Alex Goodman d27b6ebb1b fix: cap each extracted archive entry at 2 GB ...

`put` had no per-entry cap, unlike the legacy java path which capped every file at 2 GB through `intFile.SafeCopy`. At depth 1, one entry of an overlapping-entry zip bomb could decompress all the way to the 100 GB disk limit before anything stopped it.

- entries are now read through the same 2 GB cap (`intFile.PerFileReadLimit`, now exported). An entry over it is dropped after cap+1 bytes and the rest of the archive is still extracted
- `Resolver` gains `TruncatedReason`, so the truncation unknown says what happened ("an entry larger than 2.0 GiB was skipped", or the existing disk-limit text) instead of always blaming the limits

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

2026-09-24 13:21:08 -04:00

..

archive_nesting_test.go

fix: treat zero archive limits as the default

2026-09-24 11:14:23 -04:00

archive_tasks_test.go

fix: bound archive recursion with a cycle guard and depth ceiling

2026-09-24 11:32:15 -04:00

archive_tasks.go

fix: cap each extracted archive entry at 2 GB

2026-09-24 13:21:08 -04:00

cataloging_config.go

feat: 3626 add option enable license content; disable by default (#3631)

2025-02-05 20:41:03 +00:00

environment_tasks.go

chore(deps): update tools to latest versions (#2616)

2024-02-14 14:59:49 +00:00

executor_test.go

Add ability to scan snaps (as a source) (#3929)

2025-06-25 16:53:35 -04:00

executor.go

Add ability to scan snaps (as a source) (#3929)

2025-06-25 16:53:35 -04:00

expression_test.go

Add file catalogers to selection configuration (#3505)

2025-02-03 19:10:17 +00:00

expression.go

Add file catalogers to selection configuration (#3505)

2025-02-03 19:10:17 +00:00

factory.go

Add file catalogers to selection configuration (#3505)

2025-02-03 19:10:17 +00:00

feature_detection.go

feat: RHEL EUS detection (#4023)

2025-07-07 14:11:20 +00:00

file_tasks_test.go

Replace core SBOM-creation API with builder pattern (#1383)

2024-01-12 17:39:13 -05:00

file_tasks.go

feat: parallelize catalogers per-file and hash contents in parallel (#3636)

2025-03-26 11:10:08 -04:00

package_task_factory_test.go

fix: update license content filtering default case to be 'none' for no content returned

2025-05-16 14:25:15 +00:00

package_task_factory.go

feat: initial recursive archive cataloging impl

2026-09-10 08:45:36 -04:00

package_tasks.go

chore: revert custom index in favor of key_Split

2026-09-20 11:22:10 -04:00

relationship_tasks.go

Resolve owned file paths when searching for overlaps (#3828)

2025-04-24 21:59:45 +00:00

scope_tasks.go

Add deep-squashed scope to annotate all layers where a package exists (#3138)

2025-05-05 14:35:57 -04:00

selection_test.go

Add file catalogers to selection configuration (#3505)

2025-02-03 19:10:17 +00:00

selection.go

Add file catalogers to selection configuration (#3505)

2025-02-03 19:10:17 +00:00

set_test.go

Replace core SBOM-creation API with builder pattern (#1383)

2024-01-12 17:39:13 -05:00

set.go

Replace core SBOM-creation API with builder pattern (#1383)

2024-01-12 17:39:13 -05:00

task.go

Replace core SBOM-creation API with builder pattern (#1383)

2024-01-12 17:39:13 -05:00

unknowns_tasks.go

fix:handle compound aliases like ``.tgz`` when cataloging archives (#4421)

2025-12-02 16:55:32 -05:00