@zip.js/zip.js 2.8.43 → 2.8.45

package/dist/zip-fs-core.js

@@ -70,6 +70,8 @@
 	const EXTRAFIELD_TYPE_USDZ = 0x1986;
 	const EXTRAFIELD_TYPE_INFOZIP = 0x7875;
 	const EXTRAFIELD_TYPE_UNIX = 0x7855;
+	const EXTRAFIELD_TYPE_UNIX_TYPE1 = 0x5855;
+	const EXTRAFIELD_TYPE_PKWARE_UNIX = 0x000d;
 
 	const BITFLAG_ENCRYPTED = 0b1;
 	const BITFLAG_LEVEL = 0b0110;
@@ -2315,6 +2317,7 @@
 
 	const ERR_INVALID_PASSWORD = "Invalid password";
 	const ERR_INVALID_SIGNATURE = "Invalid signature";
+	const ERR_INVALID_AUTHENTICATION_CODE = ERR_INVALID_SIGNATURE;
 	const ERR_ABORT_CHECK_PASSWORD = "zipjs-abort-check-password";
 	const ERR_UNSUPPORTED_CRYPTO_API = "Crypto API not supported";
 
@@ -2365,7 +2368,7 @@
 	const DERIVED_BITS_USAGE = ["deriveBits"];
 	const SALT_LENGTH = [8, 12, 16];
 	const KEY_LENGTH = [16, 24, 32];
-	const SIGNATURE_LENGTH = 10;
+	const AUTHENTICATION_CODE_LENGTH = 10;
 	const COUNTER_DEFAULT_VALUE = [0, 0, 0, 0];
 	// deno-lint-ignore valid-typeof
 	const CRYPTO_API_SUPPORTED = typeof crypto != UNDEFINED_TYPE;
@@ -2381,7 +2384,7 @@
 
 	class AESDecryptionStream extends TransformStream {
 
-		constructor({ password, rawPassword, encryptionStrength, checkPasswordOnly }) {
+		constructor({ password, rawPassword, encryptionStrength, checkPasswordOnly, checkAuthenticationCode = true }) {
 			super({
 				start() {
 					initAesCrypto(this, password, rawPassword, encryptionStrength);
@@ -2405,8 +2408,8 @@
 					} else {
 						await ready;
 					}
-					const output = new Uint8Array(chunk.length - SIGNATURE_LENGTH - ((chunk.length - SIGNATURE_LENGTH) % BLOCK_LENGTH));
-					controller.enqueue(append(aesCrypto, chunk, output, 0, SIGNATURE_LENGTH, true));
+					const output = new Uint8Array(chunk.length - AUTHENTICATION_CODE_LENGTH - ((chunk.length - AUTHENTICATION_CODE_LENGTH) % BLOCK_LENGTH));
+					controller.enqueue(append(aesCrypto, chunk, output, 0, AUTHENTICATION_CODE_LENGTH, true));
 				},
 				async flush(controller) {
 					const {
@@ -2417,8 +2420,8 @@
 					} = this;
 					if (hmac && ctr) {
 						await ready;
-						const chunkToDecrypt = subarray(pending, 0, pending.length - SIGNATURE_LENGTH);
-						const originalSignature = subarray(pending, pending.length - SIGNATURE_LENGTH);
+						const chunkToDecrypt = subarray(pending, 0, pending.length - AUTHENTICATION_CODE_LENGTH);
+						const originalAuthenticationCode = subarray(pending, pending.length - AUTHENTICATION_CODE_LENGTH);
 						let decryptedChunkArray = EMPTY_UINT8_ARRAY;
 						if (chunkToDecrypt.length) {
 							const encryptedChunk = toBits(codecBytes, chunkToDecrypt);
@@ -2426,13 +2429,13 @@
 							const decryptedChunk = ctr.update(encryptedChunk);
 							decryptedChunkArray = fromBits(codecBytes, decryptedChunk);
 						}
-						const signature = subarray(fromBits(codecBytes, hmac.digest()), 0, SIGNATURE_LENGTH);
-						let invalidSignature = pending.length < SIGNATURE_LENGTH ? 1 : 0;
-						for (let indexSignature = 0; indexSignature < SIGNATURE_LENGTH; indexSignature++) {
-							invalidSignature |= signature[indexSignature] ^ originalSignature[indexSignature];
+						const authenticationCode = subarray(fromBits(codecBytes, hmac.digest()), 0, AUTHENTICATION_CODE_LENGTH);
+						let invalidAuthenticationCode = pending.length < AUTHENTICATION_CODE_LENGTH ? 1 : 0;
+						for (let indexByte = 0; indexByte < AUTHENTICATION_CODE_LENGTH; indexByte++) {
+							invalidAuthenticationCode |= authenticationCode[indexByte] ^ originalAuthenticationCode[indexByte];
 						}
-						if (invalidSignature) {
-							throw new Error(ERR_INVALID_SIGNATURE);
+						if (invalidAuthenticationCode && checkAuthenticationCode) {
+							throw new Error(ERR_INVALID_AUTHENTICATION_CODE);
 						}
 						controller.enqueue(decryptedChunkArray);
 					}
@@ -2444,8 +2447,6 @@
 	class AESEncryptionStream extends TransformStream {
 
 		constructor({ password, rawPassword, encryptionStrength }) {
-			// deno-lint-ignore prefer-const
-			let stream;
 			super({
 				start() {
 					initAesCrypto(this, password, rawPassword, encryptionStrength);
@@ -2484,12 +2485,11 @@
 							hmac.update(encryptedChunk);
 							encryptedChunkArray = fromBits(codecBytes, encryptedChunk);
 						}
-						stream.signature = fromBits(codecBytes, hmac.digest()).slice(0, SIGNATURE_LENGTH);
-						controller.enqueue(concat(encryptedChunkArray, stream.signature));
+						const authenticationCode = fromBits(codecBytes, hmac.digest()).slice(0, AUTHENTICATION_CODE_LENGTH);
+						controller.enqueue(concat(encryptedChunkArray, authenticationCode));
 					}
 				}
 			});
-			stream = this;
 		}
 	}
 
