zip/unzip: add security-patched archive workflows

[brandonpayton]

Purpose

Add Info-ZIP creation, extraction, inspection, and streaming tools as first-class Kandelo Homebrew formulae, with a truthful UnZip-to-Zip dependency order and the maintained downstream security patch sets.

Formula contract

• Build Zip 3.0 and UnZip 6.0 directly through Kandelo's worktree-local SDK.
• Apply Homebrew's selected Debian Zip patches, including the deliberate omission of GCC 14/glibc-only patch 12.
• Apply all 32 entries in Ubuntu's UnZip debian/patches/series, including handle_windows_zip64.patch, the manpage correction, and CVE-2021-4217.patch.
• Declare UnZip as Zip's direct runtime dependency because zip -T executes unzip.
• Install the real standalone funzip; make zipinfo the actual argv0 alias of unzip.
• Preserve the dependency-free registry feature profile: stored and Deflate entries are supported, while optional bzip2 methods remain disabled because the authoritative registry manifests declare no bzip2 dependency. The tap now has a linkable bzip2 surface, but this migration does not silently expand the package contract.
• Restrict the initial formulae to wasm32.

The final modules do not import kernel.kernel_fork. Info-ZIP's process paths lower through Kandelo posix_spawn, so fork continuation instrumentation is neither needed nor added.

Source acceptance

These source formulae may merge independently after a fresh source-only devil review. The PR contains no bottle block, sidecar, archive, receipt, provenance metadata, or other binary artifact, and merging it does not claim that either bottle is published or installable.

Existing runtime evidence

Earlier ABI 18 builds independently reproduced all declared source and patch hashes and verified the UnZip patch list against Ubuntu's exact 32-entry series. Two clean builds produced byte-identical executables.

Literal tests covered Deflate listing/extraction, unzip -Z, zipinfo argv0 dispatch, real funzip streaming, missing-archive status 9, Zip creation/listing, zip -T through exact dependency-keg bytes, and nothing-to-do status 12. Chromium exercised the same built bytes for unzip -p, zipinfo -h, and zip -T. All three executables reported ABI 18, contained no legacy Asyncify or fork-continuation surface, and embedded no staging, workspace, Nix, or temporary path.

Those builds are historical implementation evidence only. Their hashes are not publishable bottle provenance.

Current exact-head validation

The source series is based on exact tap main 36df17ec5395fb4531fddc2d9ab769eb1e6c19ca; current head is 29f9da9ffd5736259e52f00bf836ade107453668.

• Exact formula SHA-256 values are 6256025a4ae0ce90d4d2a8f51f92953040aaeecad042743f77f71c50cc167b14 for Zip and de7a4f30daae3d07cd84414d9c1b48ced48ee88e72a572be4f675cc5fae1e908 for UnZip.
• Fresh exact patched ABI 18 builds used the upstream install targets and preserved Zip's four binaries/four manpages plus UnZip's three Wasm binaries, zipgrep, the real zipinfo hardlink, and five manpages.
• All seven Wasm executables report ABI 18 and pass the #882 aliased-export guard, fork-forbidden, Asyncify, and forbidden-path checks.
• Runtime coverage passed for Zip create/list/-T, zipnote, zipcloak, zipsplit, UnZip list/extract/zipinfo/funzip/status 9, and zipgrep with only ABI 18 Dash plus the documented base tools.
• The pure-Ruby kandelo.sfx construction ran in ABI 18 Kandelo: -t verified both entries and extraction produced byte-exact 1216/864-byte files. The documented llvm-objcopy --add-section kandelo.sfx=... path independently produced valid runnable SFX bytes.
• Portable Ruby formula-support tests passed (29 runs, 216 assertions). Formula syntax, brew style, and git diff --check passed; the worktree is clean.

An independent devil's-advocate review accepted this exact head. No bottle, sidecar, receipt, or provenance artifact is included.

Durable zipgrep follow-up

The current test do block verifies the installed zipgrep script and its command surface; historical exact-head Node evidence exercised the script with ABI 18 Dash and its base tools. Before bottle publication, the merged-head validation must promote that real shell/egrep/sed/basename/unzip execution path into durable automated coverage and rerun it against the poured bytes. This is a test-automation gate, not a Formula source or dependency correction.

