zenml-nightly 0.80.2.dev20250413__tar.gz → 0.80.2.dev20250415__tar.gz

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: zenml-nightly
-Version: 0.80.2.dev20250413
+Version: 0.80.2.dev20250415
 Summary: ZenML: Write production-ready ML code.
 License: Apache-2.0
 Keywords: machine learning,production,pipeline,mlops,devops

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "zenml-nightly"
-version = "0.80.2.dev20250413"
+version = "0.80.2.dev20250415"
 packages = [{ include = "zenml", from = "src" }]
 description = "ZenML: Write production-ready ML code."
 authors = ["ZenML GmbH <info@zenml.io>"]

zenml_nightly-0.80.2.dev20250415/src/zenml/VERSION

@@ -0,0 +1 @@
+0.80.2.dev20250415

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/src/zenml/artifacts/utils.py

@@ -35,7 +35,9 @@ from zenml.artifacts.preexisting_data_materializer import (
     PreexistingDataMaterializer,
 )
 from zenml.client import Client
-from zenml.constants import MODEL_METADATA_YAML_FILE_NAME
+from zenml.constants import (
+    MODEL_METADATA_YAML_FILE_NAME,
+)
 from zenml.enums import (
     ArtifactSaveType,
     ArtifactType,
@@ -43,7 +45,10 @@ from zenml.enums import (
     StackComponentType,
     VisualizationType,
 )
-from zenml.exceptions import DoesNotExistException, StepContextError
+from zenml.exceptions import (
+    DoesNotExistException,
+    StepContextError,
+)
 from zenml.io import fileio
 from zenml.logger import get_logger
 from zenml.metadata.metadata_types import validate_metadata

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/src/zenml/config/server_config.py

@@ -34,6 +34,7 @@ from zenml.constants import (
     DEFAULT_ZENML_JWT_TOKEN_LEEWAY,
     DEFAULT_ZENML_SERVER_DEVICE_AUTH_POLLING,
     DEFAULT_ZENML_SERVER_DEVICE_AUTH_TIMEOUT,
+    DEFAULT_ZENML_SERVER_FILE_DOWNLOAD_SIZE_LIMIT,
     DEFAULT_ZENML_SERVER_GENERIC_API_TOKEN_LIFETIME,
     DEFAULT_ZENML_SERVER_GENERIC_API_TOKEN_MAX_LIFETIME,
     DEFAULT_ZENML_SERVER_LOGIN_RATE_LIMIT_DAY,
@@ -245,6 +246,8 @@ class ServerConfiguration(BaseModel):
         memcache_default_expiry: The default expiry time in seconds for cache
             entries. If not specified, the default value of 30 seconds will be
             used.
+        file_download_size_limit: The maximum size of the file download in
+            bytes. If not specified, the default value of 2GB will be used.
     """
 
     deployment_type: ServerDeploymentType = ServerDeploymentType.OTHER
@@ -346,6 +349,10 @@ class ServerConfiguration(BaseModel):
     memcache_max_capacity: int = 1000
     memcache_default_expiry: int = 30
 
+    file_download_size_limit: int = (
+        DEFAULT_ZENML_SERVER_FILE_DOWNLOAD_SIZE_LIMIT
+    )
+
     _deployment_id: Optional[UUID] = None
 
     @model_validator(mode="before")

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/src/zenml/constants.py

@@ -192,12 +192,14 @@ ENV_ZENML_SERVER_PRO_PREFIX = "ZENML_SERVER_PRO_"
 ENV_ZENML_SERVER_DEPLOYMENT_TYPE = f"{ENV_ZENML_SERVER_PREFIX}DEPLOYMENT_TYPE"
 ENV_ZENML_SERVER_AUTH_SCHEME = f"{ENV_ZENML_SERVER_PREFIX}AUTH_SCHEME"
 ENV_ZENML_SERVER_AUTO_ACTIVATE = f"{ENV_ZENML_SERVER_PREFIX}AUTO_ACTIVATE"
+
 ENV_ZENML_RUN_SINGLE_STEPS_WITHOUT_STACK = (
     "ZENML_RUN_SINGLE_STEPS_WITHOUT_STACK"
 )
 ENV_ZENML_PREVENT_CLIENT_SIDE_CACHING = "ZENML_PREVENT_CLIENT_SIDE_CACHING"
 ENV_ZENML_DISABLE_CREDENTIALS_DISK_CACHING = "DISABLE_CREDENTIALS_DISK_CACHING"
 ENV_ZENML_RUNNER_IMAGE_DISABLE_UV = "ZENML_RUNNER_IMAGE_DISABLE_UV"
+
 # Logging variables
 IS_DEBUG_ENV: bool = handle_bool_env_var(ENV_ZENML_DEBUG, default=False)
 
