Remove bz/lzma/xz support from ZIP handling

Signed-off-by: William Woodruff <william@astral.sh>

Remove CompressionMethod APIs entirely

Signed-off-by: William Woodruff <william@astral.sh>

Tear out the rest of the deprecation pathways

Signed-off-by: William Woodruff <william@astral.sh>

Fix `cargo shear`

Signed-off-by: William Woodruff <william@astral.sh>

Bump snapshots

Signed-off-by: William Woodruff <william@astral.sh>

`cargo fmt`

Signed-off-by: William Woodruff <william@astral.sh>

Specialize error messages for unsupported compression methods in zip files

Signed-off-by: William Woodruff <william@astral.sh>

Simplify matches

Signed-off-by: William Woodruff <william@astral.sh>

Author: woodruffw

Cargo.lock

@@ -106,11 +106,8 @@ async-compression = { version = "0.4.12", features = [
 async-trait = { version = "0.1.82" }
 async_http_range_reader = { version = "0.11.0", package = "astral_async_http_range_reader" }
 async_zip = { version = "0.0.17", package = "astral_async_zip", features = [
-  "bzip2",
   "deflate",
-  "lzma",
   "tokio",
-  "xz",
   "zstd",
 ] }
 axoupdater = { version = "0.10.0", default-features = false }
@@ -309,9 +306,6 @@ zeroize = { version = "1.8.1" }
 zip = { version = "8.1.0", default-features = false, features = [
   "deflate",
   "zstd",
-  "bzip2",
-  "lzma",
-  "xz",
 ] }
 zstd = { version = "0.13.3" }
 

Cargo.toml

@@ -772,14 +772,9 @@ async fn download_and_unpack(
 
     let id = reporter.on_download_start(binary.name(), version, size);
     let mut progress_reader = ProgressReader::new(reader, id, reporter);
-    stream::archive(
-        &download_url,
-        &mut progress_reader,
-        format.into(),
-        temp_dir.path(),
-    )
-    .await
-    .map_err(|e| Error::Extract { source: e })?;
+    stream::archive(&mut progress_reader, format.into(), temp_dir.path())
+        .await
+        .map_err(|e| Error::Extract { source: e })?;
     reporter.on_download_complete(id);
 
     // Find the binary in the extracted files

crates/uv-bin-install/src/lib.rs

@@ -47,7 +47,7 @@ pub(crate) async fn validate_zip(
 
     let target = tempfile::TempDir::new()?;
 
-    uv_extract::stream::unzip(args.url.to_url(), reader.compat(), target.path()).await?;
+    uv_extract::stream::unzip(reader.compat(), target.path()).await?;
 
     Ok(())
 }

crates/uv-dev/src/validate_zip.rs

@@ -662,8 +662,6 @@ impl<'a, Context: BuildContext> DistributionDatabase<'a, Context> {
         // Create an entry for the HTTP cache.
         let http_entry = wheel_entry.with_file(format!("{}.http", filename.cache_key()));
 
-        let query_url = &url.clone();
-
         let download = |response: reqwest::Response| {
             async {
                 let size = size.or_else(|| content_length(&response));
@@ -692,7 +690,7 @@ impl<'a, Context: BuildContext> DistributionDatabase<'a, Context> {
                         let mut reader = ProgressReader::new(&mut hasher, progress, &**reporter);
                         match extension {
                             WheelExtension::Whl => {
-                                uv_extract::stream::unzip(query_url, &mut reader, temp_dir.path())
+                                uv_extract::stream::unzip(&mut reader, temp_dir.path())
                                     .await
                                     .map_err(|err| Error::Extract(filename.to_string(), err))?
                             }
@@ -705,7 +703,7 @@ impl<'a, Context: BuildContext> DistributionDatabase<'a, Context> {
                     }
                     None => match extension {
                         WheelExtension::Whl => {
-                            uv_extract::stream::unzip(query_url, &mut hasher, temp_dir.path())
+                            uv_extract::stream::unzip(&mut hasher, temp_dir.path())
                                 .await
                                 .map_err(|err| Error::Extract(filename.to_string(), err))?
                         }
@@ -839,8 +837,6 @@ impl<'a, Context: BuildContext> DistributionDatabase<'a, Context> {
         // Create an entry for the HTTP cache.
         let http_entry = wheel_entry.with_file(format!("{}.http", filename.cache_key()));
 