Platform follow-up

Automattic/kandelo#877 owns the legacy registry's incorrect funzip -> unzip mapping. It does not gate the tap source: this formula builds, installs, and tests upstream's real standalone funzip and adds no compatibility wrapper.

Bottle gates

Publication is dependency-first: publish, pour, and verify the UnZip bottle before building Zip, so zip -T consumes prior Homebrew bottle bytes and its receipt/provenance records that dependency.

Trusted bottle publication remains gated on Automattic/kandelo#842, #881, #882, #887, #890, and the reworked #885; #887 is required because both formulae consume Binaryen and WABT as Homebrew build-dependency bottles; tap #22 if a branch dry run is needed; and fresh exact merged-head ABI 18 builds with reviewed sidecars and stock-guest Node/Chromium pour tests against published bytes. Automattic/kandelo#873, #874, and #888 do not apply because these direct Makefile builds neither configure nor fork-instrument.

Automattic/kandelo#867 is the merged ABI 18 baseline, not a pending gate. No main-repository or ABI change is included here.

[brandonpayton]

Exact-head update after tap #70

This branch is now based directly on tap main 36df17ec5395fb4531fddc2d9ab769eb1e6c19ca and uses the merged fail-closed Wasm artifact validator. Current head: cc490f5b19209fcca461e791d79c9a36d0891436.

Zip blob 81917ae0, SHA-256 bcc09ab2...03d23ee; UnZip blob 463b8216, SHA-256 8950c294...3c12dc98.

Through Kandelo's dev shell, the combined eight-formula syntax/style pass is clean, the merged support suite passes 29/216, and branch diff checks pass. A fresh exact-head devil review is still required.

This supersedes the older restack head/base/hash paragraph in the PR body. Source materialization remains gated on Automattic/kandelo#882; no bottle, sidecar, receipt, provenance, or poured-install claim is made by this update.

[brandonpayton]

Independent devil's-advocate review: ACCEPT exact head 29f9da9ffd5736259e52f00bf836ade107453668 over 36df17ec5395fb4531fddc2d9ab769eb1e6c19ca.

Exact formula evidence:

• Formula/zip.rb: SHA-256 6256025a4ae0ce90d4d2a8f51f92953040aaeecad042743f77f71c50cc167b14
• Formula/unzip.rb: SHA-256 de7a4f30daae3d07cd84414d9c1b48ced48ee88e72a572be4f675cc5fae1e908

The reviewer recreated both patched source trees and ABI 18 builds. Upstream install targets produced Zip's four binaries/four manpages and UnZip's three Wasm binaries plus zipgrep, real zipinfo hardlink, and five manpages. All seven Wasm tools report ABI 18 and pass the #882 aliased-export, fork-forbidden, Asyncify, and path guards.

Runtime coverage passed for Zip create/list/-T, zipnote, zipcloak, zipsplit, UnZip list/extract/zipinfo/funzip/status 9, and zipgrep with only ABI 18 Dash plus its declared base tools. The corrected pure-Ruby kandelo.sfx module ran inside ABI 18 Kandelo: -t verified both entries and extraction produced the exact 1216/864-byte payloads with the asserted upstream banner. The documented llvm-objcopy --add-section kandelo.sfx=... path also produced valid runnable SFX bytes.

Portable Ruby support tests passed (29 runs, 216 assertions), as did syntax, brew style, and diff checks. Scope is source-only: no bottles, sidecars, or receipts. Main #882 remains the declared source merge gate; this acceptance does not waive publication gates.

[brandonpayton]

Final devil's-advocate disposition: ACCEPT source merge at 29f9da9ffd5736259e52f00bf836ade107453668. Independent review verified every upstream/patch hash, exact Ubuntu 32-entry series, dependency direction, fork-forbidden artifacts, install surface, SFX construction, and historical ABI 18 Node/Chromium behavior. The PR now includes the previously omitted #887 build-dependency bottle gate and explicitly keeps real zipgrep execution as a durable pre-publication test requirement. No bottle block or publication claim is included.