@@ -2502,7 +2502,7 @@
 		});
 	}
 
-	function append(aesCrypto, input, output, paddingStart, paddingEnd, verifySignature) {
+	function append(aesCrypto, input, output, paddingStart, paddingEnd, verifyAuthenticationCode) {
 		const {
 			ctr,
 			hmac,
@@ -2516,11 +2516,11 @@
 		let offset;
 		for (offset = 0; offset <= inputLength - BLOCK_LENGTH; offset += BLOCK_LENGTH) {
 			const inputChunk = toBits(codecBytes, subarray(input, offset, offset + BLOCK_LENGTH));
-			if (verifySignature) {
+			if (verifyAuthenticationCode) {
 				hmac.update(inputChunk);
 			}
 			const outputChunk = ctr.update(inputChunk);
-			if (!verifySignature) {
+			if (!verifyAuthenticationCode) {
 				hmac.update(outputChunk);
 			}
 			output.set(fromBits(codecBytes, outputChunk), offset + paddingStart);
@@ -2803,6 +2803,7 @@
 
 	const ERR_INVALID_UNCOMPRESSED_SIZE = "Invalid uncompressed size";
 	const ERR_INVALID_COMPRESSED_DATA = "Invalid compressed data";
+	const ERR_INVALID_CRC32 = ERR_INVALID_SIGNATURE;
 	const ERR_UNSUPPORTED_COMPRESSION$2 = "Compression method not supported";
 	const FORMAT_DEFLATE_RAW = "deflate-raw";
 	const FORMAT_DEFLATE64_RAW = "deflate64-raw";
@@ -2816,14 +2817,14 @@
 
 		constructor(options, { chunkSize, CompressionStreamZlib, CompressionStream }) {
 			super({});
-			const { compressed, encrypted, useCompressionStream, zipCrypto, signed, level, deflate64, format, compressionMethod } = options;
+			const { compressed, encrypted, useCompressionStream, zipCrypto, computeCrc32, level, deflate64, format, compressionMethod } = options;
 			const stream = this;
 			let crc32Stream, encryptionStream, gzipCrc32Stream;
 			let readable = super.readable;
 			const codecStreams = format && getCodecStreams(format);
-			const useGzipCrc32 = signed && compressed && !deflate64 && !codecStreams && (!encrypted || zipCrypto) &&
+			const useGzipCrc32 = computeCrc32 && compressed && !deflate64 && !codecStreams && (!encrypted || zipCrypto) &&
 				Boolean(useCompressionStream && CompressionStream);
-			if ((!encrypted || zipCrypto) && signed && !useGzipCrc32) {
+			if ((!encrypted || zipCrypto) && computeCrc32 && !useGzipCrc32) {
 				crc32Stream = new Crc32Stream();
 				readable = pipeThrough(readable, crc32Stream);
 			}
@@ -2858,14 +2859,9 @@
 				}
 			}
 			setReadable(stream, readable, () => {
-				let signature;
-				if (encrypted && !zipCrypto) {
-					signature = encryptionStream.signature;
-				}
-				if ((!encrypted || zipCrypto) && signed) {
-					signature = useGzipCrc32 ? gzipCrc32Stream.signature : new DataView(crc32Stream.value.buffer).getUint32(0);
+				if ((!encrypted || zipCrypto) && computeCrc32) {
+					stream.crc32 = useGzipCrc32 ? gzipCrc32Stream.crc32 : new DataView(crc32Stream.value.buffer).getUint32(0);
 				}
-				stream.signature = signature;
 			});
 		}
 	}
@@ -2903,7 +2899,7 @@
 				},
 				flush() {
 					const dataView = getDataView(trailerCandidate);
-					stream.signature = dataView.getUint32(0, true);
+					stream.crc32 = dataView.getUint32(0, true);
 					stream.uncompressedSize = dataView.getUint32(4, true);
 				}
 			});
@@ -2985,7 +2981,7 @@
 
 		constructor(options, { chunkSize, DecompressionStreamZlib, DecompressionStream }) {
 			super({});
-			const { zipCrypto, encrypted, signed, signature, compressed, useCompressionStream, deflate64, format, compressionMethod, rawBitFlag, outputSize } = options;
+			const { zipCrypto, encrypted, checkCrc32, crc32, compressed, useCompressionStream, deflate64, format, compressionMethod, rawBitFlag, outputSize } = options;
 			let crc32Stream, decryptionStream;
 			let readable = super.readable;
 			if (encrypted) {
@@ -3018,15 +3014,15 @@
 				}
 				readable = mapInflateStreamError(readable);
 			}
-			if ((!encrypted || zipCrypto) && signed) {
+			if (checkCrc32) {
 				crc32Stream = new Crc32Stream();
 				readable = pipeThrough(readable, crc32Stream);
 			}
 			setReadable(this, readable, () => {
-				if ((!encrypted || zipCrypto) && signed) {
-					const dataViewSignature = new DataView(crc32Stream.value.buffer);
-					if (signature != dataViewSignature.getUint32(0, false)) {
-						throw new Error(ERR_INVALID_SIGNATURE);
+				if (checkCrc32) {
+					const computedCrc32View = new DataView(crc32Stream.value.buffer);
+					if (crc32 != computedCrc32View.getUint32(0, false)) {
+						throw new Error(ERR_INVALID_CRC32);
 					}
 				}
 			});
@@ -3250,9 +3246,9 @@
 					}
 				},
 				flush() {
-					const { signature } = stream;
+					const { crc32 } = stream;
 					Object.assign(codec, {
-						signature,
+						crc32,
 						inputSize
 					});
 				}
@@ -3547,12 +3543,12 @@
 				.pipeThrough(new ChunkStream(getChunkSize(config)))
 				.pipeTo(writable, { preventClose: true, preventAbort: true });
 			const {
-				signature,
+				crc32,
 				inputSize,
 				outputSize
 			} = codecStream;
 			return {
-				signature,
+				crc32,
 				inputSize,
 				outputSize
 			};
@@ -3913,7 +3909,7 @@
 