@@ -284,6 +286,7 @@ DEFAULT_ZENML_SERVER_GENERIC_API_TOKEN_LIFETIME = 60 * 60  # 1 hour
 DEFAULT_ZENML_SERVER_GENERIC_API_TOKEN_MAX_LIFETIME = (
     60 * 60 * 24 * 7
 )  # 7 days
+DEFAULT_ZENML_SERVER_FILE_DOWNLOAD_SIZE_LIMIT = 2 * 1024 * 1024 * 1024  # 20 GB
 
 DEFAULT_ZENML_SERVER_SECURE_HEADERS_HSTS = (
     "max-age=63072000; includeSubdomains"
@@ -350,10 +353,12 @@ CODE_REPOSITORIES = "/code_repositories"
 COMPONENT_TYPES = "/component-types"
 CONFIG = "/config"
 CURRENT_USER = "/current-user"
+DATA = "/data"
 DEACTIVATE = "/deactivate"
 DEVICES = "/devices"
 DEVICE_AUTHORIZATION = "/device_authorization"
 DEVICE_VERIFY = "/verify"
+DOWNLOAD_TOKEN = "/download-token"
 EMAIL_ANALYTICS = "/email-opt-in"
 EVENT_FLAVORS = "/event-flavors"
 EVENT_SOURCES = "/event-sources"

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/src/zenml/integrations/kubernetes/flavors/kubernetes_step_operator_flavor.py

@@ -35,11 +35,23 @@ class KubernetesStepOperatorSettings(BaseSettings):
         pod_settings: Pod settings to apply to pods executing the steps.
         service_account_name: Name of the service account to use for the pod.
         privileged: If the container should be run in privileged mode.
+        pod_startup_timeout: The maximum time to wait for a pending step pod to
+            start (in seconds).
+        pod_failure_max_retries: The maximum number of times to retry a step
+            pod if the step Kubernetes pod fails to start
+        pod_failure_retry_delay: The delay in seconds between pod
+            failure retries and pod startup retries (in seconds)
+        pod_failure_backoff: The backoff factor for pod failure retries and
+            pod startup retries.
     """
 
     pod_settings: Optional[KubernetesPodSettings] = None
     service_account_name: Optional[str] = None
     privileged: bool = False
+    pod_startup_timeout: int = 60 * 10  # Default 10 minutes
+    pod_failure_max_retries: int = 3
+    pod_failure_retry_delay: int = 10
+    pod_failure_backoff: float = 1.0
 
 
 class KubernetesStepOperatorConfig(

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/src/zenml/integrations/kubernetes/orchestrators/kube_utils.py

