From 45d2410c8f7f6e6fc8d18af0dd84d99587fda52c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 4 Nov 2026 01:01:06 +0000 Subject: [PATCH 1/6] chore(deps): bump zip from 8.4.0 to 9.0.0 Bumps [zip](https://github.com/zip-rs/zip2) from 8.4.0 to 9.0.0. - [Release notes](https://github.com/zip-rs/zip2/releases) - [Changelog](https://github.com/zip-rs/zip2/blob/master/CHANGELOG.md) - [Commits](https://github.com/zip-rs/zip2/compare/v8.4.0...v9.0.0) --- updated-dependencies: - dependency-name: zip dependency-version: 9.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- Cargo.lock | 135 +++++++++++---------------------------- gitlab-runner/Cargo.toml | 2 +- 2 files changed, 38 insertions(+), 99 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index a13e87d..cf636a2 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -10,13 +10,13 @@ checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa" [[package]] name = "aes" -version = "0.8.4" +version = "0.9.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0" +checksum = "fc0fc36d7440d015b45468ba08a21e80e056ebbd014c611c6298bb7503e04bd1" dependencies = [ - "cfg-if", "cipher", - "cpufeatures 0.2.17", + "cpubits", + "cpufeatures", ] [[package]] @@ -145,15 +145,6 @@ version = "2.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af" -[[package]] -name = "block-buffer" -version = "0.10.4" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71" -dependencies = [ - "generic-array", -] - [[package]] name = "block-buffer" version = "0.12.0" @@ -161,6 +152,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "cdd35008169921d80bc60d3d0ab416eecb028c4cd653352907921d95084790be" dependencies = [ "hybrid-array", + "zeroize", ] [[package]] @@ -221,17 +213,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601" dependencies = [ "cfg-if", - "cpufeatures 0.3.0", + "cpufeatures", "rand_core 0.10.0", ] [[package]] name = "cipher" -version = "0.4.4" +version = "0.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad" +checksum = "e34d8227fe1ba289043aeb13792056ff80fd6de1a9f49137a5f499de8e8c78ea" dependencies = [ - "crypto-common 0.1.7", + "crypto-common", "inout", ] @@ -345,13 +337,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b" [[package]] -name = "cpufeatures" -version = "0.2.17" +name = "cpubits" +version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280" -dependencies = [ - "libc", -] +checksum = "15b85f9c39137c3a891689859392b1bd49812121d0d61c9caf00d46ed5ce06ae" [[package]] name = "cpufeatures" @@ -371,16 +360,6 @@ dependencies = [ "cfg-if", ] -[[package]] -name = "crypto-common" -version = "0.1.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a" -dependencies = [ - "generic-array", - "typenum", -] - [[package]] name = "crypto-common" version = "0.2.1" @@ -498,27 +477,17 @@ dependencies = [ "syn", ] -[[package]] -name = "digest" -version = "0.10.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292" -dependencies = [ - "block-buffer 0.10.4", - "crypto-common 0.1.7", - "subtle", -] - [[package]] name = "digest" version = "0.11.