 	async function runWorker(stream, workerOptions) {
 		const { options, config } = workerOptions;
-		const { transferStreams, useWebWorkers, useCompressionStream, compressed, signed, encrypted, format, codecURI } = options;
+		const { transferStreams, useWebWorkers, useCompressionStream, compressed, checkCrc32, computeCrc32, encrypted, format, codecURI } = options;
 		const { workerURI, maxWorkers } = config;
 		if (format) {
 			if (codecURI) {
@@ -3922,7 +3918,7 @@
 			await ensureCodecStreams(format, options.codecURI);
 		}
 		workerOptions.transferStreams = transferStreams || (transferStreams === UNDEFINED_VALUE && config.transferStreams);
-		const streamCopy = !compressed && !signed && !encrypted;
+		const streamCopy = !compressed && !checkCrc32 && !computeCrc32 && !encrypted;
 		const workerSupported = format === UNDEFINED_VALUE || Boolean(options.codecURI);
 		workerOptions.useWebWorkers = !streamCopy && workerSupported && (useWebWorkers || (useWebWorkers === UNDEFINED_VALUE && config.useWebWorkers));
 		workerOptions.workerURI = workerOptions.useWebWorkers && workerURI ? workerURI : UNDEFINED_VALUE;
@@ -4165,9 +4161,12 @@
 	const PROPERTY_NAME_EXECUTABLE = "executable";
 	const PROPERTY_NAME_COMPRESSION_METHOD = "compressionMethod";
 	const PROPERTY_NAME_SIGNATURE = "signature";
+	const PROPERTY_NAME_CRC32 = "crc32";
 	const PROPERTY_NAME_EXTRA_FIELD = "extraField";
 	const PROPERTY_NAME_EXTRA_FIELD_INFOZIP = "extraFieldInfoZip";
 	const PROPERTY_NAME_EXTRA_FIELD_UNIX = "extraFieldUnix";
+	const PROPERTY_NAME_EXTRA_FIELD_UNIX_TYPE1 = "extraFieldUnixType1";
+	const PROPERTY_NAME_EXTRA_FIELD_PKWARE_UNIX = "extraFieldPkwareUnix";
 	const PROPERTY_NAME_UID = "uid";
 	const PROPERTY_NAME_GID = "gid";
 	const PROPERTY_NAME_UNIX_MODE = "unixMode";
@@ -4184,6 +4183,7 @@
 	const PROPERTY_NAME_EXTRA_FIELD_AES = "extraFieldAES";
 	const PROPERTY_NAME_EXTRA_FIELD_NTFS = "extraFieldNTFS";
 	const PROPERTY_NAME_EXTRA_FIELD_EXTENDED_TIMESTAMP = "extraFieldExtendedTimestamp";
+	const PROPERTY_NAME_EXTRA_FIELD_USDZ = "extraFieldUSDZ";
 
 	const PROPERTY_NAMES = [
 		PROPERTY_NAME_FILENAME,
@@ -4195,6 +4195,7 @@
 		PROPERTY_NAME_COMMENT,
 		PROPERTY_NAME_RAW_COMMENT,
 		PROPERTY_NAME_LAST_ACCESS_DATE,
+		PROPERTY_NAME_RAW_LAST_ACCESS_DATE,
 		PROPERTY_NAME_CREATION_DATE,
 		PROPERTY_NAME_RAW_CREATION_DATE,
 		PROPERTY_NAME_OFFSET,
@@ -4213,9 +4214,12 @@
 		PROPERTY_NAME_EXECUTABLE,
 		PROPERTY_NAME_COMPRESSION_METHOD,
 		PROPERTY_NAME_SIGNATURE,
+		PROPERTY_NAME_CRC32,
 		PROPERTY_NAME_EXTRA_FIELD,
 		PROPERTY_NAME_EXTRA_FIELD_UNIX,
 		PROPERTY_NAME_EXTRA_FIELD_INFOZIP,
+		PROPERTY_NAME_EXTRA_FIELD_UNIX_TYPE1,
+		PROPERTY_NAME_EXTRA_FIELD_PKWARE_UNIX,
 		PROPERTY_NAME_UID,
 		PROPERTY_NAME_GID,
 		PROPERTY_NAME_UNIX_MODE,
@@ -4231,7 +4235,8 @@
 		PROPERTY_NAME_EXTRA_FIELD_UNICODE_COMMENT,
 		PROPERTY_NAME_EXTRA_FIELD_AES,
 		PROPERTY_NAME_EXTRA_FIELD_NTFS,
-		PROPERTY_NAME_EXTRA_FIELD_EXTENDED_TIMESTAMP
+		PROPERTY_NAME_EXTRA_FIELD_EXTENDED_TIMESTAMP,
+		PROPERTY_NAME_EXTRA_FIELD_USDZ
 	];
 
