Three bytes in a zip file

[Fay Stegerman]

* Fay Stegerman <flx at obfusk.net> [2024-03-08 02:37]:
> * Larry Doolittle <larry at doolittle.boa.org> [2023-04-06 23:59]:
> > Do you know of any tooling that can help decode zip file contents in general?
> 
> I know this thread is almost a year old now, but I finally got to my backlog
> working on diff-zip-meta.py [1], which is a tool specifically intended to
> elucidated differences in ZIP/APK metadata.  And as of today, the master branch
> supports showing the kind of timestamp differences you reported in
> human-readable form, not just as a difference in the raw data:
> 
> $ diff-zip-meta foo.zip bar.zip
> --- foo.zip
> +++ bar.zip
> entry foo:
>   extra (entry):
> -   55540900035164ea655164ea6575780b000104e803000004e8030000
> +   55540900035164ea655464ea6575780b000104e803000004e8030000
> - extra (entry) atime=2024-03-08 01:05:21
> + extra (entry) atime=2024-03-08 01:05:24
> 
> - Fay
> 
> [1] https://github.com/obfusk/reproducible-apk-tools#diff-zip-metapy

I almost forgot: zipdetails (that comes with perl) can also show this difference
(and quite a lot of other things, though its output is not usually so easy to
diff which is why I tend to prefer my own tools -- diff-zip-meta, zipinfo.py,
apksigtool -- but it might be easier to use that for diffoscope, at least for
now):

$ diff -Naur <( zipdetails atime1.zip ) <( zipdetails atime2.zip )
@@ -15,7 +15,7 @@
 0023   Length              0009
 0025   Flags               '03 mod access'
 0026   Mod Time            65EB87EA 'Fri Mar  8 22:49:30 2024'
-002A   Access Time         65EB87EA 'Fri Mar  8 22:49:30 2024'
+002A   Access Time         65EB87EE 'Fri Mar  8 22:49:34 2024'
 002E Extra ID #0002        7875 'ux: Unix Extra Type 3'
 0030   Length              000B
 0032   Version             01

- Fay