Merge pull request #1479 from socketpair/magic

Fix: #1478: Use regex for file(1) magic matching; add .zip and .zstd support

Author: danigm

rpmlint/checks/SourceCheck.py

@@ -8,12 +8,16 @@ class SourceCheck(AbstractCheck):
     Validate files in a source package.
     """
     source_regex = re.compile(r'\.(tar|tgz)$')
+
+    # Regex patterns. Applied to a string from file(1) tool.
     compressed_fileext_magic = {
-        'xz': 'XZ compressed',
-        'gz': 'gzip compressed',
-        'tgz': 'gzip compressed',
-        'bz2': 'bzip2 compressed',
-        'zst': 'ZSTD compressed',
+        'xz': r'XZ compressed',
+        'gz': r'gzip compressed',
+        'tgz': r'gzip compressed',
+        'bz2': r'bzip2 compressed',
+        'zst': r'(ZSTD|Zstandard) compressed',
+        'zstd': r'(ZSTD|Zstandard) compressed',
+        'zip': r'Zip archive data',
     }
 
     def __init__(self, config, output):
@@ -45,12 +49,16 @@ def _check_file_ext(self, fname, pkgfile, pkg):
         """
         Check if the filename extension is the same as what file(1) says.
         """
+        if not pkgfile.magic:
+            return
         file_ext = fname.rpartition('.')[2]
-
-        if (file_ext in self.compressed_fileext_magic and
-            pkgfile.magic and
-                self.compressed_fileext_magic[file_ext] not in pkgfile.magic):
-            self.output.add_info('W', pkg, 'inconsistent-file-extension', fname)
+        pattern = self.compressed_fileext_magic.get(file_ext)
+        if pattern is None:
+            return  # file(1) pattern is unknown for given file extension
+        if re.match(pattern, pkgfile.magic, re.IGNORECASE):
+            return
+        self.output.add_info('W', pkg, 'inconsistent-file-extension',
+                             f'file {fname!r} magic {pkgfile.magic!r} does not match {pattern!r}')
 
     def _check_permissions(self, fname, pkgfile, pkg):
         """

test/files/magic/.gitignore

@@ -0,0 +1 @@
+!*

test/files/magic/byte.bz2

@@ -2,7 +2,7 @@
 from rpmlint.checks.SourceCheck import SourceCheck
 from rpmlint.filter import Filter
 
-from Testing import CONFIG, get_tested_package
+from Testing import CONFIG, get_tested_mock_package, get_tested_package
 
 
 @pytest.fixture(scope='function', autouse=True)
@@ -39,3 +39,91 @@ def test_compression_and_multispec(tmp_path, package, sourcescheck):
 
     assert 'multiple-specfiles' in out
     assert 'package contains multiple spec files' in out
+
+
+# ── Tests for _check_file_ext (compressed_fileext_magic matching) ──
+#
+# Test data: test/files/magic/ contains small compressed files, each holding
+# a single byte 'x'.  Created with standard CLI tools:
+#
+#   echo -n x | gzip -n  > byte.gz     # -n omits filename/timestamp
+#   echo -n x | bzip2    > byte.bz2
+#   echo -n x | xz       > byte.xz
+#   echo -n x | zstd -q  > byte.zst
+#   echo -n x > 0                      # zip needs a file on disk
+#   touch -t 200001010000.00 0         # fixed timestamp for reproducibility
+#   TZ=UTC zip -0 -j byte.zip 0       # -0 store, -j junk paths
+#   rm 0
+#
+# In Python (bz2 is byte-identical to CLI; others differ in internal
+# flags but are functionally equivalent):
+#   gzip.compress(b'x', mtime=0)
+#   bz2.compress(b'x')
+#   lzma.compress(b'x', format=lzma.FORMAT_XZ)
+#   zstandard.ZstdCompressor().compress(b'x')
+
+
+@pytest.mark.parametrize('ext, content_file', [
+    ('gz', 'files/magic/byte.gz'),
+    ('tgz', 'files/magic/byte.gz'),   # tgz is gzip too
+    ('bz2', 'files/magic/byte.bz2'),
+    ('xz', 'files/magic/byte.xz'),
+    ('zst', 'files/magic/byte.zst'),
+    ('zstd', 'files/magic/byte.zst'),  # .zstd is the same format
+    ('zip', 'files/magic/byte.zip'),
+])
+def test_file_ext_consistent(sourcescheck, ext, content_file):
+    """Extension matches actual compression format → no warning."""
+    output, test = sourcescheck
+    pkg = get_tested_mock_package(
+        files={f'archive.{ext}': {'content-path': content_file}},
+    )
+    test.check_source(pkg)
+    out = output.print_results(output.results)
+    assert 'inconsistent-file-extension' not in out
+
+
+@pytest.mark.parametrize('ext, content_file', [
+    ('gz', 'files/magic/byte.bz2'),
+    ('bz2', 'files/magic/byte.gz'),
+    ('xz', 'files/magic/byte.zst'),
+    ('zst', 'files/magic/byte.gz'),
+    ('zstd', 'files/magic/byte.xz'),
+    ('zip', 'files/magic/byte.gz'),
+])
+def test_file_ext_inconsistent(sourcescheck, ext, content_file):
+    """Extension does NOT match actual compression format → warning."""
+    output, test = sourcescheck
+    pkg = get_tested_mock_package(
+        files={f'archive.{ext}': {'content-path': content_file}},
+    )
+    test.check_source(pkg)
+    out = output.print_results(output.results)
+    assert 'inconsistent-file-extension' in out
+
+
+@pytest.mark.parametrize('fname', [
+    'archive.gz',
+    'archive.tar',
+    'archive.txt',
+])
+def test_file_ext_no_magic(sourcescheck, fname):
+    """File with no magic string (empty content) → no crash, no warning."""
+    output, test = sourcescheck
+    pkg = get_tested_mock_package(
+        files={fname: {'metadata': {'magic': None}}},
+    )
+    test.check_source(pkg)
+    out = output.print_results(output.results)
+    assert 'inconsistent-file-extension' not in out
+
+
+def test_file_ext_unknown_extension(sourcescheck):
+    """Extension not in compressed_fileext_magic → no warning."""
+    output, test = sourcescheck
+    pkg = get_tested_mock_package(
+        files={'archive.lz4': {'content-path': 'files/magic/byte.gz'}},
+    )
+    test.check_source(pkg)
+    out = output.print_results(output.results)
+    assert 'inconsistent-file-extension' not in out