@@ -462,3 +462,95 @@ def delete_secret(
         name=secret_name,
         namespace=namespace,
     )
+
+
+def create_and_wait_for_pod_to_start(
+    core_api: k8s_client.CoreV1Api,
+    pod_display_name: str,
+    pod_name: str,
+    pod_manifest: k8s_client.V1Pod,
+    namespace: str,
+    startup_max_retries: int,
+    startup_failure_delay: float,
+    startup_failure_backoff: float,
+    startup_timeout: float,
+) -> None:
+    """Create a pod and wait for it to reach a desired state.
+
+    Args:
+        core_api: Client of Core V1 API of Kubernetes API.
+        pod_display_name: The display name of the pod to use in logs.
+        pod_name: The name of the pod to create.
+        pod_manifest: The manifest of the pod to create.
+        namespace: The namespace in which to create the pod.
+        startup_max_retries: The maximum number of retries for the pod startup.
+        startup_failure_delay: The delay between retries for the pod startup.
+        startup_failure_backoff: The backoff factor for the pod startup.
+        startup_timeout: The maximum time to wait for the pod to start.
+
+    Raises:
+        TimeoutError: If the pod is still in a pending state after the maximum
+            wait time has elapsed.
+        Exception: If the pod fails to start after the maximum number of
+            retries.
+    """
+    retries = 0
+
+    while retries < startup_max_retries:
+        try:
+            # Create and run pod.
+            core_api.create_namespaced_pod(
+                namespace=namespace,
+                body=pod_manifest,
+            )
+            break
+        except Exception as e:
+            retries += 1
+            if retries < startup_max_retries:
+                logger.debug(f"The {pod_display_name} failed to start: {e}")
+                logger.error(
+                    f"Failed to create {pod_display_name}. "
+                    f"Retrying in {startup_failure_delay} seconds..."
+                )
+                time.sleep(startup_failure_delay)
+                startup_failure_delay *= startup_failure_backoff
+            else:
+                logger.error(
+                    f"Failed to create {pod_display_name} after "
+                    f"{startup_max_retries} retries. Exiting."
+                )
+                raise
+
+    # Wait for pod to start
+    logger.info(f"Waiting for {pod_display_name} to start...")
+    max_wait = startup_timeout
+    total_wait: float = 0
+    delay = startup_failure_delay
+    while True:
+        pod = get_pod(
+            core_api=core_api,
+            pod_name=pod_name,
+            namespace=namespace,
+        )
+        if not pod or pod_is_not_pending(pod):
+            break
+        if total_wait >= max_wait:
+            # Have to delete the pending pod so it doesn't start running
+            # later on.
+            try:
+                core_api.delete_namespaced_pod(
+                    name=pod_name,
+                    namespace=namespace,
+                )
+            except Exception:
+                pass
+            raise TimeoutError(
+                f"The {pod_display_name} is still in a pending state "
+                f"after {total_wait} seconds. Exiting."
+            )
+
+        if total_wait + delay > max_wait:
+            delay = max_wait - total_wait
+        total_wait += delay
+        time.sleep(delay)
+        delay *= startup_failure_backoff

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/src/zenml/integrations/kubernetes/orchestrators/kubernetes_orchestrator.py

@@ -543,14 +543,24 @@ class KubernetesOrchestrator(ContainerizedOrchestrator):
                 mount_local_stores=self.config.is_local,
             )
 
-            self._k8s_core_api.create_namespaced_pod(
+            logger.info("Waiting for Kubernetes orchestrator pod to start...")
+            kube_utils.create_and_wait_for_pod_to_start(
+                core_api=self._k8s_core_api,
+                pod_display_name="Kubernetes orchestrator pod",
+                pod_name=pod_name,
+                pod_manifest=pod_manifest,
                 namespace=self.config.kubernetes_namespace,
-                body=pod_manifest,
+                startup_max_retries=settings.pod_failure_max_retries,
+                startup_failure_delay=settings.pod_failure_retry_delay,
+                startup_failure_backoff=settings.pod_failure_backoff,
+                startup_timeout=settings.pod_startup_timeout,
             )
 
             # Wait for the orchestrator pod to finish and stream logs.
             if settings.synchronous:
-                logger.info("Waiting for Kubernetes orchestrator pod...")
+                logger.info(
+                    "Waiting for Kubernetes orchestrator pod to finish..."
+                )
                 kube_utils.wait_pod(
                     kube_client_fn=self.get_kube_client,
                     pod_name=pod_name,

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/src/zenml/integrations/kubernetes/orchestrators/kubernetes_orchestrator_entrypoint.py

@@ -15,7 +15,6 @@
 
 import argparse
 import socket
-import time
 from typing import Any, Dict
 from uuid import UUID
 
@@ -103,8 +102,6 @@ def main() -> None:
 
         Raises:
             Exception: If the pod fails to start.
-            TimeoutError: If the pod is still in a pending state after the
-                maximum wait time has elapsed.
         """
         # Define Kubernetes pod name.
         pod_name = f"{orchestrator_run_id}-{step_name}"
@@ -176,68 +173,18 @@ def main() -> None:
             mount_local_stores=mount_local_stores,
         )
 