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4850db49bf08e663084f7fb5c87d202ef91a3907271aff24a94eb97ff039153c" dependencies = [ - "block-buffer 0.12.0", + "block-buffer", "const-oid", - "crypto-common 0.2.1", + "crypto-common", "ctutils", + "zeroize", ] [[package]] @@ -707,16 +676,6 @@ dependencies = [ "slab", ] -[[package]] -name = "generic-array" -version = "0.14.7" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a" -dependencies = [ - "typenum", - "version_check", -] - [[package]] name = "getrandom" version = "0.2.17" @@ -771,7 +730,7 @@ dependencies = [ "futures", "gitlab-runner-mock", "glob", - "hmac 0.13.0", + "hmac", "normalize-path", "parking_lot", "pin-project", @@ -779,7 +738,7 @@ dependencies = [ "reqwest", "serde", "serde_json", - "sha2 0.11.0", + "sha2", "tempfile", "thiserror 2.0.18", "tokio", @@ -858,22 +817,13 @@ version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fc0fef456e4baa96da950455cd02c081ca953b141298e41db3fc7e36b1da849c" -[[package]] -name = "hmac" -version = "0.12.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e" -dependencies = [ - "digest 0.10.7", -] - [[package]] name = "hmac" version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f" dependencies = [ - "digest 0.11.2", + "digest", ] [[package]] @@ -1122,11 +1072,11 @@ dependencies = [ [[package]] name = "inout" -version = "0.1.4" +version = "0.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01" +checksum = "3b5cf4372d022092674a83b8febf5865f7a573cc0c5baec5e49c879b6a20978f" dependencies = [ - "generic-array", + "hybrid-array", ] [[package]] @@ -1282,11 +1232,11 @@ checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154" [[package]] name = "lzma-rust2" -version = "0.16.2" +version = "0.21.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "47bb1e988e6fb779cf720ad431242d3f03167c1b3f2b1aae7f1a94b2495b36ae" +checksum = "fde178a3caf126c440fa15628147772d8ee590a39477d711353fbe2e58a73a5b" dependencies = [ - "sha2 0.10.9", + "sha2", ] [[package]] @@ -1441,12 +1391,12 @@ dependencies = [ [[package]] name = "pbkdf2" -version = "0.12.2" +version = "0.13.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2" +checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629" dependencies = [ - "digest 0.10.7", - "hmac 0.12.1", + "digest", + "hmac", ] [[package]] @@ -1969,24 +1919,13 @@ dependencies = [ [[package]] name = "sha1" -version = "0.10.6" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba" -dependencies = [ - "cfg-if", - "cpufeatures 0.2.17", - "digest 0.10.7", -] - -[[package]] -name = "sha2" -version = "0.10.9" +version = "0.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283" +checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214" dependencies = [ "cfg-if", - "cpufeatures 0.2.17", - "digest 0.10.7", + "cpufeatures", + "digest", ] [[package]] @@ -1996,8 +1935,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4" dependencies = [ "cfg-if", - "cpufeatures 0.3.0", - "digest 0.11.2", + "cpufeatures", + "digest", ] [[package]] @@ -3208,9 +3147,9 @@ dependencies = [ [[package]] name = "zip" -version = "8.4.0" +version = "9.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "7756d0206d058333667493c4014f545f4b9603c4330ccd6d9b3f86dcab59f7d9" +checksum = "711e8c9646791c49b7eb799a19c4ae70a9b8372ddc6a1fa4778defd1e2aa5d5e" dependencies = [ "aes", "bzip2", @@ -3219,7 +3158,7 @@ dependencies = [ "deflate64", "flate2", "getrandom 0.4.2", - "hmac 0.12.1", + "hmac", "indexmap", "lzma-rust2", "memchr", diff --git a/gitlab-runner/Cargo.toml b/gitlab-runner/Cargo.toml index fbf8f0a..61dd175 100644 --- a/gitlab-runner/Cargo.toml +++ b/gitlab-runner/Cargo.toml @@ -22,7 +22,7 @@ serde = { version = "1.0.228", features = [ "derive" ] } serde_json = "1.0.145" thiserror = "2.0.18" bytes = "1.11.1" -zip = "8.4.0" +zip = "9.0.0" pin-project = "1.1.11" futures = "0.3.32" async-trait = "0.1.89" From d1e96c33f3c3f6a1f34b31eb2a14e071ae985950 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 10 Nov 2026 11:30:18 +0000 Subject: [PATCH 