feat: use better archives library

[frezbo]

Use better archives library over the forked anchore/archiver library based on mholt/archiver and was not maintained properly.

Also projects importing syft gets a govulncheck warning about:

0.069 excludeVulns = []
0.069 Passing args: ./...
31.92 - GO-2025-4020 (aka CVE-2025-11579, GHSA-rwvp-r38j-9rgg)
31.92
31.92 	DoS risk due to unrestricted RAR dictionary sizes in github.com/nwaples/rardecode

Description

Please include a summary of the changes along with any relevant motivation and context,
or link to an issue where this is explained.

• Fixes

Type of change

• [x ] Chore (improve the developer experience, fix a test flake, etc, without changing the visible behavior of Syft)

This also fixes this dreaded govulncheck on main:

govulncheck ./...
=== Symbol Results ===

Vulnerability #1: GO-2025-4020
    DoS risk due to unrestricted RAR dictionary sizes in
    github.com/nwaples/rardecode
  More info: https://pkg.go.dev/vuln/GO-2025-4020
  Module: github.com/nwaples/rardecode
    Found in: github.com/nwaples/rardecode@v1.1.3
    Fixed in: N/A
    Example traces found:
      #1: syft/source/filesource/file_source.go:259:49: filesource.unarchiveToTmp calls archiver.Rar.Unarchive, which eventually calls rardecode.FileHeader.Mode
      #2: internal/file/tar_file_traversal.go:55:31: file.ExtractGlobsFromTarToUniqueTempFile calls archiver.Walk, which eventually calls rardecode.NewReader
      #3: syft/source/filesource/file_source.go:259:49: filesource.unarchiveToTmp calls archiver.Rar.Unarchive, which eventually calls rardecode.OpenReader
      #4: internal/file/tar_file_traversal.go:55:31: file.ExtractGlobsFromTarToUniqueTempFile calls archiver.Walk, which eventually calls rardecode.ReadCloser.Close
      #5: internal/file/tar_file_traversal.go:55:31: file.ExtractGlobsFromTarToUniqueTempFile calls archiver.Walk, which eventually calls rardecode.Reader.Next
      #6: internal/file/digest.go:37:22: file.NewDigestsFromFile calls io.Copy, which eventually calls rardecode.Reader.Read
      #7: internal/file/digest.go:37:22: file.NewDigestsFromFile calls io.Copy, which eventually calls rardecode.cipherBlockReader.Read
      #8: internal/file/digest.go:37:22: file.NewDigestsFromFile calls io.Copy, which eventually calls rardecode.decodeReader.Read
      #9: syft/source/filesource/file_source.go:13:2: filesource.init calls archiver.init, which calls rardecode.init
      #10: internal/file/digest.go:37:22: file.NewDigestsFromFile calls io.Copy, which eventually calls rardecode.limitedReader.Read
      #11: internal/file/digest.go:37:22: file.NewDigestsFromFile calls io.Copy, which eventually calls rardecode.packedFileReader.Read
      #12: internal/err_helper.go:15:24: internal.CloseAndLogError calls squashfs.File.Close, which eventually calls rardecode.volume.Close

Your code is affected by 1 vulnerability from 1 module.
This scan found no other vulnerabilities in packages you import or modules you
require.
Use '-show verbose' for more details.

This was coded with help from AI and prompting it to do better and some elbow grease

[spiffcs]

We have a PR for this here:
#4029

We're taking a look at getting 4029 merged coming up soon, but there is a change we need to make before merging that to protect against symlink attacks. @frezbo if we merge 4029 does that address your issue?

[frezbo]

We have a PR for this here: #4029

We're taking a look at getting 4029 merged coming up soon, but there is a change we need to make before merging that to protect against symlink attacks. @frezbo if we merge 4029 does that address your issue?

awesome, yes #4029 will work since it drops archiver (I don't see go.mod updated in that PR to import archives though)

I can close this if that's going to be merged

[kzantow]

Since #4029 is close to merging, I'm going to close this PR but thank you very much for the contribution!

[spiffcs]

@frezbo - we merged #4029 - if you see anything else related to this after the next release feel free to ping me or the team and we'll jump on it