{"record":{"id":"851b90f1c32513e5","repo":"cilium/cilium","slug":"failed-to-open-zip-file-s-w","errorCode":null,"errorMessage":"failed to open ZIP file %s: %w","messagePattern":"failed to open ZIP file (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cilium-cli/features/summary.go","lineNumber":224,"sourceCode":"\n\t\t// Extract the ZIP file to the destination directory\n\t\terr = extractZip(tempFile, destDir)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"failed to extract artifact %s: %w\", tempFile, err)\n\t\t}\n\n\t\t// Clean up the temporary ZIP file\n\t\tos.Remove(tempFile)\n\t}\n\n\treturn nil\n}\n\n// extractZip extracts the contents of a ZIP file to a specified directory.\nfunc extractZip(zipPath, destDir string) error {\n\tr, err := zip.OpenReader(zipPath)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to open ZIP file %s: %w\", zipPath, err)\n\t}\n\tdefer r.Close()\n\n\tfor _, file := range r.File {\n\t\t// Sanitize file.Name to prevent directory traversal\n\t\tcleanName := filepath.Clean(file.Name)\n\t\tif strings.Contains(cleanName, \"..\") || filepath.IsAbs(cleanName) {\n\t\t\treturn fmt.Errorf(\"invalid file path in ZIP archive: %s\", file.Name)\n\t\t}\n\t\tdestPath := filepath.Join(destDir, cleanName)\n\t\tif !strings.HasPrefix(destPath, filepath.Clean(destDir)+string(os.PathSeparator)) {\n\t\t\treturn fmt.Errorf(\"file path escapes destination directory: %s\", destPath)\n\t\t}\n\n\t\tif file.FileInfo().IsDir() {\n\t\t\t// Create directories\n\t\t\tif err := os.MkdirAll(destPath, os.ModePerm); err != nil {\n\t\t\t\treturn fmt.Errorf(\"failed to create directory %s: %w\", destPath, err)","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/cilium/cilium/blob/ac7b90affa4baf0642e6685319d56907b3a73a6d/cilium-cli/features/summary.go#L206-L242","documentation":"extractZip opens the artifact with zip.OpenReader. If the file cannot be opened as a valid ZIP archive, this error reports the offending path plus the underlying cause.","triggerScenarios":"zip.OpenReader(zipPath) fails because the file is missing, unreadable, or not a valid ZIP (bad magic bytes / corrupt central directory).","commonSituations":"A previous download left a truncated temp file; HTML error page saved instead of a ZIP; permission denied on the temp file.","solutions":["Verify the file is a real ZIP: run unzip -t on the reported path","Re-download the artifact to fix truncation or corruption","Check file permissions on the temp file/directory","Confirm the server returned the artifact, not an HTML error page"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func looksLikeZip(p string) bool {\n\tf, err := os.Open(p)\n\tif err != nil { return false }\n\tdefer f.Close()\n\tvar magic [4]byte\n\tif _, err := io.ReadFull(f, magic[:]); err != nil { return false }\n\treturn magic[0] == 'P' && magic[1] == 'K'\n}","typeGuard":null,"tryCatchPattern":"if err := extractZip(zipPath, destDir); err != nil {\n\tvar pathErr *fs.PathError\n\tif errors.As(err, &pathErr) {\n\t\t// handle missing/unreadable file\n\t}\n\treturn err\n}","preventionTips":["Validate the artifact URL returns a real ZIP (content-type), not an HTML error page","Re-download truncated temp files instead of reusing them","Check file permissions before extraction","Pin trusted artifact sources"],"tags":["zip","corrupt-archive","io"],"backgroundTag":"invalid-zip-archive","analyzedSha":"ac7b90affa4baf0642e6685319d56907b3a73a6d","analyzedAt":"2026-08-31T18:27:15.868Z","schemaVersion":2},"datasetVersion":"2026-08-31T19:17:28.585Z"}