 	class Entry {
@@ -4284,6 +4289,8 @@
 	const OPTION_CHECK_OVERLAPPING_ENTRY = "checkOverlappingEntry";
 	const OPTION_CHECK_AMBIGUITY = "checkAmbiguity";
 	const OPTION_CHECK_SIGNATURE = "checkSignature";
+	const OPTION_CHECK_CRC32 = "checkCrc32";
+	const OPTION_CHECK_AUTHENTICATION_CODE = "checkAuthenticationCode";
 	const OPTION_USE_WEB_WORKERS = "useWebWorkers";
 	const OPTION_USE_COMPRESSION_STREAM = "useCompressionStream";
 	const OPTION_TRANSFER_STREAMS = "transferStreams";
@@ -4303,6 +4310,7 @@
 	const OPTION_OFFSET = "offset";
 	const OPTION_USDZ = "usdz";
 	const OPTION_UNIX_EXTRA_FIELD_TYPE = "unixExtraFieldType";
+	const OPTION_LOCAL_EXTRA_FIELD = "localExtraField";
 	const OPTION_STRICTNESS = "strictness";
 	const OPTION_MAX_APPENDED_DATA_SIZE = "maxAppendedDataSize";
 	const STRICTNESS_STRICT = "strict";
@@ -4355,6 +4363,7 @@
 	const PROPERTY_NAME_UTF8_SUFFIX = "UTF8";
 	const CHARSET_CP437 = "cp437";
 	const BITFLAG_AMBIGUITY_MASK = BITFLAG_ENCRYPTED | BITFLAG_DATA_DESCRIPTOR | BITFLAG_LANG_ENCODING_FLAG;
+	const VENDOR_VERSION_AE_1$1 = 1;
 	const ZIP64_PROPERTIES = [
 		[PROPERTY_NAME_UNCOMPRESSED_SIZE, MAX_32_BITS],
 		[PROPERTY_NAME_COMPRESSED_SIZE, MAX_32_BITS],
@@ -4707,7 +4716,7 @@
 				config,
 				bitFlag,
 				rawBitFlag,
-				signature,
+				crc32,
 				rawLastModDate,
 				uncompressedSize,
 				compressedSize
@@ -4794,6 +4803,11 @@
 			if (deflate64) {
 				useCompressionStream = false;
 			}
+			const checkCrc32Option = getOptionValue$1(zipEntry, options, OPTION_CHECK_CRC32);
+			const checkCrc32 = (checkCrc32Option === UNDEFINED_VALUE ?
+				getOptionValue$1(zipEntry, options, OPTION_CHECK_SIGNATURE) :
+				checkCrc32Option) && !passThrough &&
+				(!encrypted || zipCrypto || (extraFieldAES && extraFieldAES.vendorVersion == VENDOR_VERSION_AE_1$1));
 			const workerOptions = {
 				options: {
 					codecType: CODEC_INFLATE,
@@ -4801,10 +4815,11 @@
 					rawPassword,
 					zipCrypto,
 					encryptionStrength: extraFieldAES && extraFieldAES.strength,
-					signed: getOptionValue$1(zipEntry, options, OPTION_CHECK_SIGNATURE) && !passThrough,
-					passwordVerification: zipCrypto && (dataDescriptor ? ((rawLastModDate >>> 8) & MAX_8_BITS) : ((signature >>> 24) & MAX_8_BITS)),
+					checkCrc32,
+					checkAuthenticationCode: getOptionValue$1(zipEntry, options, OPTION_CHECK_AUTHENTICATION_CODE),
+					passwordVerification: zipCrypto && (dataDescriptor ? ((rawLastModDate >>> 8) & MAX_8_BITS) : ((crc32 >>> 24) & MAX_8_BITS)),
 					outputSize: passThrough ? compressedSize : uncompressedSize,
-					signature,
+					crc32,
 					compressed: compressionMethod != 0 && !passThrough,
 					encrypted,
 					useWebWorkers: getOptionValue$1(zipEntry, options, OPTION_USE_WEB_WORKERS),
@@ -4826,7 +4841,7 @@
 					fileEntry,
 					index,
 					offset: localHeaderOffset,
-					signature,
+					crc32,
 					compressedSize,
 					uncompressedSize,
 					dataOffset,
@@ -4917,6 +4932,7 @@
 		const compressionMethod = getUint16(dataView, offset + 4);
 		Object.assign(directory, {
 			signature: getUint32(dataView, offset + HEADER_OFFSET_SIGNATURE),
+			crc32: getUint32(dataView, offset + HEADER_OFFSET_SIGNATURE),
 			compressedSize: getUint32(dataView, offset + HEADER_OFFSET_COMPRESSED_SIZE),
 			uncompressedSize: getUint32(dataView, offset + HEADER_OFFSET_UNCOMPRESSED_SIZE)
 		});
@@ -4942,6 +4958,16 @@
 		} else {
 			directory.compressionMethod = compressionMethod;
 		}
+		const extraFieldPkwareUnix = extraField.get(EXTRAFIELD_TYPE_PKWARE_UNIX);
+		if (extraFieldPkwareUnix) {
+			readExtraFieldUnixDates(extraFieldPkwareUnix, directory);
+			directory.extraFieldPkwareUnix = extraFieldPkwareUnix;
+		}
+		const extraFieldUnixType1 = extraField.get(EXTRAFIELD_TYPE_UNIX_TYPE1);
+		if (extraFieldUnixType1) {
+			readExtraFieldUnixDates(extraFieldUnixType1, directory);
+			directory.extraFieldUnixType1 = extraFieldUnixType1;
+		}
 		const extraFieldNTFS = extraField.get(EXTRAFIELD_TYPE_NTFS);
 		if (extraFieldNTFS) {
 			readExtraFieldNTFS(extraFieldNTFS, directory);
@@ -4991,15 +5017,15 @@
 			return;
 		}
 		const extraFieldView = getDataView(extraFieldUnicode.data);
-		const crc32 = new Crc32();
-		crc32.append(fileEntry[rawPropertyName]);
-		const dataViewSignature = getDataView(new Uint8Array(4));
-		dataViewSignature.setUint32(0, crc32.get(), true);
-		const signature = getUint32(extraFieldView, 1);
+		const computedCrc32 = new Crc32();
+		computedCrc32.append(fileEntry[rawPropertyName]);
+		const computedCrc32View = getDataView(new Uint8Array(4));
+		computedCrc32View.setUint32(0, computedCrc32.get(), true);
+		const nameCrc32 = getUint32(extraFieldView, 1);
 		Object.assign(extraFieldUnicode, {
 			version: getUint8(extraFieldView, 0),
 			[propertyName]: decodeText(extraFieldUnicode.data.subarray(5)),
-			valid: !fileEntry.bitFlag.languageEncodingFlag && signature == getUint32(dataViewSignature, 0)
+			valid: !fileEntry.bitFlag.languageEncodingFlag && nameCrc32 == getUint32(computedCrc32View, 0)
 		});
 		if (extraFieldUnicode.valid) {
 			directory[propertyName] = extraFieldUnicode[propertyName];
@@ -5018,6 +5044,9 @@
 			compressionMethod: getUint16(extraFieldView, 5)
 		});
 		directory.compressionMethod = extraFieldAES.compressionMethod;
+		if (extraFieldAES.vendorVersion != VENDOR_VERSION_AE_1$1) {
+			directory.crc32 = UNDEFINED_VALUE;
+		}
 	}
 
 	function readExtraFieldNTFS(extraFieldNTFS, directory) {
@@ -5036,29 +5065,41 @@
 		} catch {
 			// ignored
 		}
-		try {
-			if (tag1Data && tag1Data.length == 24) {
-				const tag1View = getDataView(tag1Data);
-				const rawLastModDate = tag1View.getBigUint64(0, true);
-				const rawLastAccessDate = tag1View.getBigUint64(8, true);
-				const rawCreationDate = tag1View.getBigUint64(16, true);
-				Object.assign(extraFieldNTFS, {
-					rawLastModDate,
-					rawLastAccessDate,
-					rawCreationDate
-				});
-				const lastModDate = getDateNTFS(rawLastModDate);
-				const lastAccessDate = getDateNTFS(rawLastAccessDate);
-				const creationDate = getDateNTFS(rawCreationDate);
-				const extraFieldData = { lastModDate, lastAccessDate, creationDate };
-				Object.assign(extraFieldNTFS, extraFieldData);
-				Object.assign(directory, extraFieldData);
-			}
-		} catch {
-			// ignored
+		if (tag1Data && tag1Data.length == 24) {
+			const tag1View = getDataView(tag1Data);
+			const rawLastModDate = tag1View.getBigUint64(0, true);
+			const rawLastAccessDate = tag1View.getBigUint64(8, true);
+			const rawCreationDate = tag1View.getBigUint64(16, true);
+			Object.assign(extraFieldNTFS, {
+				rawLastModDate,
+				rawLastAccessDate,
+				rawCreationDate
+			});
+			const lastModDate = getDateNTFS(rawLastModDate);
+			const lastAccessDate = getDateNTFS(rawLastAccessDate);
+			const creationDate = getDateNTFS(rawCreationDate);
+			const extraFieldData = { lastModDate, lastAccessDate, creationDate };
+			Object.assign(extraFieldNTFS, extraFieldData);
+			Object.assign(directory, extraFieldData);
 		}
 	}
 
