unmagic-icon 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17b7d09638783ea1144e26806aa2e7915d04e08645ed39c2df6a2f3026a69bdf
-  data.tar.gz: 39b8e9e8fc1a88c494c1336224b88632c0f5153e002fa2a2663b1f476c42f27b
+  metadata.gz: 66fe0a90a06ca3989154088d6e1d8cda87f6f1055d9b0ddf368ee2e9a054fd2f
+  data.tar.gz: fb7ad24d2a2c4d56a9dc4246751ff12542424ebc392bddba9be78f8f3420bc47
 SHA512:
-  metadata.gz: 58e783d9c8829e92c70149d48f95a012a092123fa85ec2e92f68eb30203d4028722f7db8aad66c487880749b5e9647062c11cc4118c06faf71b5784fd617a9ea
-  data.tar.gz: d5ecd53c6ee72f8aaa9050221d4a619fc58a778f9998896a50530a1cee737564f3667e5bb4435040c69c645861dcb8a0ca829bcb3b923db025d51b32800a1882
+  metadata.gz: c5e2c6186cb26a61779090c520930a9941725db13d2807df6a61ecad308debecaf86c928ca9e4b5bc6ca3dd3768b16fa1456ae42802a34bd6a90ab8963db3b71
+  data.tar.gz: 65e389aa2b586335518e70919aa560601a8157cc8ef21bab78ed8ab52fdce9dc0ba35add14410a737d4fbc9690fafe673cc7d5a1ec9ec14aa31dd64e2649a694

data/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.0] - 2026-07-31
+
+### Added
+- New downloadable icon library: `lobe-icons` (AI/LLM brand logos from
+  LobeHub, with `-color` and `-text` variants alongside each bare mark)
+
+## [0.2.1] - 2026-07-14
+
+### Changed
+- Archives are now extracted in pure Ruby (rubyzip for zips, stdlib
+  `Gem::Package::TarReader`/`Zlib` for tarballs) instead of shelling out to
+  `unzip`/`tar`, so `unmagic:icons:install` works in minimal containers —
+  such as Rails' default slim Docker image — where those binaries aren't
+  installed. Extraction also guards against zip-slip path traversal.
+
+### Added
+- Runtime dependency on `rubyzip` (>= 2.3)
+
 ## [0.2.0] - 2026-06-22
 
 ### Added
@@ -41,6 +59,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   hooks into `assets:precompile`) and `unmagic:icons:download[library]`
 - `Unmagic::Icon::Web`, a Rack app for browsing the configured icon libraries
 
-[Unreleased]: https://github.com/unreasonable-magic/unmagic-icon/compare/v0.2.0...HEAD
+[Unreleased]: https://github.com/unreasonable-magic/unmagic-icon/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/unreasonable-magic/unmagic-icon/compare/v0.2.1...v0.3.0
+[0.2.1]: https://github.com/unreasonable-magic/unmagic-icon/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/unreasonable-magic/unmagic-icon/compare/v0.1.0...v0.2.0
 [0.1.0]: https://github.com/unreasonable-magic/unmagic-icon/releases/tag/v0.1.0

data/README.md

@@ -133,6 +133,7 @@ Available libraries:
 | `iconoir`             | Iconoir             | Free open source icons designed on a 24x24 grid                             |
 | `material-design-icons` | Material Design Icons | 7400+ Material Design icons (Pictogrammers @mdi)                        |
 | `phosphor`            | Phosphor Icons      | Flexible icon family with six weights (thin to fill, plus duotone)           |
+| `lobe-icons`          | Lobe Icons          | Popular AI / LLM model brand logos and icons                                 |
 
 ### Browsing icons
 

data/lib/unmagic/icon/library/source/lobe_icons.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Unmagic
+  class Icon
+    class Library
+      class Source
+        # LobeHub's AI/LLM brand logos, sourced from the static-svg npm package
+        # rather than the repo (the repo only ships React components). Each brand
+        # comes in up to three variants, distinguished by filename suffix: the
+        # bare mark (openai), the full-colour mark (openai-color), and the
+        # wordmark (openai-text).
+        class LobeIcons < Source
+          key :"lobe-icons"
+          title "Lobe Icons"
+          description "Popular AI / LLM model brand logos and icons"
+          url "https://registry.npmjs.org/@lobehub/icons-static-svg/-/icons-static-svg-1.94.0.tgz"
+          archive :tgz
+          dir "lobe-icons"
+          extract "package/icons/*.svg"
+        end
+      end
+    end
+  end
+end

data/lib/unmagic/icon/library/source.rb

@@ -6,7 +6,8 @@ require "json"
 require "pathname"
 require "fileutils"
 require "tmpdir"
-require "open3"
+require "zlib"
+require "rubygems/package"
 