-        retries = 0
-        max_retries = settings.pod_failure_max_retries
-        delay: float = settings.pod_failure_retry_delay
-        backoff = settings.pod_failure_backoff
-
-        while retries < max_retries:
-            try:
-                # Create and run pod.
-                core_api.create_namespaced_pod(
-                    namespace=args.kubernetes_namespace,
-                    body=pod_manifest,
-                )
-                break
-            except Exception as e:
-                retries += 1
-                if retries < max_retries:
-                    logger.debug(
-                        f"Pod for step `{step_name}` failed to start: {e}"
-                    )
-                    logger.error(
-                        f"Failed to create pod for step `{step_name}`. "
-                        f"Retrying in {delay} seconds..."
-                    )
-                    time.sleep(delay)
-                    delay *= backoff
-                else:
-                    logger.error(
-                        f"Failed to create pod for step `{step_name}` after "
-                        f"{max_retries} retries. Exiting."
-                    )
-                    raise
-
-        # Wait for pod to start
-        max_wait = settings.pod_startup_timeout
-        total_wait: float = 0
-        delay = settings.pod_failure_retry_delay
-        while True:
-            pod = kube_utils.get_pod(
-                core_api, pod_name, args.kubernetes_namespace
-            )
-            if not pod or kube_utils.pod_is_not_pending(pod):
-                break
-            if total_wait >= max_wait:
-                # Have to delete the pending pod so it doesn't start running
-                # later on.
-                try:
-                    core_api.delete_namespaced_pod(
-                        name=pod_name,
-                        namespace=args.kubernetes_namespace,
-                    )
-                except Exception:
-                    pass
-                raise TimeoutError(
-                    f"Pod for step `{step_name}` is still in a pending state "
-                    f"after {total_wait} seconds. Exiting."
-                )
-
-            if total_wait + delay > max_wait:
-                delay = max_wait - total_wait
-            total_wait += delay
-            time.sleep(delay)
-            delay *= backoff
+        logger.info(f"Waiting for pod of step `{step_name}` to start...")
+        kube_utils.create_and_wait_for_pod_to_start(
+            core_api=core_api,
+            pod_display_name=f"pod for step `{step_name}`",
+            pod_name=pod_name,
+            pod_manifest=pod_manifest,
+            namespace=args.kubernetes_namespace,
+            startup_max_retries=settings.pod_failure_max_retries,
+            startup_failure_delay=settings.pod_failure_retry_delay,
+            startup_failure_backoff=settings.pod_failure_backoff,
+            startup_timeout=settings.pod_startup_timeout,
+        )
 
         # Wait for pod to finish.
         logger.info(f"Waiting for pod of step `{step_name}` to finish...")

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/src/zenml/integrations/kubernetes/step_operators/kubernetes_step_operator.py

@@ -218,13 +218,24 @@ class KubernetesStepOperator(BaseStepOperator):
             mount_local_stores=False,
         )
 
-        self._k8s_core_api.create_namespaced_pod(
+        logger.info(
+            "Waiting for pod of step `%s` to start...", info.pipeline_step_name
+        )
+        kube_utils.create_and_wait_for_pod_to_start(
+            core_api=self._k8s_core_api,
+            pod_display_name=f"pod of step `{info.pipeline_step_name}`",
+            pod_name=pod_name,
+            pod_manifest=pod_manifest,
             namespace=self.config.kubernetes_namespace,
-            body=pod_manifest,
+            startup_max_retries=settings.pod_failure_max_retries,
+            startup_failure_delay=settings.pod_failure_retry_delay,
+            startup_failure_backoff=settings.pod_failure_backoff,
+            startup_timeout=settings.pod_startup_timeout,
         )
 
         logger.info(
-            "Waiting for pod of step `%s` to start...", info.pipeline_step_name
+            "Waiting for pod of step `%s` to finish...",
+            info.pipeline_step_name,
         )
         kube_utils.wait_pod(
             kube_client_fn=self.get_kube_client,

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/src/zenml/materializers/path_materializer.py

@@ -26,6 +26,7 @@ from zenml.constants import (
 from zenml.enums import ArtifactType
 from zenml.io import fileio
 from zenml.materializers.base_materializer import BaseMaterializer
+from zenml.utils.io_utils import is_path_within_directory
 
 
 class PathMaterializer(BaseMaterializer):
@@ -71,7 +72,15 @@ class PathMaterializer(BaseMaterializer):
 
                 # Extract the archive to the temporary directory
                 with tarfile.open(archive_path_local, "r:gz") as tar:
-                    tar.extractall(path=directory)
+                    # Validate archive members to prevent path traversal attacks
+                    # Filter members to only those with safe paths
+                    safe_members = []
+                    for member in tar.getmembers():
+                        if is_path_within_directory(member.name, directory):
+                            safe_members.append(member)
+
+                    # Extract only safe members
+                    tar.extractall(path=directory, members=safe_members)  # nosec B202 - members are filtered through is_path_within_directory
 
                 # Clean up the archive file
                 os.remove(archive_path_local)
@@ -93,8 +102,14 @@ class PathMaterializer(BaseMaterializer):
 
