Bandcamp and archive.org zip archives are unpacked with setuid

[acid-bong]

Version

0.8.0

Description

steps to reproduce:

• download an archive: "name your price" https://mementoorl.bandcamp.com/album/demo-2020, free https://darlingyou.bandcamp.com/album/the-weight-of-days
• unpack with Ouch
• files have 4032 permissions

Current Behavior

$ ouch --version
ouch 0.8.0

$ ouch d memento.\ -\ Demo\ 2020.zip -d memento-0.8.0
[INFO] Directory "memento-0.8.0" created
[INFO] extracted ( 47.83 MiB) "memento-0.8.0/memento. - Demo 2020 - 01 Coexist.flac"
[INFO] extracted ( 34.28 MiB) "memento-0.8.0/memento. - Demo 2020 - 02 Memento.flac"
[INFO] extracted ( 36.09 MiB) "memento-0.8.0/memento. - Demo 2020 - 03 Fate And Forgiveness.flac"
[INFO] extracted ( 39.01 MiB) "memento-0.8.0/memento. - Demo 2020 - 04 Decay.flac"
[INFO] extracted (  3.03 MiB) "memento-0.8.0/cover.jpg"
[INFO] Successfully decompressed archive to "memento-0.8.0"
[INFO] Files unpacked: 5

$ tree -ph memento-0.8.0
[drwxr-xr-x 4.0K]  memento-0.8.0
├── [---S-wx-w- 2.9M]  cover.jpg
├── [---S-wx-w-  46M]  memento. - Demo 2020 - 01 Coexist.flac
├── [---S-wx-w-  33M]  memento. - Demo 2020 - 02 Memento.flac
├── [---S-wx-w-  34M]  memento. - Demo 2020 - 03 Fate And Forgiveness.flac
└── [---S-wx-w-  37M]  memento. - Demo 2020 - 04 Decay.flac

$ LANG=C stat memento-0.8.0/cover.jpg
  File: memento-0.8.0/cover.jpg
  Size: 3026211   	Blocks: 5912       IO Block: 4096   regular file
Device: 254,0	Inode: 671520279   Links: 1
Access: (4032/---S-wx-w-)  Uid: ( 1000/    acid)   Gid: (  100/   users)
Access: 2026-06-07 10:17:22.022803790 +0300
Modify: 2026-06-07 09:52:12.000000000 +0300
Change: 2026-06-07 10:17:22.025803845 +0300
 Birth: 2026-06-07 10:17:22.022803790 +0300

Expected Behavior

$ /run/booted-system/sw/bin/ouch --version
ouch 0.7.1

$ /run/booted-system/sw/bin/ouch d memento.\ -\ Demo\ 2020.zip -d memento-0.7.1
[INFO] Directory "memento-0.7.1" created
[INFO] extracted ( 47.83 MiB) "memento-0.7.1/memento. - Demo 2020 - 01 Coexist.flac"
[INFO] extracted ( 34.28 MiB) "memento-0.7.1/memento. - Demo 2020 - 02 Memento.flac"
[INFO] extracted ( 36.09 MiB) "memento-0.7.1/memento. - Demo 2020 - 03 Fate And Forgiveness.flac"
[INFO] extracted ( 39.01 MiB) "memento-0.7.1/memento. - Demo 2020 - 04 Decay.flac"
[INFO] extracted (  3.03 MiB) "memento-0.7.1/cover.jpg"
[INFO] Successfully decompressed archive to "memento-0.7.1"
[INFO] Files unpacked: 5

$ tree -ph memento-0.7.1
[drwxr-xr-x 4.0K]  memento-0.7.1
├── [-rw-rw-r-- 2.9M]  cover.jpg
├── [-rw-rw-r--  46M]  memento. - Demo 2020 - 01 Coexist.flac
├── [-rw-rw-r--  33M]  memento. - Demo 2020 - 02 Memento.flac
├── [-rw-rw-r--  34M]  memento. - Demo 2020 - 03 Fate And Forgiveness.flac
└── [-rw-rw-r--  37M]  memento. - Demo 2020 - 04 Decay.flac

1 directory, 5 files

$ LANG=C stat memento-0.8.0/cover.jpg
  File: memento-0.8.0/cover.jpg
  Size: 3026211   	Blocks: 5912       IO Block: 4096   regular file
Device: 254,0	Inode: 671520279   Links: 1
Access: (4032/---S-wx-w-)  Uid: ( 1000/    acid)   Gid: (  100/   users)
Access: 2026-06-07 10:17:22.022803790 +0300
Modify: 2026-06-07 09:52:12.000000000 +0300
Change: 2026-06-07 10:17:22.025803845 +0300
 Birth: 2026-06-07 10:17:22.022803790 +0300

Additional Information

somehow I can't reproduce it with other zip files, such as fonts from https://fonts.google.com or some archives i had long before and don't remember where i pulled them from. how can I debug the Bandcamp archives? unlike tar, zip doesn't seem to store Unix permissions

also i'm on NixOS, hence the access to older versions

[marcospb19]

Thanks for the report!

[marcospb19]

Fixed by Tommady

[acid-bong]

looks like it's worth reopening, cuz now the archives are impossible to unpack:

$ result/bin/ouch --version
ouch 0.8.1

$ result/bin/ouch d ~/music/Drain/DRAIN\ -\ Over\ Thinking.zip -d /tmp/drain-new
[INFO] Directory "/tmp/drain-new" created
[ERROR] Permission denied (os error 13)
 - Permission denied

[exit code 1]
$ ls -lah /tmp/drain-new
total 6,6M
drwxr-xr-x  2 acid users   60 июл 12 21:48  .
drwxrwxrwt 18 root root   540 июл 12 21:48  ..
------x---  1 acid users 6,6M июл 12 21:48 'DRAIN - Over Thinking - 01 Eighty-Sixed.flac'

[marcospb19]

@acid-bong did you compile that 0.8.1 binary from source or is it from a pre-compiled package?

Asking to understand if the new landlock code might've be the culprid.

[acid-bong]

from source, will try your pre-compiled in a mo

upd: same stuff with the pre-compiled, i don't understand what the difference would be