Expand description
Extraction of a zip dist into a directory, stripping the single root directory of GitHub/Packagist zipballs (ArchiveDownloader’s rule: strip iff the archive has exactly one top-level entry and it is a directory; otherwise everything is extracted as is), and a DISTRUSTFUL extraction:
- paths:
enclosed_name()(rejects..and absolute paths); - symlinks (unix mode S_IFLNK): relative target only, and the lexically resolved path must stay inside the package root;
- executable bits preserved (binaries depend on them);
- refusal of absurd decompressed sizes (crude zip bomb).