 # Terminal progress is a nicety, not a requirement. The downloader runs fine
 # (with plain output) when these sibling gems aren't installed.
@@ -211,19 +212,76 @@ module Unmagic
           end
         end
 
+        # Pure-Ruby extraction — no `unzip`/`tar` binaries required, so this
+        # works in minimal containers (e.g. Rails' default slim Docker image).
         def extract_archive(archive_path, destination, type)
           case type
           when :zip
-            _, stderr, status = Open3.capture3("unzip", "-q", "-o", archive_path, "-d", destination)
-            raise ExtractionError, "Failed to extract zip: #{stderr}" unless status.success?
+            extract_zip(archive_path, destination)
           when :tgz, :tar
-            _, stderr, status = Open3.capture3("tar", "-xzf", archive_path, "-C", destination)
-            raise ExtractionError, "Failed to extract tar: #{stderr}" unless status.success?
+            extract_tar(archive_path, destination)
           else
             raise ExtractionError, "Unknown archive type: #{type}"
           end
         end
 
+        def extract_zip(archive_path, destination)
+          require "zip"
+
+          Zip::File.open(archive_path) do |zip|
+            zip.each do |entry|
+              path = safe_extraction_path(entry.name, destination)
+
+              if entry.directory?
+                FileUtils.mkdir_p(path)
+              elsif entry.file?
+                FileUtils.mkdir_p(File.dirname(path))
+                entry.get_input_stream do |input|
+                  File.open(path, "wb") { |file| IO.copy_stream(input, file) }
+                end
+              end
+            end
+          end
+        rescue Zip::Error => e
+          raise ExtractionError, "Failed to extract zip: #{e.message}"
+        end
+
+        GZIP_MAGIC = "\x1f\x8b".b
+
+        def extract_tar(archive_path, destination)
+          File.open(archive_path, "rb") do |file|
+            stream = file.read(2) == GZIP_MAGIC ? Zlib::GzipReader.new(file.tap(&:rewind)) : file.tap(&:rewind)
+
+            Gem::Package::TarReader.new(stream) do |tar|
+              tar.each do |entry|
+                path = safe_extraction_path(entry.full_name, destination)
+
+                if entry.directory?
+                  FileUtils.mkdir_p(path)
+                elsif entry.file?
+                  FileUtils.mkdir_p(File.dirname(path))
+                  File.open(path, "wb") { |output| IO.copy_stream(entry, output) }
+                end
+              end
+            end
+          end
+        rescue Zlib::Error, Gem::Package::Error => e
+          raise ExtractionError, "Failed to extract tar: #{e.message}"
+        end
+
+        # Guards against zip-slip: entries like "../../etc/passwd" must not
+        # escape the extraction directory.
+        def safe_extraction_path(entry_name, destination)
+          destination = File.expand_path(destination)
+          path = File.expand_path(entry_name, destination)
+
+          unless path == destination || path.start_with?(destination + File::SEPARATOR)
+            raise ExtractionError, "Archive entry escapes extraction directory: #{entry_name}"
+          end
+
+          path
+        end
+
         def count_svgs(directory)
           Dir.glob(File.join(directory, "**", "*.svg")).size
         end
@@ -246,3 +304,4 @@ require_relative "source/octicons"
 require_relative "source/iconoir"
 require_relative "source/material_design_icons"
 require_relative "source/phosphor"
+require_relative "source/lobe_icons"

data/lib/unmagic/icon/version.rb

@@ -2,6 +2,6 @@
 
 module Unmagic
   class Icon
-    VERSION = "0.2.0"
+    VERSION = "0.3.0"
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: unmagic-icon
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Keith Pitt
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-22 00:00:00.000000000 Z
+date: 2026-07-31 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -52,6 +52,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: 1.8.5
+- !ruby/object:Gem::Dependency
+  name: rubyzip
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '2.3'
 - !ruby/object:Gem::Dependency
   name: rspec
   requirement: !ruby/object:Gem::Requirement
@@ -107,6 +121,7 @@ files:
 - lib/unmagic/icon/library/source/feather.rb
 - lib/unmagic/icon/library/source/heroicons.rb
 - lib/unmagic/icon/library/source/iconoir.rb
+- lib/unmagic/icon/library/source/lobe_icons.rb
 - lib/unmagic/icon/library/source/lucide.rb
 - lib/unmagic/icon/library/source/material_design_icons.rb
 - lib/unmagic/icon/library/source/material_file_icons.rb