2/6] Fix zip 9 artifact name API integration Co-authored-by: sjoerdsimons <22603932+sjoerdsimons@users.noreply.github.com> --- gitlab-runner/examples/demo-runner.rs | 2 +- gitlab-runner/src/artifact.rs | 5 +++-- gitlab-runner/tests/artifacts.rs | 11 +++++++---- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/gitlab-runner/examples/demo-runner.rs b/gitlab-runner/examples/demo-runner.rs index d4050b0..e39a06d 100644 --- a/gitlab-runner/examples/demo-runner.rs +++ b/gitlab-runner/examples/demo-runner.rs @@ -114,7 +114,7 @@ impl Run { s.clear(); s.push_str("Failed to read file to text"); } - (f.name().to_string(), s) + (f.name().expect("Failed to get file name").into_owned(), s) }; outputln!("=== File: {} ===", name); outputln!("{}", data); diff --git a/gitlab-runner/src/artifact.rs b/gitlab-runner/src/artifact.rs index 7d83a6f..e33b254 100644 --- a/gitlab-runner/src/artifact.rs +++ b/gitlab-runner/src/artifact.rs @@ -1,5 +1,6 @@ //! Helpers for artifacts downloaded from gitlab use std::{ + borrow::Cow, io::{Read, Seek}, path::PathBuf, }; @@ -13,7 +14,7 @@ pub struct ArtifactFile<'a>(ZipFile<'a, Box>); impl ArtifactFile<'_> { /// Get the name of the file - pub fn name(&self) -> &str { + pub fn name(&self) -> ZipResult> { self.0.name() } @@ -52,7 +53,7 @@ impl Artifact { /// /// The returned file name isn't sanatized in any way and should *not* be used as a path on the /// filesystem. To get a safe path of a given file use [`ArtifactFile::path`] - pub fn file_names(&self) -> impl Iterator { + pub fn file_names(&self) -> impl Iterator>> { self.zip.file_names() } diff --git a/gitlab-runner/tests/artifacts.rs b/gitlab-runner/tests/artifacts.rs index d9820a7..7f27e15 100644 --- a/gitlab-runner/tests/artifacts.rs +++ b/gitlab-runner/tests/artifacts.rs @@ -68,7 +68,10 @@ impl Download { .await .unwrap() .expect("No artifacts to download"); - let mut names: Vec<_> = artifact.file_names().collect(); + let mut names: Vec<_> = artifact + .file_names() + .collect::>>() + .expect("Failed to get artifact file names"); names.sort_unstable(); assert_eq!(3, names.len()); assert_eq!(&["dir/test", "test", "test2"], names.as_slice()); @@ -79,7 +82,7 @@ impl Download { ("dir/test", "testdata-dir"), ] { let mut f = artifact.file(name).expect("Testfile not available"); - assert_eq!(f.name(), name); + assert_eq!(f.name().unwrap(), name); let mut data = Vec::new(); f.read_to_end(&mut data).expect("Failed to read content"); assert_eq!(expected.as_bytes(), &*data); @@ -87,7 +90,7 @@ impl Download { /* Try reading first data file a second time */ let mut f = artifact.file("test").expect("Testfile not available"); - assert_eq!(f.name(), "test"); + assert_eq!(f.name().unwrap(), "test"); let mut data = Vec::new(); f.read_to_end(&mut data).expect("Failed to read content"); assert_eq!("testdata".as_bytes(), &*data); @@ -246,7 +249,7 @@ async fn multiple_upload() { assert_eq!(z.len(), 3); for ix in 0..z.len() { let mut f = z.by_index(ix).expect("failed to get zip file"); - match f.name() { + match f.name().unwrap().as_ref() { "test" => { let mut data = Vec::new(); f.read_to_end(&mut data).expect("failed to read zip file"); From 6e8403ead4c8f01604aced49c85e382208e35626 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 10 Nov 2026 12:11:05 +0000 Subject: [PATCH 3/6] Log artifact filename decoding errors Co-authored-by: sjoerdsimons <22603932+sjoerdsimons@users.noreply.github.com> --- gitlab-runner/examples/demo-runner.rs | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/gitlab-runner/examples/demo-runner.rs