fix: don't fail on malformed tar headers (#6674)

close #5362

.changeset/orange-garlics-compete.md

@@ -0,0 +1,6 @@
+---
+"@pnpm/cafs": patch
+"pnpm": patch
+---
+
+Don't fail when a package is archived in a tarball with malformed tar headers [#5362](https://github.com/pnpm/pnpm/issues/5362).

store/cafs/src/addFilesFromTarball.ts

@@ -11,7 +11,7 @@ export async function addFilesFromTarball (
   manifest?: DeferredManifestPromise
 ): Promise<FilesIndex> {
   const ignore = _ignore ?? (() => false)
-  const extract = tar.extract()
+  const extract = tar.extract({ allowUnknownFormat: true })
   const filesIndex: FilesIndex = {}
   await new Promise<void>((resolve, reject) => {
     extract.on('entry', (header, fileStream, next) => {

store/cafs/test/index.ts

@@ -74,3 +74,11 @@ test('file names are normalized when unpacking a tarball', async () => {
     'package.json',
   ])
 })
+
+test('broken magic in tarball headers is handled gracefully', async () => {
+  const dest = tempy.directory()
+  const cafs = createCafs(dest)
+  await cafs.addFilesFromTarball(
+    createReadStream(path.join(__dirname, 'fixtures/jquery.dirtyforms-2.0.0.tgz'))
+  )
+})