zip

zip is a Rust crate implementing the PKWARE ZIP file format (per APPNOTE.TXT v6.3.9), providing both a ZipArchive reader and a ZipWriter for creating and appending to ZIP files. It supports a wide range of compression methods behind feature flags — Stored, Deflate (via a built-in implementation, flate2, or the higher-ratio zopfli), Deflate64, Bzip2, LZMA, XZ, PPMd, and Zstandard — as well as AES and legacy ZipCrypto encryption for both reading and writing protected archives.

Published on crates.io as zip (the repository itself is named zip2, reflecting a fork/continuation of the original zip-rs project under new maintainers), it’s one of the most widely used Rust crates for ZIP handling, supporting streaming reads, in-place archive merging, and WASM targets with a reduced feature set.

What You Get

• ZipArchive::new() for random-access reading of existing ZIP files, plus streaming readers for processing archives from stdin or a network stream
• ZipWriter::new(), new_append(), and new_stream() for creating, appending to, or streaming new ZIP archives
• Feature-gated support for Stored, Deflate, Deflate64, Bzip2, LZMA, XZ, PPMd, and Zstandard compression methods
• AES (AE-1/AE-2) and legacy ZipCrypto encryption and decryption support
• A merge_archive() API for combining archives, and WASM compatibility with a reduced default feature set

Common Use Cases

• Building CLI or GUI archive tools that need to read, extract, or create ZIP files in Rust
• Packaging build artifacts, game assets, or application bundles into ZIP archives programmatically
• Implementing servers or CLIs that stream ZIP contents in or out without buffering the entire archive in memory
• Handling password-protected ZIP files that use AES or legacy ZipCrypto encryption

Under The Hood

Architecture: The crate is organized around src/read/ (containing zip_archive.rs, zipfile.rs, readers.rs, stream.rs, and magic_finder.rs for locating the end-of-central-directory record) and a single large src/write.rs (over 4,500 lines) implementing ZipWriter; shared format concerns live in src/format/, src/spec.rs, and src/types.rs, while each compression backend is isolated so features can be toggled independently. src/legacy/ and src/extra_fields/ handle backward-compatible extension parsing (NTFS timestamps, Unix permissions, Zip64) — reflecting the format’s long history of vendor extensions that a spec-compliant reader must tolerate. Tech Stack: Modern Rust (2024 edition, MSRV 1.88) with an unusually large, all-optional dependency surface (flate2, bzip2, lzma-rs-style crates, zstd, ppmd-rust, aes, hmac, pbkdf2, sha1, constant_time_eq for encryption) gated behind Cargo features so consumers pull in only the codecs they need; indexmap and memchr support the central-directory index and byte-scanning respectively. Code Quality: The project runs continuous AFL-based fuzzing against both its read and write paths (documented fuzzing workflows for fuzz_read/fuzz_write using cargo afl and arbitrary), a strong signal for a format-parsing library that must safely handle adversarial or corrupted input; a benches/ directory and tests/ suite with real ZIP fixture files under multiple licenses further exercise compatibility against files produced by other tools. API Design: Reading and writing are cleanly separated (ZipArchive vs ZipWriter) and encryption/compression are opt-in via FileOptions, so a minimal build can support just Stored/Deflate while advanced users layer in AES, Zstandard, or PPMd without changing call sites — the tradeoff is that consumers must understand which Cargo features to enable to get support for archives produced by other tools (e.g. 7-Zip’s PPMd-compressed ZIPs).