pkg-rar/tests/fixtures/ at trunk · mary.my.id/pkg-rar · Tangled

mary.my.id / pkg-rar

2

streaming RAR extractor jsr.io/@mary/rar

jsr

2

pkg-rar / tests / fixtures /

at trunk 1 folder 1 file

Mary fix: terminate the Blob reader stream once the slice is delivered 2mo ago

chore: vendor rarfile test corpus vendors the RAR test archives and their .exp golden dumps from markokr/rarfile (ISC, commit db1df33) into tests/fixtures/rarfile/, with the upstream LICENSE alongside for attribution.

3 months ago

rar3-long-password.rar

feat: implement RAR3 rarbug SHA-1 for >28-char passwords RARLAB's `rar3_s2k` runs a 0x40000-round SHA-1 over `wstr + salt` and extracts a 16-byte key/IV pair. when one update spans more than one SHA-1 block, RARLAB applies an in-place corruption: every full 64-byte block of the input aligned to the running hash boundary is overwritten with `W[64..79]` packed little-endian, using a circular-16-slot W expansion that does not match a normal 80-entry expansion. the corruption compounds across iterations because the same seed buffer is re-hashed in a tight loop. `Sha1.updateWithRar3Corruption` reproduces the quirk. `rar3DeriveKey` now routes seed updates through it, so passwords past 28 characters derive a key bit-exact with system `unrar`. shorter passwords (≤ 64-byte seeds) skip the corruption and behave like plain SHA-1. KDF correctness verified against rarfile's `test_rar3_s2k` vectors — the 29-character case hits the rarbug branch. an end-to-end fixture `rar3-long-password.rar` was hand-built (no RAR archiver is available in this environment), with system `unrar` used as an external oracle to confirm structural validity.

3 months ago