-        let query_url = &url.clone();
-
         let download = |response: reqwest::Response| {
             async {
                 let size = size.or_else(|| content_length(&response));
@@ -911,7 +907,7 @@ impl<'a, Context: BuildContext> DistributionDatabase<'a, Context> {
 
                     let files = match extension {
                         WheelExtension::Whl => {
-                            uv_extract::stream::unzip(query_url, &mut hasher, temp_dir.path())
+                            uv_extract::stream::unzip(&mut hasher, temp_dir.path())
                                 .await
                                 .map_err(|err| Error::Extract(filename.to_string(), err))?
                         }
@@ -1107,11 +1103,9 @@ impl<'a, Context: BuildContext> DistributionDatabase<'a, Context> {
 
             // Unzip the wheel to a temporary directory.
             let files = match extension {
-                WheelExtension::Whl => {
-                    uv_extract::stream::unzip(path.display(), &mut hasher, temp_dir.path())
-                        .await
-                        .map_err(|err| Error::Extract(filename.to_string(), err))?
-                }
+                WheelExtension::Whl => uv_extract::stream::unzip(&mut hasher, temp_dir.path())
+                    .await
+                    .map_err(|err| Error::Extract(filename.to_string(), err))?,
                 WheelExtension::WhlZst => {
                     uv_extract::stream::untar_zst(&mut hasher, temp_dir.path())
                         .await

crates/uv-distribution/src/distribution_database.rs

@@ -792,8 +792,6 @@ impl<'a, T: BuildContext> SourceDistributionBuilder<'a, T> {
         };
 
         let download = |response| {
-            let query_url = url.clone();
-
             async {
                 // At this point, we're seeing a new or updated source distribution. Initialize a
                 // new revision, to collect the source and built artifacts.
@@ -804,7 +802,7 @@ impl<'a, T: BuildContext> SourceDistributionBuilder<'a, T> {
                 let entry = cache_shard.shard(revision.id()).entry(SOURCE);
                 let algorithms = hashes.algorithms();
                 let hashes = self
-                    .download_archive(query_url, response, source, ext, entry.path(), &algorithms)
+                    .download_archive(response, source, ext, entry.path(), &algorithms)
                     .await?;
 
                 Ok(revision.with_hashes(HashDigests::from(hashes)))
@@ -2264,8 +2262,6 @@ impl<'a, T: BuildContext> SourceDistributionBuilder<'a, T> {
         };
 
         let download = |response| {
-            let query_url = url.clone();
-
             async {
                 // Take the union of the requested and existing hash algorithms.
                 let algorithms = {
@@ -2279,7 +2275,7 @@ impl<'a, T: BuildContext> SourceDistributionBuilder<'a, T> {
                 };
 
                 let hashes = self
-                    .download_archive(query_url, response, source, ext, entry.path(), &algorithms)
+                    .download_archive(response, source, ext, entry.path(), &algorithms)
                     .await?;
                 for existing in revision.hashes() {
                     if !hashes.contains(existing) {
@@ -2313,7 +2309,6 @@ impl<'a, T: BuildContext> SourceDistributionBuilder<'a, T> {
     /// Download and unzip a source distribution into the cache from an HTTP response.
     async fn download_archive(
         &self,
-        query_url: DisplaySafeUrl,
         response: Response,
         source: &BuildableSource<'_>,
         ext: SourceDistExtension,
@@ -2342,7 +2337,7 @@ impl<'a, T: BuildContext> SourceDistributionBuilder<'a, T> {
 
         // Download and unzip the source distribution into a temporary directory.
         let span = info_span!("download_source_dist", source_dist = %source);
-        uv_extract::stream::archive(query_url, &mut hasher, ext, temp_dir.path())
+        uv_extract::stream::archive(&mut hasher, ext, temp_dir.path())
             .await
             .map_err(|err| Error::Extract(source.to_string(), err))?;
         drop(span);
@@ -2411,7 +2406,7 @@ impl<'a, T: BuildContext> SourceDistributionBuilder<'a, T> {
         let mut hasher = uv_extract::hash::HashReader::new(reader, &mut hashers);
 
         // Unzip the archive into a temporary directory.
-        uv_extract::stream::archive(path.display(), &mut hasher, ext, &temp_dir.path())
+        uv_extract::stream::archive(&mut hasher, ext, &temp_dir.path())
             .await
             .map_err(|err| Error::Extract(temp_dir.path().to_string_lossy().into_owned(), err))?;
 

crates/uv-distribution/src/source/mod.rs

@@ -20,7 +20,6 @@ uv-configuration = { workspace = true }
 uv-distribution-filename = { workspace = true }
 uv-pypi-types = { workspace = true }
 uv-static = { workspace = true }
-uv-warnings = { workspace = true }
 
 astral-tokio-tar = { workspace = true }
 async-compression = { workspace = true, features = ["bzip2", "gzip", "zstd", "xz"] }

