any missing intermediate
+    # directories for a file entry before writing it. This defaults to
+    # false: a missing intermediate directory usually means an earlier
+    # entry (e.g. a symlink) was deliberately skipped as unsafe, and letting
+    # a later entry silently succeed by re-creating that path as a plain
+    # directory would mask that. Bulk operations such as `extract_all`,
+    # which have no such earlier-entry to skip past, opt into this.
+    def extract(entry_path = @name, destination_directory: '.',
+                create_parent_directories: false, &block)
       dest_dir = ::File.absolute_path(destination_directory || '.')
       extract_path = ::File.absolute_path(::File.join(dest_dir, entry_path))
 
@@ -299,6 +323,8 @@ module Zip
 
       raise "unknown file type #{inspect}" unless directory? || file? || symlink?
 
+      ::FileUtils.mkdir_p(::File.dirname(extract_path)) if create_parent_directories && file?
+
       __send__(:"create_#{ftype}", extract_path, &block)
       self
     end
@@ -396,7 +422,7 @@ module Zip
       [::Zip::LOCAL_ENTRY_SIGNATURE,
        @version_needed_to_extract, # version needed to extract
        @gp_flags, # @gp_flags
-       compression_method,
+       stored_compression_method,
        @time.to_binary_dos_time, # @last_mod_time
        @time.to_binary_dos_date, # @last_mod_date
        @crc,
@@ -578,7 +604,7 @@ module Zip
         @fstype, # filesystem type
         @version_needed_to_extract, # @versionNeededToExtract
         @gp_flags, # @gp_flags
-        compression_method,
+        stored_compression_method,
         @time.to_binary_dos_time, # @last_mod_time
         @time.to_binary_dos_date, # @last_mod_date
         @crc,
@@ -824,6 +850,13 @@ module Zip
       @compression_method = @extra[:aes].compression_method if ftype != :directory
     end
 
+    # AES-encrypted entries always store `COMPRESSION_METHOD_AES` (99) on the
+    # wire; the real compression method lives in the AES extra field instead
+    # (see `parse_aes_extra`, which reverses this on read).
+    def stored_compression_method # :nodoc:
+      aes? ? COMPRESSION_METHOD_AES : compression_method
+    end
+
     # For DEFLATED compression *only*: set the general purpose flags 1 and 2 to
     # indicate compression level. This seems to be mainly cosmetic but they are
     # generally set by other tools - including in docx files. It is these flags
@@ -853,7 +886,8 @@ module Zip
       # Might not know size here, so need ZIP64 just in case.
       # If we already have a ZIP64 extra (placeholder) then we must fill it in.
       if zip64? || @size.nil? || @size >= 0xFFFFFFFF || @compressed_size >= 0xFFFFFFFF
-        @version_needed_to_extract = VERSION_NEEDED_TO_EXTRACT_ZIP64
+        @version_needed_to_extract =
+          [@version_needed_to_extract, VERSION_NEEDED_TO_EXTRACT_ZIP64].max
         zip64 = @extra[:zip64] || @extra.create(:zip64)
 
         # Local header always includes size and compressed size.
@@ -867,7 +901,8 @@ module Zip
 
       if (@size && @size >= 0xFFFFFFFF) || @compressed_size >= 0xFFFFFFFF ||
          @local_header_offset >= 0xFFFFFFFF
-        @version_needed_to_extract = VERSION_NEEDED_TO_EXTRACT_ZIP64
+        @version_needed_to_extract =
+          [@version_needed_to_extract, VERSION_NEEDED_TO_EXTRACT_ZIP64].max
         zip64 = @extra[:zip64] || @extra.create(:zip64)
 
         # Central directory entry entries include whichever fields are necessary.

data/lib/zip/extra_field/aes.rb

@@ -3,7 +3,7 @@
 module Zip
   # Info-ZIP Extra for AES encryption
   class ExtraField::AES < ExtraField::Generic # :nodoc:
-    attr_reader :vendor_version, :vendor_id, :encryption_strength, :compression_method
+    attr_accessor :vendor_version, :vendor_id, :encryption_strength, :compression_method
 
