# M12-04J Status

status: done
task: keep malicious ZIP/TAR fixtures in the long-term archive security regression
updated: 2026-08-18 America/New_York
enablingTask: false
parityStateChange: false

## Scope

Six deterministic binary fixtures cover ZIP path traversal, compression-ratio abuse, duplicate
paths, TAR path traversal, symlink escape, and file/directory prefix conflict. The generator fixes
container fields and timestamps; the checker regenerates every file in a temporary directory and
requires byte-for-byte equality with the committed fixtures and catalog SHA-256 values.

The checker reads ZIP EOCD/central-directory and USTAR header metadata, verifies local-header
bindings, TAR checksums, alignment, and end markers, then feeds the actual entry metadata into the
M12-04D/G link and conflict gates. It never invokes `tar`, `unzip`, or an extraction API. All six
fixtures fail closed with `IO_ARCHIVE_UNSAFE` and are included in the existing N-023 Chromium grep.

## Evidence

- `node tools/web/check-malicious-archive-fixtures.mjs` passed 6/6 with three ZIP and three TAR
  fixtures and extraction disabled.
- `WEB_TEST_PORT=5408 npm --prefix web run test:asset-library` passed 2/2, including the persistent
  binary-fixture security test and the existing N-023 asset/IO gate.
- Fixture byte lengths range from 115 to 3,072 bytes and every committed SHA-256 matches the
  generated catalog.

## Artifact Hashes

- parent manifest: `574afa68a787b9481d0e098d38b94cb810a9827fe185b0df796d62cc160ba7c5`
- generator: `b372ea8cb2f97b035ffb2cc18666dae9167dcfb349131851ad9f1ff0fc40ba16`
- checker: `edda2f420f26e55f9990d24b755bb9b4f732ec32c2e072210144b3d0b6634d9b`
- fixture manifest: `a93834316f6a23b8a0e6c1f1f806ec584d6f03aa339c2680cae2ce8133a40e58`
- Chromium spec: `f327500808dd67359a152ce28134b58d027aebd6758416b5535b659b9900bbfe`
- package commands: `cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c`
- manifest: `989d417ab44e165849c7054f331f7038ec1d779349c39dd4f5b30050bbaecf56`

## Next Task

`M12-05A`: generate the glTF/GLB, OBJ, STL, PLY, USD, and Alembic format inventory from the pinned
Blender 5.2 build/runtime.

## Rollback

Remove the fixture generator/checker, six binary fixtures and catalog, Chromium spec, golden
manifest, and this status entry. Restore M12-04I as the queue tail and move the machine queue back to
`M12-04J`. No parity ledger rollback is required.