+	function readExtraFieldUnixDates(extraField, directory) {
+		if (extraField.data.length < 8) {
+			return;
+		}
+		const extraFieldView = getDataView(extraField.data);
+		const lastAccessDate = new Date(getUint32(extraFieldView, 0) * 1000);
+		const lastModDate = new Date(getUint32(extraFieldView, 4) * 1000);
+		const extraFieldData = { lastAccessDate, lastModDate };
+		if (extraField.data.length >= 12) {
+			extraFieldData.uid = getUint16(extraFieldView, 8);
+			extraFieldData.gid = getUint16(extraFieldView, 10);
+		}
+		Object.assign(extraField, extraFieldData);
+		Object.assign(directory, extraFieldData);
+	}
+
 	function readExtraFieldUnix(extraField, directory, isInfoZip) {
 		try {
 			const view = getDataView(extraField.data);
@@ -5137,7 +5178,7 @@
 		fileEntry,
 		index,
 		offset,
-		signature,
+		crc32,
 		compressedSize,
 		uncompressedSize,
 		dataOffset,
@@ -5158,7 +5199,7 @@
 			const dataDescriptorSignature = dataDescriptorArray.length == dataDescriptorLength + DATA_DESCRIPTOR_RECORD_SIGNATURE_LENGTH &&
 				getUint32(getDataView(dataDescriptorArray), 0) == DATA_DESCRIPTOR_RECORD_SIGNATURE;
 			if (dataDescriptorSignature) {
-				const readSignature = getUint32(getDataView(dataDescriptorArray), 4);
+				const readCrc32 = getUint32(getDataView(dataDescriptorArray), 4);
 				let readCompressedSize;
 				let readUncompressedSize;
 				if (extraFieldZip64) {
@@ -5168,8 +5209,8 @@
 					readCompressedSize = getUint32(getDataView(dataDescriptorArray), 8);
 					readUncompressedSize = getUint32(getDataView(dataDescriptorArray), 12);
 				}
-				const matchSignature = (fileEntry.encrypted && !fileEntry.zipCrypto) || readSignature == signature;
-				if (matchSignature &&
+				const matchCrc32 = (fileEntry.encrypted && !fileEntry.zipCrypto) || readCrc32 == crc32;
+				if (matchCrc32 &&
 					readCompressedSize == compressedSize &&
 					readUncompressedSize == uncompressedSize) {
 					dataDescriptorLength += DATA_DESCRIPTOR_RECORD_SIGNATURE_LENGTH;
@@ -5338,11 +5379,11 @@
 			throwAmbiguousArchive("mismatched local file header (compression method)");
 		}
 		if (!localDirectory.bitFlag.dataDescriptor &&
-			(localDirectory.signature || localDirectory.compressedSize || localDirectory.uncompressedSize) &&
-			(localDirectory.signature != zipEntry.signature ||
+			(localDirectory.crc32 || localDirectory.compressedSize || localDirectory.uncompressedSize) &&
+			(localDirectory.crc32 != zipEntry.crc32 ||
 				localDirectory.compressedSize != zipEntry.compressedSize ||
 				localDirectory.uncompressedSize != zipEntry.uncompressedSize)) {
-			throwAmbiguousArchive("mismatched local file header (signature or sizes)");
+			throwAmbiguousArchive("mismatched local file header (crc32 or sizes)");
 		}
 	}
 
@@ -5358,11 +5399,7 @@
 
 	function getDate(timeRaw) {
 		const date = (timeRaw & 0xffff0000) >> 16, time = timeRaw & MAX_16_BITS;
-		try {
-			return new Date(1980 + ((date & 0xFE00) >> 9), ((date & 0x01E0) >> 5) - 1, date & 0x001F, (time & 0xF800) >> 11, (time & 0x07E0) >> 5, (time & 0x001F) * 2, 0);
-		} catch {
-			// ignored
-		}
+		return new Date(1980 + ((date & 0xFE00) >> 9), ((date & 0x01E0) >> 5) - 1, date & 0x001F, (time & 0xF800) >> 11, (time & 0x07E0) >> 5, (time & 0x001F) * 2, 0);
 	}
 
 	function getDateNTFS(timeRaw) {
@@ -5395,7 +5432,9 @@
 		ERR_EOCDR_LOCATOR_ZIP64_NOT_FOUND: ERR_EOCDR_LOCATOR_ZIP64_NOT_FOUND,
 		ERR_EOCDR_NOT_FOUND: ERR_EOCDR_NOT_FOUND,
 		ERR_EXTRAFIELD_ZIP64_NOT_FOUND: ERR_EXTRAFIELD_ZIP64_NOT_FOUND,
+		ERR_INVALID_AUTHENTICATION_CODE: ERR_INVALID_AUTHENTICATION_CODE,
 		ERR_INVALID_COMPRESSED_DATA: ERR_INVALID_COMPRESSED_DATA,
+		ERR_INVALID_CRC32: ERR_INVALID_CRC32,
 		ERR_INVALID_PASSWORD: ERR_INVALID_PASSWORD,
 		ERR_INVALID_SIGNATURE: ERR_INVALID_SIGNATURE,
 		ERR_INVALID_UNCOMPRESSED_SIZE: ERR_INVALID_UNCOMPRESSED_SIZE,
@@ -5448,6 +5487,8 @@
 	const ERR_UNSUPPORTED_COMPRESSION = "Compression method not supported";
 	const MIN_UNIX_TIME = -2147483648;
 	const MAX_UNIX_TIME = 2147483647;
+	const MIN_NTFS_TIME = BigInt(0);
+	const MAX_NTFS_TIME = BigInt("0x7fffffffffffffff");
 	const ERR_UNSUPPORTED_FORMAT = "Zip64 is not supported (set the 'zip64' option to 'true')";
 	const ERR_UNDEFINED_UNCOMPRESSED_SIZE = "Undefined uncompressed size";
 	const ERR_UNDEFINED_READER = "Undefined reader";
@@ -5461,7 +5502,9 @@
 	const ERR_INVALID_MSDOS_DATA = "Invalid msdosAttributes (must be an object with boolean flags)";
 