     HEADER_ID = [0x9901].pack('v')
     register_map

data/lib/zip/file.rb

@@ -12,9 +12,10 @@ module Zip
   # the archive and methods such as `get_input_stream` and
   # `get_output_stream` for reading from and writing entries to the
   # archive. The class includes a few convenience methods such as
-  # `extract` for extracting entries to the filesystem, and `remove`,
-  # `replace`, `rename` and `mkdir` for making simple modifications to
-  # the archive.
+  # `extract` for extracting entries to the filesystem, `extract_all` for
+  # extracting every entry, `add_recursive` for adding the contents of a
+  # directory tree, and `remove`, `replace`, `rename` and `mkdir` for
+  # making simple modifications to the archive.
   #
   # Modifications to a zip archive are not committed until `commit` or
   # `close` is called. The method `open` accepts a block following
@@ -178,6 +179,28 @@ module Zip
           cdir.count_entries(path_or_io)
         end
       end
+
+      # Recursively adds the contents of `src_dir` to the new archive
+      # `zip_file_name`, nested under `prefix` if given (the archive root
+      # otherwise). `src_dir` itself is not added, only its contents.
+      #
+      # Symlinks are ignored (skipped, with a warning) rather than followed
+      # or added, to avoid the security issues they can pose. `max_depth`
+      # limits how many directory levels below `src_dir` are walked; anything
+      # deeper is skipped, also with a warning (default: 16).
+      def add_recursive(zip_file_name, src_dir, prefix: '', max_depth: 16, &continue_on_exists_proc)
+        Zip::File.open(zip_file_name, create: true) do |zf|
+          zf.add_recursive(src_dir, prefix: prefix, max_depth: max_depth, &continue_on_exists_proc)
+        end
+      end
+
+      # Extracts every entry in the zip archive `zip_file_name` into
+      # `destination_directory`, preserving the archive's directory structure.
+      def extract_all(zip_file_name, destination_directory = '.', &block)
+        Zip::File.open(zip_file_name) do |zf|
+          zf.extract_all(destination_directory, &block)
+        end
+      end
     end
 
     # Returns an input stream to the specified entry. If a block is passed
@@ -252,6 +275,25 @@ module Zip
       add(entry, src_path, &continue_on_exists_proc)
     end
 
+    # Recursively adds the contents of `src_dir` to the archive, nested
+    # under `prefix` if given (the archive root otherwise). `src_dir`
+    # itself is not added, only its contents.
+    #
+    # Symlinks are ignored (skipped, with a warning) rather than followed
+    # or added, to avoid the security issues they can pose. `max_depth`
+    # limits how many directory levels below `src_dir` are walked; anything
+    # deeper is skipped, also with a warning (default: 16).
+    def add_recursive(src_dir, prefix: '', max_depth: 16, &continue_on_exists_proc)
+      raise Errno::ENOENT, src_dir unless ::File.directory?(src_dir)
+      raise ArgumentError, 'max_depth must be at least 1' if max_depth < 1
+
+      prefix = prefix.to_s
+      prefix += '/' unless prefix.empty? || prefix.end_with?('/')
+
+      add_recursive_dir(prefix, src_dir, 1, max_depth, continue_on_exists_proc)
+      self
+    end
+
     # Removes the specified entry.
     def remove(entry)
       @cdir.delete(get_entry(entry))
@@ -286,6 +328,33 @@ module Zip
       found_entry.extract(entry_path, destination_directory: destination_directory, &block)
     end
 
+    # Extracts every entry in the archive into `destination_directory`,
+    # preserving the archive's directory structure.
+    #
+    # Symlink entries are ignored (skipped, with a warning) rather than
+    # extracted. See `Entry#extract` for the path-safety checks applied to
+    # every other entry.
+    #
+    # NB: The caller is responsible for making sure `destination_directory` is
+    # safe, if it is passed.
+    def extract_all(destination_directory = '.', &block)
+      # Partition the entries into directories and non-directories, so that
+      # directories are created first.
+      dirs, others = entries.partition(&:directory?)
+
+      (dirs + others).each do |entry|
+        if entry.symlink?
+          warn "WARNING: skipped symlink '#{entry.name}' during extract_all."
+          next
+        end
+
+        entry.extract(entry.name, destination_directory:     destination_directory,
+                                  create_parent_directories: true, &block)
+      end
+
+      self
+    end
+
     # Commits changes that has been made since the previous commit to
     # the zip archive.
     def commit
@@ -363,6 +432,29 @@ module Zip
 
