spaxe-dev/zipcheck

No problems traced to this repository code in these checks.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• zipcheck detects a high-expansion zip bomb without extracting it: Real input produced the expected result: 1 suspicious

  Source: Static zip-bomb / archive-bomb detection that never extracts anything.

  Input: bomb.zip declaring 300000000 bytes from 291706 bytes on disk

  Expected: reported as suspicious

  Command: <guest-path> --fail-on none <guest-path>

  Observed: 1 suspicious, 0 clean, 0 unknown (0.00s) use -v for notes and member samples; --json for machine output

• --fail-on none exits 0 even when suspicious: Real input produced the expected result: 0 dangerous, 1 suspicious

  Source: zipcheck --fail-on none archive.zip

  Input: bomb.zip

  Expected: summary line shows 1 suspicious

  Command: <guest-path> --fail-on none <guest-path>

  Observed: 0 dangerous, 1 suspicious, 0 clean, 0 unknown (0.00s) use -v for notes and member samples; --json for machine output

Examples

• JSON output reports the suspicious verdict for the bomb sample: command completed successfully

  Source: README.md ## Usage (--json, machine-readable)

  Input: --json --fail-on none bomb.zip

  Expected: verdict suspicious in JSON

  Command: <guest-path> --json --fail-on none <guest-path>

  Observed: truncated": false, "findings": [ { "code": "HIGH_EXPANSION", "severity": "medium", "severity_value": 2, "title": "Declared expansion is unusually large", "detail": "The archive declares 300000000 bytes of output from 291706 bytes on disk (1,028:1). Extract it only inside a resource-limited sandbox.", "evidence": { "declared_uncompressed": 300000000, "file_size": 291706, "ratio": 1028.4327370708863 } } ], "nested": [], "duration_ms": 3.398 } ] }

• Repository test suite (documented Development commands): command completed successfully

  Source: README.md ## Development

  Input: python -m pytest

  Expected: tests pass

  Command: <guest-path> -m pytest -q

  Observed: ........................................................................ [ 69%] ................................ [100%]

Local or hosted: local

Scan an archive for zip-bomb risk with the zipcheck CLI (static metadata check, no extraction)