b/gitlab-runner/examples/demo-runner.rs index e39a06d..36cd259 100644 --- a/gitlab-runner/examples/demo-runner.rs +++ b/gitlab-runner/examples/demo-runner.rs @@ -11,7 +11,7 @@ use gitlab_runner::{ }; use serde::Deserialize; use tokio::signal::unix::{SignalKind, signal}; -use tracing::{debug, info}; +use tracing::{debug, error, info}; use tracing_subscriber::prelude::*; use url::Url; @@ -109,12 +109,19 @@ impl Run { for i in 0..artifact.len() { let (name, data) = { let mut f = artifact.by_index(i).expect("Failed to open file"); + let name = match f.name() { + Ok(name) => name.into_owned(), + Err(e) => { + error!("Failed to get file name: {e}"); + continue; + } + }; let mut s = String::new(); if f.read_to_string(&mut s).is_err() { s.clear(); s.push_str("Failed to read file to text"); } - (f.name().expect("Failed to get file name").into_owned(), s) + (name, s) }; outputln!("=== File: {} ===", name); outputln!("{}", data); From 5d58744cd41e4bba72e2f9ca2658bb06fb539714 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 10 Nov 2026 12:30:12 +0000 Subject: [PATCH 4/6] Avoid leaking zip errors and log to job trace Co-authored-by: sjoerdsimons <22603932+sjoerdsimons@users.noreply.github.com> --- gitlab-runner/examples/demo-runner.rs | 4 ++-- gitlab-runner/src/artifact.rs | 10 ++++++---- gitlab-runner/tests/artifacts.rs | 2 +- 3 files changed, 9 insertions(+), 7 deletions(-) diff --git a/gitlab-runner/examples/demo-runner.rs b/gitlab-runner/examples/demo-runner.rs index 36cd259..d9ad9b9 100644 --- a/gitlab-runner/examples/demo-runner.rs +++ b/gitlab-runner/examples/demo-runner.rs @@ -11,7 +11,7 @@ use gitlab_runner::{ }; use serde::Deserialize; use tokio::signal::unix::{SignalKind, signal}; -use tracing::{debug, error, info}; +use tracing::{debug, info}; use tracing_subscriber::prelude::*; use url::Url; @@ -112,7 +112,7 @@ impl Run { let name = match f.name() { Ok(name) => name.into_owned(), Err(e) => { - error!("Failed to get file name: {e}"); + outputln!("Failed to get file name: {}\n", e); continue; } }; diff --git a/gitlab-runner/src/artifact.rs b/gitlab-runner/src/artifact.rs index e33b254..83617e2 100644 --- a/gitlab-runner/src/artifact.rs +++ b/gitlab-runner/src/artifact.rs @@ -14,8 +14,8 @@ pub struct ArtifactFile<'a>(ZipFile<'a, Box>); impl ArtifactFile<'_> { /// Get the name of the file - pub fn name(&self) -> ZipResult> { - self.0.name() + pub fn name(&self) -> std::io::Result> { + self.0.name().map_err(std::io::Error::other) } /// Get the safe path of the file @@ -53,8 +53,10 @@ impl Artifact { /// /// The returned file name isn't sanatized in any way and should *not* be used as a path on the /// filesystem. To get a safe path of a given file use [`ArtifactFile::path`] - pub fn file_names(&self) -> impl Iterator>> { - self.zip.file_names() + pub fn file_names(&self) -> impl Iterator>> { + self.zip + .file_names() + .map(|name| name.map_err(std::io::Error::other)) } /// Get a file in the artifact by name diff --git a/gitlab-runner/tests/artifacts.rs b/gitlab-runner/tests/artifacts.rs index 7f27e15..dacc205 100644 --- a/gitlab-runner/tests/artifacts.rs +++ b/gitlab-runner/tests/artifacts.rs @@ -70,7 +70,7 @@ impl Download { .expect("No artifacts to download"); let mut names: Vec<_> = artifact .file_names() - .collect::>>() + .collect::>>() .expect("Failed to get artifact file names"); names.sort_unstable(); assert_eq!