 	const EXTRAFIELD_DATA_AES = new Uint8Array([0x07, 0x00, 0x02, 0x00, 0x41, 0x45, 0x03, 0x00, 0x00]);
-	const INFOZIP_EXTRA_FIELD_TYPE = "infozip";
+	const EXTRAFIELD_OFFSET_AES_VENDOR_VERSION = 4;
+	const VENDOR_VERSION_AE_1 = 1;
+	const INFOZIP_EXTRA_FIELD_TYPE$1 = "infozip";
 	const UNIX_EXTRA_FIELD_TYPE = "unix";
 
 	let workers = 0;
@@ -5555,9 +5598,9 @@
 					zip64UncompressedSize,
 					extraFieldLength
 				});
-				const { signature } = entry;
-				if (signature !== UNDEFINED_VALUE) {
-					setUint32(headerView, HEADER_OFFSET_SIGNATURE, signature);
+				const { crc32 } = entry;
+				if (crc32 !== UNDEFINED_VALUE) {
+					setUint32(headerView, HEADER_OFFSET_SIGNATURE, crc32);
 				}
 				Object.assign(entry, {
 					zip64UncompressedSize,
@@ -5680,6 +5723,7 @@
 				internalFileAttribute: metadataInfo.resolvedOptions.internalFileAttributes,
 				externalFileAttribute: attributesInfo.resolvedOptions.externalFileAttributes,
 				signature: options[PROPERTY_NAME_SIGNATURE],
+				crc32: options.crc32 === UNDEFINED_VALUE ? options[PROPERTY_NAME_SIGNATURE] : options.crc32,
 				offset: zipWriter.offset - diskOffset,
 				diskNumberStart: diskNumber
 			});
@@ -5716,7 +5760,7 @@
 		if (unixMode !== UNDEFINED_VALUE && (unixMode < 0 || unixMode > MAX_16_BITS)) {
 			throw new Error(ERR_INVALID_UNIX_MODE);
 		}
-		if (unixExtraFieldType !== UNDEFINED_VALUE && unixExtraFieldType !== INFOZIP_EXTRA_FIELD_TYPE && unixExtraFieldType !== UNIX_EXTRA_FIELD_TYPE) {
+		if (unixExtraFieldType !== UNDEFINED_VALUE && unixExtraFieldType !== INFOZIP_EXTRA_FIELD_TYPE$1 && unixExtraFieldType !== UNIX_EXTRA_FIELD_TYPE) {
 			throw new Error(ERR_INVALID_UNIX_EXTRA_FIELD_TYPE);
 		}
 		if (unixExtraFieldType === UNIX_EXTRA_FIELD_TYPE &&
@@ -5724,7 +5768,7 @@
 			throw new Error(ERR_INVALID_UNIX_ID_SIZE);
 		}
 		if (unixExtraFieldType === UNDEFINED_VALUE && (uid !== UNDEFINED_VALUE || gid !== UNDEFINED_VALUE)) {
-			unixExtraFieldType = INFOZIP_EXTRA_FIELD_TYPE;
+			unixExtraFieldType = INFOZIP_EXTRA_FIELD_TYPE$1;
 		}
 		let msdosAttributesRaw = getOptionValue(zipWriter, options, PROPERTY_NAME_MSDOS_ATTRIBUTES_RAW);
 		let msdosAttributes = getOptionValue(zipWriter, options, PROPERTY_NAME_MSDOS_ATTRIBUTES);
@@ -5896,27 +5940,8 @@
 		if (!zipCrypto && (password !== UNDEFINED_VALUE || rawPassword !== UNDEFINED_VALUE) && !(encryptionStrength >= 1 && encryptionStrength <= 3)) {
 			throw new Error(ERR_INVALID_ENCRYPTION_STRENGTH);
 		}
-		let rawExtraField = EMPTY_UINT8_ARRAY;
-		const extraField = options[PROPERTY_NAME_EXTRA_FIELD];
-		if (extraField) {
-			let extraFieldSize = 0;
-			let offset = 0;
-			extraField.forEach(data => extraFieldSize += 4 + getLength(data));
-			rawExtraField = new Uint8Array(extraFieldSize);
-			const rawExtraFieldView = getDataView(rawExtraField);
-			extraField.forEach((data, type) => {
-				if (type > MAX_16_BITS) {
-					throw new Error(ERR_INVALID_EXTRAFIELD_TYPE);
-				}
-				if (getLength(data) > MAX_16_BITS) {
-					throw new Error(ERR_INVALID_EXTRAFIELD_DATA);
-				}
-				setUint16(rawExtraFieldView, offset, type);
-				setUint16(rawExtraFieldView, offset + 2, getLength(data));
-				arraySet(rawExtraField, data, offset + 4);
-				offset += 4 + getLength(data);
-			});
-		}
+		const rawExtraField = serializeExtraField(options[PROPERTY_NAME_EXTRA_FIELD]);
+		const rawLocalExtraField = serializeExtraField(options[OPTION_LOCAL_EXTRA_FIELD]);
 		return {
 			comment,
 			resolvedOptions: {
@@ -5950,11 +5975,36 @@
 				useCompressionStream,
 				dataDescriptor,
 				zip64,
-				rawExtraField
+				rawExtraField,
+				rawLocalExtraField
 			}
 		};
 	}
 