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md 2>/dev/null | head -c 6000
ls <guest-path> ; ls /inputs 2>/dev/null; echo "CDP=$CDP_URL"; curl -s -m 10 -i "$CDP_URL/json/version" | head -20
cd <guest-path> && grep -n "^## \|^### " README.md && sed -n '/^## Install/,/^## Detection rules/p' README.md | head -c 7000
cd <guest-path> && python3 -m venv <guest-path> 2>&1 | tail -3; <guest-path> -m pip install -q --upgrade pip 2>&1 | tail -3; <guest-path> -m pip install '.[aes]' 2>&1 | tail -5; ls <guest-path> | grep -i zip
mkdir -p <guest-path> && cd <guest-path> && which zip || (sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y zip >/dev/null 2>&1; which zip); head -c 300000000 /dev/zero | zip -q -9 bomb.zip - ; echo "hello" > hello.txt && zip -q small.zip hello.txt; ls -la <guest-path>
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import sys, zipfile
out = sys.argv[1]
with zipfile.ZipFile(out + "/bomb.zip", "w", zipfile.ZIP_DEFLATED, compresslevel=9) as z:
    z.writestr("zeros.bin", b"\0" * 300_000_000)
with zipfile.ZipFile(out + "/small.zip", "w", zipfile.ZIP_DEFLATED) as z:
    z.writestr("hello.txt", "hello\n")
EOF
python3 -I <guest-path> <guest-path> && ls -la <guest-path> && <guest-path> <guest-path>; echo "rc=$?"; <guest-path> <guest-path>; echo "rc=$?"
cd <guest-path> && sed -n '712,760p' README.md | head -c 4000; echo ----; grep -rniE "cron|schedul|watch|--once|daemon|webhook" src README.md | head -20; echo ----; ls tests tools; ls .coldpass
cd <guest-path> && timeout 900 <guest-path> -m pip install -q -e '.[dev]' 2>&1 | tail -3; timeout 900 <guest-path> -m pytest -q 2>&1 | tail -8
cd <guest-path> && grep -c -F "Static zip-bomb / archive-bomb detection that never extracts anything." README.md; grep -c -F "zipcheck --fail-on none archive.zip" README.md; grep -c -F "Requires Python 3.10+." README.md; <guest-path> --json --fail-on none <guest-path> | head -c 700; echo; echo rc=$?
cd <guest-path> && Z=<guest-path> && cat > probe.json <<EOF
{"kind":"cli","argv":["$Z","--fail-on","none","<guest-path>"],"cwd":"<guest-path>","env":{},"expected_text":"1 suspicious"}
EOF
cat > claims.json <<EOF
[
{"kind":"claim","claim":"zipcheck detects a high-expansion zip bomb without extracting it","source":"Static zip-bomb / archive-bomb detection that never extracts anything.","input":"bomb.zip declaring 300000000 bytes from 291706 bytes on disk","expected":"reported as suspicious","probe_kind":"cli","argv":["$Z","--fail-on","none","<guest-path>"],"cwd":"<guest-path>","env":{},"expected_text":"1 suspicious"},
{"kind":"claim","claim":"--fail-on none exits 0 even when suspicious","source":"zipcheck --fail-on none archive.zip","input":"bomb.zip","expected":"summary line shows 1 suspicious","probe_kind":"cli","argv":["$Z","--fail-on","none","<guest-path>"],"cwd":"<guest-path>","env":{},"expected_text":"0 dangerous, 1 suspicious"}
]
EOF
cat > examples.json <<EOF
[
{"kind":"example","claim":"JSON output reports the suspicious verdict for the bomb sample","source":"README.md ## Usage (--json, machine-readable)","input":"--json --fail-on none bomb.zip","expected":"verdict suspicious in JSON","argv":["$Z","--json","--fail-on","none","<guest-path>"],"cwd":"<guest-path>","env":{},"expected_text":"\"verdict\": \"suspicious\""},
{"kind":"example","claim":"Repository test suite (documented Development commands)","source":"README.md ## Development","input":"python -m pytest","expected":"tests pass","argv":["<guest-path>","-m","pytest","-q"],"cwd":"<guest-path>","env":{}}
]
EOF
cat > cycles.json <<EOF
{"detected":false,"reason":"Entry points inspected (src/zipcheck CLI, README Usage) and grep for cron/schedule/watch/--once/daemon/webhook found nothing. zipcheck is a one-shot CLI that scans the files it is given and exits; no product scheduler or loop exists.","checks":[]}
EOF
for f in probe claims examples cycles; do <guest-path> -m json.tool $f.json >/dev/null && echo "$f ok"; done
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Scan an archive for zip-bomb risk with the zipcheck CLI (static metadata check, no extraction)","operation_scope":"Linux guest, Python 3.12.3, venv at <guest-path> with zipcheck[aes] 0.3.0 installed from the checkout; sample archives generated in <guest-path>; no browser or credentials needed","steps":["python3 -m venv <guest-path>","<guest-path> -m pip install '.[aes]'  (README Install, from checkout)","<guest-path> <guest-path>  -> CLEAN","<guest-path> --fail-on none <guest-path>  -> SUSPICIOUS, HIGH_EXPANSION, 1 suspicious","<guest-path> --json --fail-on none <guest-path>  -> verdict suspicious","python -m pip install -e '.[dev]' and python -m pytest (README Development)"],"deviations":["zip binary not present in the guest, so the bomb fixture was generated with a stdlib zipfile script (<guest-path>) instead of the zip CLI","Installed into a venv rather than pipx/uv (both documented; venv is the README pip path)","Did not run tools/generate_samples.py (needs a RAR binary and produces large files); used a 300 MB zero-filled deflate bomb instead","Browser CDP endpoint checked (HTTP 200) but not used; zipcheck is a CLI"],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for this run."}
EOF
<guest-path> -m json.tool report.json >/dev/null && echo report ok; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40