crates/uv-extract/Cargo.toml

@@ -5,9 +5,9 @@ pub enum Error {
     #[error("I/O operation failed during extraction")]
     Io(#[source] std::io::Error),
     #[error("Invalid zip file")]
-    Zip(#[from] zip::result::ZipError),
+    Zip(#[source] zip::result::ZipError),
     #[error("Invalid zip file structure")]
-    AsyncZip(#[from] async_zip::error::ZipError),
+    AsyncZip(#[source] async_zip::error::ZipError),
     #[error("Invalid tar file")]
     Tar(#[from] tokio_tar::TarError),
     #[error(
@@ -93,6 +93,31 @@ pub enum Error {
     EmptyFilename,
     #[error("Archive contains unacceptable filename: {filename}")]
     UnacceptableFilename { filename: String },
+    #[error(
+        "Archive contains a file with an unsupported compression method; files must be compressed with 'stored', 'DEFLATE', or 'zstd'"
+    )]
+    UnsupportedCompression,
+}
+
+impl From<async_zip::error::ZipError> for Error {
+    fn from(err: async_zip::error::ZipError) -> Self {
+        match err {
+            async_zip::error::ZipError::CompressionNotSupported(_) => Self::UnsupportedCompression,
+            o => Self::AsyncZip(o),
+        }
+    }
+}
+
+impl From<zip::result::ZipError> for Error {
+    fn from(err: zip::result::ZipError) -> Self {
+        match err {
+            // NOTE: No structured error from the zip crate, so we need to sniff the message.
+            zip::result::ZipError::UnsupportedArchive("Compression method not supported") => {
+                Self::UnsupportedCompression
+            }
+            o => Self::Zip(o),
+        }
+    }
 }
 
 impl Error {

crates/uv-extract/src/error.rs

@@ -1,4 +1,4 @@
-use std::{fmt::Display, sync::LazyLock};
+use std::sync::LazyLock;
 
 pub use error::Error;
 use regex::Regex;
@@ -14,64 +14,6 @@ mod vendor;
 static CONTROL_CHARACTERS_RE: LazyLock<Regex> = LazyLock::new(|| Regex::new(r"\p{C}").unwrap());
 static REPLACEMENT_CHARACTER: &str = "\u{FFFD}";
 
-/// Compression methods that we consider supported.
-///
-/// Our underlying ZIP dependencies may support more.
-pub(crate) enum CompressionMethod {
-    Stored,
-    Deflated,
-    Zstd,
-    // NOTE: This will become `Unsupported(...)` in the future.
-    Deprecated(&'static str),
-}
-
-impl CompressionMethod {
-    /// Returns `true` if this is a well-known compression method that we
-    /// expect other ZIP implementations to support.
-    pub(crate) fn is_well_known(&self) -> bool {
-        matches!(self, Self::Stored | Self::Deflated | Self::Zstd)
-    }
-}
-
-impl Display for CompressionMethod {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Stored => write!(f, "stored"),
-            Self::Deflated => write!(f, "DEFLATE"),
-            Self::Zstd => write!(f, "zstd"),
-            Self::Deprecated(name) => write!(f, "{name}"),
-        }
-    }
-}
-
-impl From<async_zip::Compression> for CompressionMethod {
-    fn from(value: async_zip::Compression) -> Self {
-        match value {
-            async_zip::Compression::Stored => Self::Stored,
-            async_zip::Compression::Deflate => Self::Deflated,
-            async_zip::Compression::Zstd => Self::Zstd,
-            async_zip::Compression::Bz => Self::Deprecated("bzip2"),
-            async_zip::Compression::Lzma => Self::Deprecated("lzma"),
-            async_zip::Compression::Xz => Self::Deprecated("xz"),
-            _ => Self::Deprecated("unknown"),
-        }
-    }
-}
-
-impl From<zip::CompressionMethod> for CompressionMethod {
-    fn from(value: zip::CompressionMethod) -> Self {
-        match value {
-            zip::CompressionMethod::Stored => Self::Stored,
-            zip::CompressionMethod::Deflated => Self::Deflated,
-            zip::CompressionMethod::Zstd => Self::Zstd,
-            zip::CompressionMethod::Bzip2 => Self::Deprecated("bzip2"),
-            zip::CompressionMethod::Lzma => Self::Deprecated("lzma"),
-            zip::CompressionMethod::Xz => Self::Deprecated("xz"),
-            _ => Self::Deprecated("unknown"),
-        }
-    }
-}
-
 /// Validate that a given filename (e.g. reported by a ZIP archive's
 /// local file entries or central directory entries) is "safe" to use.
 ///