(3, names.len()); From 13353f4c6b7a8eff37db33ef6bdb5367531e2e62 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 10 Nov 2026 12:46:49 +0000 Subject: [PATCH 5/6] Preserve embedded ZIP I/O errors Co-authored-by: sjoerdsimons <22603932+sjoerdsimons@users.noreply.github.com> --- gitlab-runner/src/artifact.rs | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-) diff --git a/gitlab-runner/src/artifact.rs b/gitlab-runner/src/artifact.rs index 83617e2..42a62d5 100644 --- a/gitlab-runner/src/artifact.rs +++ b/gitlab-runner/src/artifact.rs @@ -7,6 +7,34 @@ use std::{ use zip::{read::ZipFile, result::ZipResult}; +fn zip_error_to_io(error: zip::result::ZipError) -> std::io::Error { + match error { + zip::result::ZipError::Io(error) => error, + error => std::io::Error::other(error), + } +} + +#[cfg(test)] +mod tests { + use super::zip_error_to_io; + use std::io::{Error, ErrorKind}; + use zip::result::ZipError; + + #[test] + fn preserves_io_errors() { + let error = zip_error_to_io(ZipError::Io(Error::from(ErrorKind::NotFound))); + + assert_eq!(error.kind(), ErrorKind::NotFound); + } + + #[test] + fn maps_other_errors_to_other() { + let error = zip_error_to_io(ZipError::FileNotFound); + + assert_eq!(error.kind(), ErrorKind::Other); + } +} + /// A file in a gitlab artifact /// /// Most importantly this implements [`Read`] to read out the content of the file @@ -15,7 +43,7 @@ pub struct ArtifactFile<'a>(ZipFile<'a, Box>); impl ArtifactFile<'_> { /// Get the name of the file pub fn name(&self) -> std::io::Result> { - self.0.name().map_err(std::io::Error::other) + self.0.name().map_err(zip_error_to_io) } /// Get the safe path of the file @@ -56,7 +84,7 @@ impl Artifact { pub fn file_names(&self) -> impl Iterator>> { self.zip .file_names() - .map(|name| name.map_err(std::io::Error::other)) + .map(|name| name.map_err(zip_error_to_io)) } /// Get a file in the artifact by name From 70fc01bc7a75209f2761861110a7a48521fa5bd6 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Tue, 10 Nov 2026 13:05:33 +0000 Subject: [PATCH 6/6] Move artifact tests after production items Co-authored-by: sjoerdsimons <22603932+sjoerdsimons@users.noreply.github.com> --- gitlab-runner/src/artifact.rs | 42 +++++++++++++++++------------------ 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/gitlab-runner/src/artifact.rs b/gitlab-runner/src/artifact.rs index 42a62d5..116bb69 100644 --- a/gitlab-runner/src/artifact.rs +++ b/gitlab-runner/src/artifact.rs @@ -14,27 +14,6 @@ fn zip_error_to_io(error: zip::result::ZipError) -> std::io::Error { } } -#[cfg(test)] -mod tests { - use super::zip_error_to_io; - use std::io::{Error, ErrorKind}; - use zip::result::ZipError; - - #[test] - fn preserves_io_errors() { - let error = zip_error_to_io(ZipError::Io(Error::from(ErrorKind::NotFound))); - - assert_eq!(error.kind(), ErrorKind::NotFound); - } - - #[test] - fn maps_other_errors_to_other() { - let error = zip_error_to_io(ZipError::FileNotFound); - - assert_eq!(error.kind(), ErrorKind::Other); - } -} - /// A file in a gitlab artifact /// /// Most importantly this implements [`Read`] to read out the content of the file @@ -107,3 +86,24 @@ impl Artifact { self.zip.len() } } + +#[cfg(test)] +mod tests { + use super::zip_error_to_io; + use std::io::{Error, ErrorKind}; + use zip::result::ZipError; + + #[test] + fn preserves_io_errors() { + let error = zip_error_to_io(ZipError::Io(Error::from(ErrorKind::NotFound))); + + assert_eq!(error.kind(), ErrorKind::NotFound); + } + + #[test] + fn maps_other_errors_to_other() { + let error = zip_error_to_io(ZipError::FileNotFound); + + assert_eq!(error.kind(), ErrorKind::Other); + } +}