     private
 
+    def add_recursive_dir(entry_prefix, src_dir, depth, max_depth, continue_on_exists_proc)
+      ::Dir.children(src_dir).sort.each do |child|
+        src_path = ::File.join(src_dir, child)
+
+        if ::File.symlink?(src_path)
+          warn "WARNING: skipped symlink '#{src_path}' while adding directory contents."
+        elsif ::File.directory?(src_path)
+          entry_name = "#{entry_prefix}#{child}/"
+          add(entry_name, src_path, &continue_on_exists_proc)
+
+          if depth < max_depth
+            add_recursive_dir(entry_name, src_path, depth + 1, max_depth, continue_on_exists_proc)
+          else
+            warn "WARNING: max_depth (#{max_depth}) reached, not descending into '#{src_path}'."
+          end
+        elsif ::File.file?(src_path)
+          add("#{entry_prefix}#{child}", src_path, &continue_on_exists_proc)
+        else
+          warn "WARNING: skipped '#{src_path}' - not a regular file or directory."
+        end
+      end
+    end
+
     def initialize_cdir(path_or_io, buffer: false)
       @cdir = ::Zip::CentralDirectory.new
 

data/lib/zip/input_stream.rb

@@ -51,8 +51,10 @@ module Zip
     #
     # @param context [String||IO||StringIO] file path or IO/StringIO object
     # @param offset [Integer] offset in the IO/StringIO
-    def initialize(context, offset: 0, decrypter: nil)
-      super()
+    # This method also accepts the standard IO encoding options:
+    # `external_encoding:`, `internal_encoding:` and `encoding:`.
+    def initialize(context, offset: 0, decrypter: nil, **opts)
+      super(**opts)
       @archive_io = get_io(context, offset)
       @decompressor = ::Zip::NullDecompressor
       @decrypter = decrypter
@@ -107,7 +109,7 @@ module Zip
       output = produce_input(maxlen)
 
       if out_string.nil?
-        output.force_encoding(Encoding::ASCII_8BIT)
+        output.force_encoding(@internal_encoding || @external_encoding)
       else
         encoding = out_string.encoding
         out_string.replace(output).force_encoding(encoding)
@@ -125,8 +127,8 @@ module Zip
       # Same as #initialize but if a block is passed the opened
       # stream is passed to the block and closed when the block
       # returns.
-      def open(filename_or_io, offset: 0, decrypter: nil)
-        zio = new(filename_or_io, offset: offset, decrypter: decrypter)
+      def open(filename_or_io, offset: 0, decrypter: nil, **opts)
+        zio = new(filename_or_io, offset: offset, decrypter: decrypter, **opts)
         return zio unless block_given?
 
         begin

data/lib/zip/ioextras/abstract_input_stream.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative 'fake_io'
+
 module Zip
   module IOExtras # :nodoc:
     # Implements many of the convenience methods of IO
@@ -9,7 +11,11 @@ module Zip
       include Enumerable
       include FakeIO
 
-      def initialize # :nodoc:
+      # Creates a new input stream wrapper.
+      #
+      # This method accepts the standard IO encoding options:
+      # `external_encoding:`, `internal_encoding:` and `encoding:`.
+      def initialize(**opts)
         super
         @lineno        = 0
         @pos           = 0
@@ -33,7 +39,7 @@ module Zip
       # containing the bytes read. The string's encoding is the unchanged
       # encoding of `out_string`, if `out_string` is given; `ASCII-8BIT`,
       # otherwise.
-      def read(maxlen = nil, out_string = nil) # rubocop:disable Metrics/PerceivedComplexity
+      def read(maxlen = nil, out_string = nil) # rubocop:disable Metrics/PerceivedComplexity,Metrics/CyclomaticComplexity
         return (maxlen.nil? || maxlen.zero? ? '' : nil) if eof?
 
         tbuf = if @output_buffer.bytesize > 0
@@ -60,7 +66,7 @@ module Zip
         @pos += tbuf.length
 
         if out_string.nil?
-          tbuf.force_encoding(Encoding::ASCII_8BIT)
+          tbuf.force_encoding(@internal_encoding || @external_encoding)
         else
           encoding = out_string.encoding
           out_string.replace(tbuf).force_encoding(encoding)
@@ -109,7 +115,7 @@ module Zip
       #
       # Optional keyword argument `chomp` specifies whether line separators
       # are to be omitted.
-      def gets(sep = $INPUT_RECORD_SEPARATOR, limit = nil, chomp: false)
+      def gets(sep = $INPUT_RECORD_SEPARATOR, limit = nil, chomp: false) # rubocop:disable Metrics/AbcSize,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
         if sep.nil?
           return nil if eof?
 