         Args:
             data: Path to a local directory or file to store. Must be a Path object.
+
+        Raises:
+            TypeError: If data is not a Path object.
         """
-        assert isinstance(data, Path)
+        if not isinstance(data, Path):
+            raise TypeError(
+                f"Expected a Path object, got {type(data).__name__}"
+            )
 
         if data.is_dir():
             # Handle directory artifact

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/src/zenml/utils/io_utils.py

@@ -205,6 +205,29 @@ def resolve_relative_path(path: str) -> str:
     return str(Path(path).resolve())
 
 
+def is_path_within_directory(path: str, directory: str) -> bool:
+    """Checks if a path is contained within a given directory.
+
+    This utility function verifies that a path (absolute or relative) resolves
+    to a location that is within the specified directory. This is useful for
+    security checks such as preventing path traversal attacks when extracting
+    archives (CVE-2007-4559) or whenever path containment needs to be verified.
+
+    Args:
+        path: The path to check (can be relative or absolute).
+        directory: The directory that should contain the path.
+
+    Returns:
+        Boolean indicating whether the path is contained within the directory (True)
+        or not (False).
+    """
+    # Convert to absolute path, ensuring it's normalized
+    abs_path = os.path.abspath(os.path.join(directory, path))
+    # Check if the path is within the target directory
+    dir_abs = os.path.abspath(directory)
+    return abs_path.startswith(dir_abs + os.sep) or abs_path == dir_abs
+
+
 def move(source: str, destination: str, overwrite: bool = False) -> None:
     """Moves dir or file from source to destination. Can be used to rename.
 

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/src/zenml/zen_server/auth.py

@@ -983,6 +983,58 @@ def generate_access_token(
     )
 
 
+def generate_artifact_download_token(artifact_version_id: UUID) -> str:
+    """Generate a JWT token for artifact download.
+
+    Args:
+        artifact_version_id: The ID of the artifact version to download.
+
+    Returns:
+        The JWT token for the artifact download.
+    """
+    import jwt
+
+    config = server_config()
+
+    return jwt.encode(
+        {
+            "exp": utc_now() + timedelta(seconds=30),
+            "artifact_version_id": str(artifact_version_id),
+        },
+        key=config.jwt_secret_key,
+        algorithm=config.jwt_token_algorithm,
+    )
+
+
+def verify_artifact_download_token(
+    token: str, artifact_version_id: UUID
+) -> None:
+    """Verify a JWT token for artifact download.
+
+    Args:
+        token: The JWT token to verify.
+        artifact_version_id: The ID of the artifact version to download.
+
+    Raises:
+        CredentialsNotValid: If the token is invalid or the artifact version
+            ID does not match.
+    """
+    import jwt
+
+    config = server_config()
+    try:
+        claims = jwt.decode(
+            token,
+            config.jwt_secret_key,
+            algorithms=[config.jwt_token_algorithm],
+        )
+    except jwt.PyJWTError as e:
+        raise CredentialsNotValid(f"Invalid JWT token: {e}") from e
+
+    if claims["artifact_version_id"] != str(artifact_version_id):
+        raise CredentialsNotValid("Invalid artifact version ID")
+
+
 def http_authentication(
     credentials: HTTPBasicCredentials = Depends(HTTPBasic()),
 ) -> AuthContext:

{zenml_nightly-0.80.2.dev20250413 → zenml_nightly-0.80.2.dev20250415}/src/zenml/zen_server/cloud_utils.py

@@ -7,7 +7,10 @@ import requests
 from requests.adapters import HTTPAdapter, Retry
 
 from zenml.config.server_config import ServerProConfiguration
-from zenml.exceptions import SubscriptionUpgradeRequiredError
+from zenml.exceptions import (
+    IllegalOperationError,
+    SubscriptionUpgradeRequiredError,
+)
 from zenml.utils.time_utils import utc_now
 from zenml.zen_server.utils import get_zenml_headers, server_config
 
@@ -43,6 +46,7 @@ class ZenMLCloudConnection:
         Raises:
             SubscriptionUpgradeRequiredError: If the current subscription tier
                 is insufficient for the attempted operation.
+            IllegalOperationError: If the request failed with a 403 status code.
             RuntimeError: If the request failed.
 