+	function serializeExtraField(extraField) {
+		if (!extraField) {
+			return EMPTY_UINT8_ARRAY;
+		}
+		let extraFieldSize = 0;
+		let offset = 0;
+		extraField.forEach(data => extraFieldSize += 4 + getLength(data));
+		const rawExtraField = new Uint8Array(extraFieldSize);
+		const rawExtraFieldView = getDataView(rawExtraField);
+		extraField.forEach((data, type) => {
+			if (type > MAX_16_BITS) {
+				throw new Error(ERR_INVALID_EXTRAFIELD_TYPE);
+			}
+			if (getLength(data) > MAX_16_BITS) {
+				throw new Error(ERR_INVALID_EXTRAFIELD_DATA);
+			}
+			setUint16(rawExtraFieldView, offset, type);
+			setUint16(rawExtraFieldView, offset + 2, getLength(data));
+			arraySet(rawExtraField, data, offset + 4);
+			offset += 4 + getLength(data);
+		});
+		return rawExtraField;
+	}
+
 	async function resolveSizes(zipWriter, reader, { resolvedOptions: metadata }, options) {
 		const { passThrough, zipCrypto, password, rawPassword, encryptionStrength } = metadata;
 		let { dataDescriptor, zip64, level, compressionMethod } = metadata;
@@ -6279,7 +6329,7 @@
 			msdosAttributes
 		};
 		let {
-			signature,
+			crc32,
 			uncompressedSize
 		} = options;
 		let compressedSize = 0;
@@ -6299,7 +6349,7 @@
 					encryptionStrength,
 					zipCrypto: encrypted && zipCrypto,
 					passwordVerification: encrypted && zipCrypto && (rawLastModDate >> 8) & MAX_8_BITS,
-					signed: !passThrough,
+					computeCrc32: !passThrough,
 					compressed: compressed && !passThrough,
 					encrypted: encrypted && !passThrough,
 					useWebWorkers,
@@ -6318,7 +6368,9 @@
 				writer.size += compressedSize;
 				if (!passThrough) {
 					uncompressedSize = result.inputSize;
-					signature = result.signature;
+					if (!encrypted || zipCrypto) {
+						crc32 = result.crc32;
+					}
 				}
 				if ((!zip64CompressedSize && compressedSize >= MAX_32_BITS) ||
 					(!zip64UncompressedSize && uncompressedSize >= MAX_32_BITS)) {
@@ -6333,7 +6385,7 @@
 
 		}
 		setEntryInfo({
-			signature,
+			crc32,
 			compressedSize,
 			uncompressedSize,
 			headerInfo,
@@ -6356,7 +6408,8 @@
 			version,
 			headerArray,
 			headerView,
-			signature,
+			signature: crc32,
+			crc32: encrypted && !zipCrypto && !passThrough ? UNDEFINED_VALUE : crc32,
 			extraFieldExtendedTimestampFlag,
 			zip64UncompressedSize,
 			zip64CompressedSize
@@ -6377,6 +6430,7 @@
 			dataDescriptor,
 			directory,
 			rawExtraField,
+			rawLocalExtraField,
 			encryptionStrength,
 			extendedTimestamp,
 			ntfsTimestamp,
@@ -6384,7 +6438,8 @@
 			encrypted,
 			zip64UncompressedSize,
 			zip64CompressedSize,
-			uncompressedSize
+			uncompressedSize,
+			crc32
 		} = options;
 		let { version, compressionMethod } = options;
 		const compressed = !directory && (compressionMethod === UNDEFINED_VALUE
@@ -6457,8 +6512,8 @@
 					extraFieldNTFS.uint16(EXTRAFIELD_TYPE_NTFS_TAG1);
 					extraFieldNTFS.uint16(24);
 					extraFieldNTFS.uint64(lastModTimeNTFS);
-					extraFieldNTFS.uint64(getTimeNTFS(lastAccessDate) || lastModTimeNTFS);
-					extraFieldNTFS.uint64(getTimeNTFS(creationDate) || lastModTimeNTFS);
+					extraFieldNTFS.uint64(lastAccessDate ? getTimeNTFS(lastAccessDate) : lastModTimeNTFS);
+					extraFieldNTFS.uint64(creationDate ? getTimeNTFS(creationDate) : lastModTimeNTFS);
 					rawExtraFieldNTFS = extraFieldNTFS.array;
 				} catch {
 					rawExtraFieldNTFS = EMPTY_UINT8_ARRAY;
@@ -6472,7 +6527,7 @@
 		let rawExtraFieldUnix;
 		try {
 			const { uid, gid, unixExtraFieldType } = options;
-			if (unixExtraFieldType == INFOZIP_EXTRA_FIELD_TYPE && (uid !== UNDEFINED_VALUE || gid !== UNDEFINED_VALUE)) {
+			if (unixExtraFieldType == INFOZIP_EXTRA_FIELD_TYPE$1 && (uid !== UNDEFINED_VALUE || gid !== UNDEFINED_VALUE)) {
 				const uidBytes = packUnixId(uid);
 				const gidBytes = packUnixId(gid);
 				const payloadLength = 3 + uidBytes.length + gidBytes.length;
@@ -6510,15 +6565,18 @@
 		}
 		if (encrypted && !zipCrypto) {
 			version = version > VERSION_AES ? version : VERSION_AES;
+			if (passThrough && crc32 !== UNDEFINED_VALUE) {
+				rawExtraFieldAES[EXTRAFIELD_OFFSET_AES_VENDOR_VERSION] = VENDOR_VERSION_AE_1;
+			}
 			rawExtraFieldAES[9] = compressionMethod;
 			compressionMethod = COMPRESSION_METHOD_AES;
 		}
 		const localExtraFieldZip64Length = writeLocalExtraFieldZip64 ? getLength(rawLocalExtraFieldZip64) : 0;
-		const extraFieldLength = localExtraFieldZip64Length + getLength(rawExtraFieldAES, rawExtraFieldExtendedTimestamp, rawExtraFieldNTFS, rawExtraFieldUnix, rawExtraField);
+		const extraFieldLength = localExtraFieldZip64Length + getLength(rawExtraFieldAES, rawExtraFieldExtendedTimestamp, rawExtraFieldNTFS, rawExtraFieldUnix, rawExtraField, rawLocalExtraField);
 		if (extraFieldLength > MAX_16_BITS) {
 			throw new Error(ERR_INVALID_EXTRAFIELD_DATA);
 		}
-		const dosLastModDate = new Date(Math.ceil(lastModDate.getTime() / 2000) * 2000);
+		const dosLastModDate = new Date(Math.ceil(Math.floor(lastModDate.getTime() / 1000) / 2) * 2000);
 		const {
 			headerArray,
 			headerView,
@@ -6548,6 +6606,7 @@
 		localHeader.bytes(rawExtraFieldNTFS);
 		localHeader.bytes(rawExtraFieldUnix);
 		localHeader.bytes(rawExtraField);
+		localHeader.bytes(rawLocalExtraField);
 		if (dataDescriptor) {
 			if (!zip64CompressedSize) {
 				setUint32(localHeaderView, HEADER_OFFSET_COMPRESSED_SIZE + LOCAL_HEADER_COMMON_OFFSET, 0);
@@ -6666,7 +6725,7 @@
 	}
 
