chore: migrate syft to use mholt/archives instead of anchore fork

[l-qing]

Description

Please include a summary of the changes along with any relevant motivation and context,
or link to an issue where this is explained.

• Fixes

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (please discuss with the team first; Syft is 1.0 software and we won't accept breaking changes without going to 2.0)
• Documentation (updates the documentation)
• Chore (improve the developer experience, fix a test flake, etc, without changing the visible behavior of Syft)
• Performance (make Syft run faster or use less memory, without changing visible behavior much)

Checklist:

• I have added unit tests that cover changed behavior
• I have tested my code in common scenarios and confirmed there are no regressions
• I have added comments to my code, particularly in hard-to-understand sections

[l-qing]

cherry-pick from: anchore#4029

[kilo-code-bot]

✅ No New Issues - Previous Review Still Valid

19 files reviewed | Confidence: 90% | Recommendation: Approve with monitoring

This PR successfully migrates from anchore/archiver to mholt/archives with significant security and architectural improvements.

Key Improvements Confirmed

• Enhanced Security: Comprehensive symlink attack protection and path traversal prevention
• Modern API: Migrated to visitor pattern with proper context usage
• Better Error Handling: More consistent error patterns and logging
• Code Cleanup: Removed 229 lines of custom ZIP handling in favor of standard library

Security Tests Added

Extensive security test coverage for:

• Path traversal attacks (../../../etc/passwd)
• Symlink-based directory escapes
• Malicious archive extraction scenarios

Dependencies Updated

• Primary: github.com/mholt/archives (replacing github.com/anchore/archiver/v3)
• Supporting: Updated nwaples/rardecode/v2, olekukonko/* packages to latest stable versions
• Removed: Direct golang/snappy dependency (now handled transitively)

Architecture Changes

All archive operations now use the visitor pattern:

archives.Identify(ctx, path, nil)
format.Extract(ctx, reader, visitor)

Status: No New Issues Found

The changes since the previous review are consistent with the original migration plan. No new security concerns, bugs, or architectural issues have been introduced. The comprehensive test suite provides confidence in the changes.

Recommendation

Approve with monitoring - The migration maintains backward compatibility while significantly improving security posture.

[kilo-code-bot]

✅ No Issues Found

19 files reviewed | Confidence: 95% | Recommendation: Approve

This PR successfully migrates from github.com/anchore/archiver/v3 to github.com/mholt/archives with significant security and architectural improvements.

Key Improvements Confirmed

• Enhanced Security: Comprehensive symlink attack protection and path traversal prevention via SafeJoin function
• Modern API: Migrated to visitor pattern with proper context usage throughout
• Better Error Handling: More consistent error patterns and logging
• Code Cleanup: Removed 229 lines of custom ZIP handling in zip_read_closer.go in favor of standard library
• Dependency Updates: Updated supporting packages (nwaples/rardecode/v2, olekukonko/*) to latest stable versions

Security Tests Added

Extensive security test coverage in zip_file_traversal_test.go:

• Path traversal attacks (../../../etc/passwd)
• Symlink-based directory escapes
• Malicious archive extraction scenarios
• Forensic analysis of extraction directories
• Validation of symlink attack prevention

Architecture Changes

All archive operations now use the modern visitor pattern:

// Old API
archiver.ByExtension(path)
archiver.Walk(archivePath, visitor)

// New API  
archives.Identify(ctx, path, nil)
format.Extract(ctx, reader, visitor)

Critical Security Features

1. Path Traversal Protection: SafeJoin ensures archive entries cannot escape extraction directories
2. Context Propagation: All functions properly use context.Context for cancellation and timeouts
3. Symlink Safety: Comprehensive testing confirms symlinks are handled safely
4. Error Containment: Malicious archives are rejected with clear error messages

Status: No Issues Found

The migration maintains backward compatibility while significantly improving the security posture. All existing functionality is preserved with enhanced protection against archive-based attacks.

Recommendation

Approve - This is a high-quality migration that improves both security and code maintainability.

[l-qing]

这个文件是从 上游 main 分支检出的代码。

[l-qing]

这个文件是 AI 帮忙修改的，原来的版本不存在了。