         Returns:
@@ -65,6 +69,8 @@ class ZenMLCloudConnection:
         except requests.HTTPError as e:
             if response.status_code == 402:
                 raise SubscriptionUpgradeRequiredError(response.json())
+            elif response.status_code == 403:
+                raise IllegalOperationError(response.json())
             else:
                 raise RuntimeError(
                     f"Failed while trying to contact the central zenml pro "

zenml_nightly-0.80.2.dev20250415/src/zenml/zen_server/download_utils.py

@@ -0,0 +1,126 @@
+#  Copyright (c) ZenML GmbH 2025. All Rights Reserved.
+#
+#  Licensed under the Apache License, Version 2.0 (the "License");
+#  you may not use this file except in compliance with the License.
+#  You may obtain a copy of the License at:
+#
+#       https://www.apache.org/licenses/LICENSE-2.0
+#
+#  Unless required by applicable law or agreed to in writing, software
+#  distributed under the License is distributed on an "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+#  or implied. See the License for the specific language governing
+#  permissions and limitations under the License.
+"""Utility functions for downloading artifacts."""
+
+import os
+import tarfile
+import tempfile
+from typing import (
+    TYPE_CHECKING,
+    Optional,
+)
+
+from zenml.artifacts.utils import _load_artifact_store
+from zenml.exceptions import (
+    IllegalOperationError,
+)
+from zenml.models import (
+    ArtifactVersionResponse,
+)
+from zenml.zen_server.utils import server_config, zen_store
+
+if TYPE_CHECKING:
+    from zenml.artifact_stores.base_artifact_store import BaseArtifactStore
+
+
+def verify_artifact_is_downloadable(
+    artifact: "ArtifactVersionResponse",
+) -> "BaseArtifactStore":
+    """Verify that the given artifact is downloadable.
+
+    Args:
+        artifact: The artifact to verify.
+
+    Raises:
+        IllegalOperationError: If the artifact is too large to be archived.
+        KeyError: If the artifact store is not found or the artifact URI does
+            not exist.
+
+    Returns:
+        The artifact store.
+    """
+    if not artifact.artifact_store_id:
+        raise KeyError(
+            f"Artifact '{artifact.id}' cannot be downloaded because the "
+            "underlying artifact store was deleted."
+        )
+
+    artifact_store = _load_artifact_store(
+        artifact_store_id=artifact.artifact_store_id, zen_store=zen_store()
+    )
+
+    if not artifact_store.exists(artifact.uri):
+        raise KeyError(f"The artifact URI '{artifact.uri}' does not exist.")
+
+    size = artifact_store.size(artifact.uri)
+    max_download_size = server_config().file_download_size_limit
+
+    if size and size > max_download_size:
+        raise IllegalOperationError(
+            f"The artifact '{artifact.id}' is too large to be downloaded. "
+            f"The maximum download size allowed by your ZenML server is "
+            f"{max_download_size} bytes."
+        )
+
+    return artifact_store
+
+
+def create_artifact_archive(
+    artifact: "ArtifactVersionResponse",
+    archive_path: Optional[str] = None,
+) -> str:
+    """Create an archive of the given artifact.
+
+    Args:
+        artifact: The artifact to archive.
+        archive_path: The path to which to save the archive.
+
+    Returns:
+        The path to the created archive.
+    """
+    if archive_path is None:
+        archive_path = tempfile.mktemp()
+
+    artifact_store = verify_artifact_is_downloadable(artifact)
+
+    def _prepare_tarinfo(path: str) -> tarfile.TarInfo:
+        archive_path = os.path.relpath(path, artifact.uri)
+        tarinfo = tarfile.TarInfo(name=archive_path)
+        if size := artifact_store.size(path):
+            tarinfo.size = size
+        return tarinfo
+
+    with tarfile.open(name=archive_path, mode="w:gz") as tar:
+        if artifact_store.isdir(artifact.uri):
+            for dir, _, files in artifact_store.walk(artifact.uri):
+                dir = dir.decode() if isinstance(dir, bytes) else dir
+                dir_info = tarfile.TarInfo(
+                    name=os.path.relpath(dir, artifact.uri)
+                )
+                dir_info.type = tarfile.DIRTYPE
+                dir_info.mode = 0o755
+                tar.addfile(dir_info)
+
+                for file in files:
+                    file = file.decode() if isinstance(file, bytes) else file
+                    path = os.path.join(dir, file)
+                    tarinfo = _prepare_tarinfo(path)
+                    with artifact_store.open(path, "rb") as f:
+                        tar.addfile(tarinfo, fileobj=f)
+        else:
+            tarinfo = _prepare_tarinfo(artifact.uri)
+            with artifact_store.open(artifact.uri, "rb") as f:
+                tar.addfile(tarinfo, fileobj=f)
+
+    return archive_path