 	function setEntryInfo({
-		signature,
+		crc32,
 		compressedSize,
 		uncompressedSize,
 		headerInfo,
@@ -6674,6 +6733,7 @@
 	}, {
 		zip64,
 		zipCrypto,
+		passThrough,
 		dataDescriptor
 	}) {
 		const {
@@ -6684,10 +6744,10 @@
 			dataDescriptorView,
 			dataDescriptorOffset
 		} = dataDescriptorInfo;
-		if ((!encrypted || zipCrypto) && signature !== UNDEFINED_VALUE) {
-			setUint32(headerView, HEADER_OFFSET_SIGNATURE, signature);
+		if ((!encrypted || zipCrypto || passThrough) && crc32 !== UNDEFINED_VALUE) {
+			setUint32(headerView, HEADER_OFFSET_SIGNATURE, crc32);
 			if (dataDescriptor) {
-				setUint32(dataDescriptorView, dataDescriptorOffset, signature);
+				setUint32(dataDescriptorView, dataDescriptorOffset, crc32);
 			}
 		}
 		if (zip64) {
@@ -6710,15 +6770,15 @@
 		encrypted,
 		zip64,
 		localExtraFieldZip64Length,
-		signature,
+		crc32,
 		compressedSize,
 		uncompressedSize,
 		zip64UncompressedSize,
 		zip64CompressedSize
-	}, localHeaderView, { dataDescriptor }) {
+	}, localHeaderView, { dataDescriptor, passThrough }) {
 		if (!dataDescriptor) {
-			if (!encrypted) {
-				setUint32(localHeaderView, HEADER_OFFSET_SIGNATURE + LOCAL_HEADER_COMMON_OFFSET, signature);
+			if (!encrypted || (passThrough && crc32 !== UNDEFINED_VALUE)) {
+				setUint32(localHeaderView, HEADER_OFFSET_SIGNATURE + LOCAL_HEADER_COMMON_OFFSET, crc32);
 			}
 			if (!zip64CompressedSize) {
 				setUint32(localHeaderView, HEADER_OFFSET_COMPRESSED_SIZE + LOCAL_HEADER_COMMON_OFFSET, compressedSize);
@@ -7027,7 +7087,8 @@
 
 	function getTimeNTFS(date) {
 		if (date) {
-			return ((BigInt(date.getTime()) + BigInt(11644473600000)) * BigInt(10000));
+			const timeNTFS = ((BigInt(date.getTime()) + BigInt(11644473600000)) * BigInt(10000));
+			return timeNTFS < MIN_NTFS_TIME ? MIN_NTFS_TIME : timeNTFS > MAX_NTFS_TIME ? MAX_NTFS_TIME : timeNTFS;
 		}
 	}
 
@@ -7182,6 +7243,20 @@
 
 	const ERR_ENTRY_EXISTS = "Entry filename already exists";
 	const ERR_READABLE_CONSUMED = "Readable stream already consumed";
+	const INFOZIP_EXTRA_FIELD_TYPE = "infozip";
+	const INTERPRETED_EXTRA_FIELD_TYPES = new Set([
+		EXTRAFIELD_TYPE_ZIP64,
+		EXTRAFIELD_TYPE_AES,
+		EXTRAFIELD_TYPE_NTFS,
+		EXTRAFIELD_TYPE_EXTENDED_TIMESTAMP,
+		EXTRAFIELD_TYPE_UNICODE_PATH,
+		EXTRAFIELD_TYPE_UNICODE_COMMENT,
+		EXTRAFIELD_TYPE_USDZ,
+		EXTRAFIELD_TYPE_INFOZIP,
+		EXTRAFIELD_TYPE_UNIX,
+		EXTRAFIELD_TYPE_UNIX_TYPE1,
+		EXTRAFIELD_TYPE_PKWARE_UNIX
+	]);
 
 	class ZipEntry {
 
@@ -7919,6 +7994,20 @@
 		}
 	}
 
+	function getUserExtraField(extraField) {
+		if (extraField) {
+			const userExtraField = new Map();
+			extraField.forEach((field, type) => {
+				if (!INTERPRETED_EXTRA_FIELD_TYPES.has(type)) {
+					userExtraField.set(type, field.data);
+				}
+			});
+			if (userExtraField.size) {
+				return userExtraField;
+			}
+		}
+	}
+
 	async function exportZip(zipWriter, entry, totalSize, options, readers) {
 		const selectedEntry = entry;
 		const entryOffsets = new Map();
@@ -7956,9 +8045,13 @@
 						uncompressedSize,
 						encrypted,
 						zipCrypto,
-						signature,
+						crc32,
 						compressionMethod,
-						extraFieldAES
+						extraFieldAES,
+						internalFileAttributes,
+						extraField,
+						uid,
+						gid
 					} = child.data;
 					zipEntryOptions = {
 						externalFileAttributes,
@@ -7966,8 +8059,20 @@
 						comment,
 						lastModDate,
 						creationDate,
-						lastAccessDate
+						lastAccessDate,
+						internalFileAttributes
 					};
+					const userExtraField = getUserExtraField(extraField);
+					if (userExtraField) {
+						zipEntryOptions.extraField = userExtraField;
+					}
+					if (uid !== UNDEFINED_VALUE || gid !== UNDEFINED_VALUE) {
+						Object.assign(zipEntryOptions, {
+							uid,
+							gid,
+							unixExtraFieldType: options.unixExtraFieldType || INFOZIP_EXTRA_FIELD_TYPE
+						});
+					}
 					if (child.passThrough) {
 						let level, encryptionStrength;
 						if (compressionMethod === 0) {
@@ -7980,7 +8085,7 @@
 							passThrough: true,
 							encrypted,
 							zipCrypto,
-							signature,
+							crc32,
 							uncompressedSize,
 							level,
 							encryptionStrength,