@@ -124,6 +130,8 @@ module Zip
           sep = "#{$INPUT_RECORD_SEPARATOR}#{$INPUT_RECORD_SEPARATOR}"
         end
 
+        encoding = @internal_encoding || @external_encoding
+
         buffer_index = 0
         while (sep_index = @output_buffer.index(sep, buffer_index)).nil?
           break if limit && @output_buffer.bytesize >= limit
@@ -133,7 +141,7 @@ module Zip
 
             @lineno = @lineno.next
             @pos += @output_buffer.bytesize
-            return @output_buffer.slice!(0..)
+            return @output_buffer.slice!(0..).force_encoding(encoding)
           end
 
           buffer_index = [buffer_index, @output_buffer.bytesize - sep.bytesize].max
@@ -144,7 +152,9 @@ module Zip
         cut_index = sep_index ? [sep_index + sep.bytesize, limit].min : limit
         @lineno = @lineno.next
         @pos += cut_index
-        chomp ? @output_buffer.slice!(0, cut_index).chomp(sep) : @output_buffer.slice!(0, cut_index)
+        data = @output_buffer.slice!(0, cut_index)
+        data&.chomp!(sep) if chomp
+        data&.force_encoding(encoding)
       end
 
       def ungetc(byte) # :nodoc:

data/lib/zip/ioextras/abstract_output_stream.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative 'fake_io'
+
 module Zip
   module IOExtras # :nodoc:
     # Implements many of the output convenience methods of IO.

data/lib/zip/ioextras/fake_io.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+module Zip
+  module IOExtras # :nodoc:
+    module FakeIO # :nodoc:
+      attr_reader :external_encoding, :internal_encoding
+
+      def initialize(**opts)
+        @internal_encoding = Encoding.find(opts[:internal_encoding]) if opts[:internal_encoding]
+
+        if opts[:encoding].kind_of?(String)
+          _ext, int = opts[:encoding].split(':', 2)
+          @internal_encoding = Encoding.find(int) unless @internal_encoding || int.nil?
+        end
+
+        @external_encoding = Encoding::ASCII_8BIT
+      end
+
+      def set_encoding(ext_enc, int_enc = nil)
+        if ext_enc.kind_of?(String) && ext_enc.include?(':')
+          _ext_enc, int_enc = ext_enc.split(':', 2)
+        end
+
+        begin
+          @internal_encoding = Encoding.find(int_enc) if int_enc
+        rescue ArgumentError
+          warn "warning: Unsupported encoding #{int_enc} ignored"
+        end
+
+        @external_encoding = Encoding::ASCII_8BIT
+      end
+
+      # Implement kind_of? in order to pretend to be an IO object.
+      def kind_of?(object)
+        object == IO || super
+      end
+    end
+  end
+end

data/lib/zip/ioextras.rb

@@ -21,18 +21,11 @@ module Zip
         end
       end
     end
-
-    # Implements kind_of? in order to pretend to be an IO object
-    module FakeIO # :nodoc:
-      def kind_of?(object)
-        object == IO || super
-      end
-    end
   end
 end
 
-require 'zip/ioextras/abstract_input_stream'
-require 'zip/ioextras/abstract_output_stream'
+require_relative 'ioextras/abstract_input_stream'
+require_relative 'ioextras/abstract_output_stream'
 
 # Copyright (C) 2002-2004 Thomas Sondergaard
 # rubyzip is free software; you can redistribute it and/or

data/lib/zip/output_stream.rb

@@ -29,8 +29,8 @@ module Zip
 
     # Opens the indicated zip file. If a file with that name already
     # exists it will be overwritten.
-    def initialize(file_name, stream: false, encrypter: nil, suppress_extra_fields: false)
-      super()
+    def initialize(file_name, stream: false, encrypter: nil, suppress_extra_fields: false, **opts)
+      super(**opts)
       @file_name = file_name
       @output_stream = if stream
                          iostream = Zip::RUNNING_ON_WINDOWS ? @file_name : @file_name.dup
@@ -52,27 +52,28 @@ module Zip
       # Same as #initialize but if a block is passed the opened
       # stream is passed to the block and closed when the block
       # returns.
-      def open(file_name, encrypter: nil, suppress_extra_fields: false)
+      def open(file_name, encrypter: nil, suppress_extra_fields: false, **opts)
         unless block_given?
           return new(
             file_name,
             encrypter:             encrypter,
-            suppress_extra_fields: suppress_extra_fields
+            suppress_extra_fields: suppress_extra_fields,
+            **opts
           )
         end
 
         zos = new(file_name, stream: false, encrypter: encrypter,
-                  suppress_extra_fields: suppress_extra_fields)
+                  suppress_extra_fields: suppress_extra_fields, **opts)
         yield zos
       ensure
         zos.close if zos
       end
 
