Repository: ossf/package-analysis (language: python)

Issue:
support extracting zip archives
Some packages such as [`proactive-jupyter-kernel`](https://pypi.org/project/proactive-jupyter-kernel/) upload their source as a zip file which currently fails as the static analysis archive extraction expects a .tar.gz file.

We should do filetype detection using `file` (NOT the file extension) so that we can do static analysis on zip archives too 


Discussion / hints:
code to be updated seem to be at https://github.com/ossf/package-analysis/blob/c473e2d466d9a01425528ffdc2456246feb45c8c/internal/utils/archive_extract.go#L16

might you be open to introducing something like https://github.com/mholt/archiver?
Hi @gliptak, yes that's a good suggestion! I'd be open to introducing something like that. Please feel free to submit a PR.

Fix patch:
diff --git a/internal/pkgmanager/npm.go b/internal/pkgmanager/npm.go
index 0389fb98..fe209cb4 100644
--- a/internal/pkgmanager/npm.go
+++ b/internal/pkgmanager/npm.go
@@ -88,5 +88,5 @@ var npmPkgManager = PkgManager{
 	latestVersion:   getNPMLatest,
 	archiveURL:      getNPMArchiveURL,
 	archiveFilename: getNPMArchiveFilename,
-	extractArchive:  utils.ExtractTarGzFile,
+	extractArchive:  utils.ExtractArchiveFile,
 }
diff --git a/internal/pkgmanager/pypi.go b/internal/pkgmanager/pypi.go
index 79bc6354..df893a0b 100644
--- a/internal/pkgmanager/pypi.go
+++ b/internal/pkgmanager/pypi.go
@@ -83,5 +83,5 @@ var pypiPkgManager = PkgManager{
 	latestVersion:   getPyPILatest,
 	archiveURL:      getPyPIArchiveURL,
 	archiveFilename: defaultArchiveFilename,
-	extractArchive:  utils.ExtractTarGzFile,
+	extractArchive:  utils.ExtractArchiveFile,
 }
diff --git a/internal/utils/archive_extract.go b/internal/utils/archive_extract.go
index a35646e9..18d9dfc2 100644
--- a/internal/utils/archive_extract.go
+++ b/internal/utils/archive_extract.go
@@ -11,10 +11,10 @@ import (
 	"strings"
 )
 
-// ExtractTarGzFile extracts a .tar.gz / .tgz file located at tgzPath,
+// ExtractArchiveFile extracts a .tar.gz / .tgz file located at archivePath,
 // using outputDir as the root of the extracted files.
-func ExtractTarGzFile(tgzPath string, outputDir string) error {
-	f, err := os.Open(tgzPath)
+func ExtractArchiveFile(archivePath string, outputDir string) error {
+	f, err := os.Open(archivePath)
 	if err != nil {
 		return err
 	}


Test patch:
diff --git a/internal/utils/archive_extract_test.go b/internal/utils/archive_extract_test.go
index 2db23225..dba1c2f5 100644
--- a/internal/utils/archive_extract_test.go
+++ b/internal/utils/archive_extract_test.go
@@ -107,7 +107,7 @@ func doExtractionTest(archivePath, extractPath string, archiveHeaders []*tar.Hea
 
 	log.Initialize("")
 
-	if err = ExtractTarGzFile(archivePath, extractPath); err != nil {
+	if err = ExtractArchiveFile(archivePath, extractPath); err != nil {
 		return fmt.Errorf("extract failed: %w", err)
 	}