Cannot read Zip artifacts due to `Zip::GPFBit3Error: General purpose flag Bit 3 is set so not possible to get proper info from local header`

Summary

In !94107 (merged), we added a new adapter allowing for GitLab to read files from zip JobArtifacts. We added unit tests for this using zip files produced from the zip command line utility, but neglected to perform full integration tests. It seems that the zip which are produced by gitlab-runner are missing necessary metadata which is expected by the rubyzip library, which causes an error to be raised when trying to read the zip artifacts.

There is currently no code performing these reads, so this bug is not user-facing.

Steps to reproduce

  1. Ensure your GDK has gitlab-runner set up

  2. Create a new project

  3. Create a .gitlab-ci.yml file in the project with this configuration:

    persist_sbom:
      image: alpine:latest
      script: wget https://gitlab.com/-/snippets/2378046/raw/main/gl-sbom-npm-npm.cdx.json
      artifacts:
        reports:
          cyclonedx:
            - gl-sbom-npm-npm.cdx.json
  4. Allow the job to run and note down the pipeline id

  5. Start the rails console: bundle exec rails c

  6. Run this ruby code:

    pipeline = Ci::Pipeline.find(pipeline_id)
    pipeline.sbom_reports
  7. Receive error:

    Zip::GPFBit3Error: General purpose flag Bit 3 is set so not possible to get proper info from local header.Please 
    use ::Zip::File instead of ::Zip::InputStream
    from /Users/bwilliams/.asdf/installs/ruby/2.7.5/lib/ruby/gems/2.7.0/gems/rubyzip-2.3.2/lib/zip/input_stream.rb:132:in `open_entry'

What is the current bug behavior?

An error is raised

What is the expected correct behavior?

Gitlab::Ci::Reports::Sbom::Reports should be returned

Possible fixes

Edited by Brian Williams