       # Same as #open but writes to a filestream instead
-      def write_buffer(io = ::StringIO.new, encrypter: nil, suppress_extra_fields: false)
+      def write_buffer(io = ::StringIO.new, encrypter: nil, suppress_extra_fields: false, **opts)
         io.binmode if io.respond_to?(:binmode)
         zos = new(io, stream: true, encrypter: encrypter,
-                  suppress_extra_fields: suppress_extra_fields)
+                  suppress_extra_fields: suppress_extra_fields, **opts)
         yield zos
         zos.close_buffer
       end
@@ -148,27 +149,29 @@ module Zip
       return unless @current_entry
 
       finish
+      @output_stream << @encrypter.trailer unless @current_entry.directory?
       @current_entry.compressed_size = @output_stream.tell -
                                        @current_entry.local_header_offset -
                                        @current_entry.calculate_local_header_size
       @current_entry.size = @compressor.size
-      @current_entry.crc = @compressor.crc
+      @current_entry.crc = @encrypter.crc(@compressor.crc)
       @output_stream << @encrypter.data_descriptor(
         @current_entry.crc,
         @current_entry.compressed_size,
         @current_entry.size
       )
-      @current_entry.gp_flags |= @encrypter.gp_flags
+      @current_entry.gp_flags |= @encrypter.gp_flags unless @current_entry.directory?
       @current_entry = nil
       @compressor = ::Zip::NullCompressor.instance
     end
 
     def init_next_entry(entry)
       finalize_current_entry
+      @encrypter.prepare_entry(entry)
       @cdir << entry
       entry.write_local_entry(@output_stream, suppress_extra_fields: @suppress_extra_fields)
       @encrypter.reset!
-      @output_stream << @encrypter.header(entry.mtime)
+      @output_stream << @encrypter.header(entry.mtime) unless entry.directory?
       @compressor = get_compressor(entry)
     end
 
@@ -177,7 +180,7 @@ module Zip
       when Entry::DEFLATED
         ::Zip::Deflater.new(@output_stream, entry.compression_level, @encrypter)
       when Entry::STORED
-        ::Zip::PassThruCompressor.new(@output_stream)
+        ::Zip::PassThruCompressor.new(@output_stream, @encrypter)
       else
         raise ::Zip::CompressionMethodError, entry.compression_method
       end

data/lib/zip/pass_thru_compressor.rb

@@ -2,9 +2,10 @@
 
 module Zip
   class PassThruCompressor < Compressor # :nodoc:all
-    def initialize(output_stream)
+    def initialize(output_stream, encrypter = NullEncrypter.new)
       super()
       @output_stream = output_stream
+      @encrypter = encrypter
       @crc = Zlib.crc32
       @size = 0
     end
@@ -13,7 +14,7 @@ module Zip
       val = data.to_s
       @crc = Zlib.crc32(val, @crc)
       @size += val.bytesize
-      @output_stream << val
+      @output_stream << @encrypter.encrypt(val)
     end
 
     attr_reader :size, :crc

data/lib/zip/version.rb

@@ -2,5 +2,5 @@
 
 module Zip
   # The version of the Rubyzip library.
-  VERSION = '3.6.0'
+  VERSION = '3.7.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubyzip
 version: !ruby/object:Gem::Version
-  version: 3.6.0
+  version: 3.7.0
 platform: ruby
 authors:
 - Robert Haines
@@ -174,6 +174,7 @@ files:
 - lib/zip/ioextras.rb
 - lib/zip/ioextras/abstract_input_stream.rb
 - lib/zip/ioextras/abstract_output_stream.rb
+- lib/zip/ioextras/fake_io.rb
 - lib/zip/null_compressor.rb
 - lib/zip/null_decompressor.rb
 - lib/zip/null_input_stream.rb
@@ -196,9 +197,9 @@ licenses:
 - BSD-2-Clause
 metadata:
   bug_tracker_uri: https://github.com/rubyzip/rubyzip/issues
-  changelog_uri: https://github.com/rubyzip/rubyzip/blob/v3.6.0/Changelog.md
-  documentation_uri: https://www.rubydoc.info/gems/rubyzip/3.6.0
-  source_code_uri: https://github.com/rubyzip/rubyzip/tree/v3.6.0
+  changelog_uri: https://github.com/rubyzip/rubyzip/blob/v3.7.0/Changelog.md
+  documentation_uri: https://www.rubydoc.info/gems/rubyzip/3.7.0
+  source_code_uri: https://github.com/rubyzip/rubyzip/tree/v3.7.0
   wiki_uri: https://github.com/rubyzip/rubyzip/wiki
   rubygems_mfa_required: 'true'
 rdoc_options: []