Add a small 7z fixture whose filter chain is ARM64 BCJ followed by
LZMA2. This exercises extraction through CMake's bundled libarchive
and liblzma path.
The fixture was generated with 7-Zip 25.01 (arm64). The payload is a
16-byte AArch64 instruction sequence:
1f2003d500000094000000141f2003d5
The payload mtime was set to 2026-06-21T00:00:00Z and then archived
with:
7z a -m0=ARM64 -m1=LZMA2 -mb0:1 -mtm=on -mtc=off -mta=off \
7zip-arm64-bcj.7z payload.bin
The resulting 7zip-arm64-bcj.7z has SHA256:
3DE9111E71C6AA3CBD604460040EBBE6F57E8B00D1D5C5343AC07D435AA2A8D2
Add security flags to libarchive extraction to prevent path traversal
(Zip Slip) and absolute path attacks:
- ARCHIVE_EXTRACT_SECURE_NODOTDOT: Block ".." path components
- ARCHIVE_EXTRACT_SECURE_NOABSOLUTEPATHS: Block absolute paths
- ARCHIVE_EXTRACT_SECURE_SYMLINKS: Block symlinks escaping extract dir
This hardens both `cmake -E tar` and `file(ARCHIVE_EXTRACT)` against
malicious archives that attempt to write files outside the intended
extraction directory.
Similar to GNU tar add a --touch option to the tar extract command to
skip extracting the timestamps from the files in the archive
effectively touching them as if they were just created.
Issue: #22746
Rationale:
Currently during creation of archive by 'tar',
if error appears, it interrupt archive creation.
As a result only part of files are archived
This behaviour is not consistent with 'copy_directory', native 'tar'
and other command behaviour.
With this Merge Request this behaviour is fixed.
NihilDigit
Alex Overchenko
Leslie P. Polzer
Brad King
Kasper Laudrup
Bartosz Kosiorek
Bartosz Kosiorek
Nils Gladitz