Skip to content

Conversation

@jsoriano
Copy link
Member

@jsoriano jsoriano commented Nov 10, 2025

Use stdlib's archive.zip for Zip compression.

The main benefits of the other library are:

  • Multiple compression formats.
  • Additional compression algorithms on the zip format.
  • Able to append files to existing zip files.

We are not using any of these benefits, and on the other hand it has the following problems:

  • Less maintained than stdlib.
  • Misleading defaults that may lead to don't use any compression.
  • Frequent false positives on security reports on formats or algorithms that we don't use.

In addition to that, the stdlib included AddFS in 1.22.0, that is quite handy to just compress a directory with good-enough defaults. AddFS is not used at the end.

@jsoriano jsoriano self-assigned this Nov 10, 2025
@jsoriano jsoriano requested a review from a team as a code owner November 10, 2025 11:34
@jsoriano
Copy link
Member Author

test integrations

@elastic-vault-github-plugin-prod

Created or updated PR in integrations repository to test this version. Check elastic/integrations#15918

)

// Zip function creates the .zip archive from the source path (built package content).
func Zip(ctx context.Context, sourcePath, destinationFile string) error {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we add a small unit test that verifies this works as expected?

i am wondering, both sourcePath and destinationFile are absolute paths, do they have to belong to the repository?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we add a small unit test that verifies this works as expected?

Added in 01ad9b3

i am wondering, both sourcePath and destinationFile are absolute paths, do they have to belong to the repository?

Not really, both are intended to be used with built files. The source path is the built package, and the destination file is the built zip.

}

logger.Debugf("Create work directory for archiving: %s", workDir)
err = CopyAll(sourcePath, workDir)
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have taken the opportunity to make a small refactor, with the new fsWithPrefix wrapper, we don't need to copy all the files only to add the root directory.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of adding a wrapper, I have followed at the end the same approach as Mario in https://github.com/elastic/package-storage-infra/pull/1069, cloning zip.AddFS to add the prefix.

)

// Zip function creates the .zip archive from the source path (built package content).
func Zip(ctx context.Context, sourcePath, destinationFile string) error {
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Current implementation doesn't use a context, I have removed it, and from all the callers that don't use it.

Copy link
Member Author

@jsoriano jsoriano Nov 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removing >200 indirect dependencies is actually the best part of this change 🙂

Update: this is 30% of elastic-package dependencies 😮

@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

History

cc @jsoriano

Copy link
Contributor

@mrodm mrodm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

}

err = files.Zip(ctx, builtPackageDir, zippedPackagePath)
logger.Debugf("Compress using archives.Zip (destination: %s)", zippedPackagePath)
Copy link
Contributor

@mrodm mrodm Nov 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍

Not sure if this was added just for debugging, but it looks like it could be kept:

2025/11/11 10:53:03 DEBUG Build zipped package
2025/11/11 10:53:03 DEBUG Compress using archives.Zip (destination: /home/user/Coding/work/integrations/build/packages/nginx-2.3.2.zip)
2025/11/11 10:53:03 DEBUG Validating built .zip package (path: /home/user/Coding/work/integrations/build/packages/nginx-2.3.2.zip)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jsoriano jsoriano merged commit 0658ef4 into elastic:main Nov 11, 2025
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants