chore(flare): drop mholt/archiver for stdlib archive/zip

[wdhif]

What does this PR do?

Replaces the single github.com/mholt/archiver/v3 call site in kubectl datadog flare
with the standard library's archive/zip, and drops the dependency.

• cmd/kubectl-datadog/flare/flare.go: new archiveDir() helper replaces
  archiver.NewZip().Archive(); the zip *archiver.Zip field on options is gone.
• cmd/kubectl-datadog/flare/archive_test.go: new unit test pinning the archive layout
  (top-level folder, nested dirs, non-regular files skipped).
• go.mod / go.sum / LICENSE-3rdparty.csv: removes 1 direct + 9 indirect modules.

No user-facing change to the flare command.

Motivation

mholt/archiver/v3 is deprecated and frozen at v3.5.1, which carries two path traversal
advisories:

advisory	severity	vector
CVE-2025-3445	High (8.1)	Zip Slip via a crafted zip
CVE-2024-0406	Moderate (6.1)	path traversal via a crafted tar

Both are reachable only through archiver.Unarchive, and neither can be cleared by a
version bump: no fix was ever published — v3.5.1 is the last version on the module proxy,
so the 3.5.2 that some scanners cite as the patched release does not exist — and
upstream's only remediation is the rename to mholt/archives.

The flare command only ever wrote a zip of a single directory, so the vulnerable
extraction path was never reachable from the operator, but the dependency still shows up in
dependency scans with no remediation available in place.

Migrating to mholt/archives was the other option and was rejected: it is pre-1.0
(v0.1.5, no API stability commitment) and it grows the footprint, requiring ~14 modules
(adding bodgit/sevenzip, STARRY-S/zip, minio/minlz, sorairolake/lzip-go,
mikelolasagasti/xz, spf13/afero, hashicorp/golang-lru) — i.e. pulling 7z/rar/lzip
decoders into the operator in order to write one zip.

Going to the standard library instead removes 10 modules for ~60 lines of code:

	before	after
modules attributable to this dep	10	0
LICENSE-3rdparty.csv rows	9	0
kubectl-datadog binary	163.0 MB	161.1 MB

The removed set includes github.com/xi2/xz, which we currently ship with its license
listed as Unknown.

Additional Notes

Output equivalence. Zipping one real flare directory with both implementations produces
identical entry names and order, directory entries, compression methods, CRC32s,
uncompressed sizes, decompressed bytes, flag bits, creator/extract versions, permissions
(0755 dir / 0644 files), DOS timestamps and extended-timestamp extra fields.

The one observable difference is compressed size — archiver deflated through
github.com/klauspost/compress/zip rather than archive/zip, so the same input now yields
a slightly smaller archive:

entry	archiver v3	stdlib
datadog-custom-resources.yaml	2610	2385
<pod>-metrics.txt	3899	3712
<pod>-status.txt	749	735
<pod>.json	2593	2501
total	9851	9333 (−5.3%)

Same DEFLATE format, so no consumer is affected.

One latent behaviour difference: archiver had SelectiveCompression, which stored
files whose extension is already compressed (.gz, .png, .zip, …); archiveDir always
deflates. The flare only ever writes .yaml, .txt and .json, so this is unreachable
today — replicating it would mean copying a 30-entry extension map for no gain.

go.work.sum picks up 3 /go.mod hashes (brotli, snappy, pierrec/lz4) that moved
out of go.sum when the modules left the main module's graph. Stable across make sync +
rebuild.

Minimum Agent Versions

None — the change is confined to the kubectl plugin.

• Agent: n/a
• Cluster Agent: n/a

Describe your test plan

Automated: make lint, go build ./..., go test ./... (106 packages ok, 0 failures),
make verify-licenses (exit 0, no diff).

Manual, on minikube (minikube start, Kubernetes v1.35.1) with operator 1.28.0 installed
from the datadog-operator Helm chart plus a DatadogAgent CR:

1. Build the plugin before and after the change:
   go build -o /tmp/flare-before ./cmd/kubectl-datadog/main.go on main, same for this
   branch. go version -m on each confirms github.com/mholt/archiver/v3 is linked into
   the first and absent from the second.
2. Run each with an isolated TMPDIR so the artifacts don't collide:
   TMPDIR=/tmp/before; echo n | /tmp/flare-before flare --email <you> --apiKey <key>.
   Answer n at the upload prompt — the flare is written locally and nothing is sent to
   Datadog.
3. Compare the two archives: same entries, order, directory entry, compression methods and
   permissions. The collected -metrics.txt and .json payloads differ only because they
   carry live counter and log data; the stable files (datadog-custom-resources.yaml,
   -status.txt) come out with identical CRCs and content hashes.
4. For a controlled comparison, zip the same directory with both implementations, then
   unzip both and diff -r — extracted trees are byte-identical, verified per file with
   shasum -a 256. Every zip header field matches except compress_size.
5. unzip -t <flare>.zip reports no errors on the new archive, and the collected
   datadog-custom-resources.yaml still has the API key redacted.

Checklist

• PR has at least one valid label: bug, enhancement, refactoring,
  documentation, tooling, and/or dependencies
• PR has a milestone or the qa/skip-qa label
• All commits are signed (see: signing commits)

[datadog-datadog-prod-us1]

 

✨ Unblock PR with BitsAI

🛑 Gate Violations

🎯 1 Code Coverage issue detected

A Patch coverage percentage gate may be blocking this PR.

• Patch coverage: 65.79% (threshold: 80.00%)

⚠️ Warnings

🚦 1 Pipeline job failed

DataDog/datadog-operator | check_formatting — 🔧 Needs a code fix, caused by this PR

View in Datadog · View in GitLab

ℹ️ Info

🎯 Code Coverage (details)
• Patch Coverage: 65.79%
• Overall Coverage: 50.54% (+0.44%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 4209b87 | Docs | View more details | Give us feedback!}

[wdhif]

/dd-review codex